Module 7 of StartCloud's Essential Eight for Australian Business pathway, in five short units with a knowledge check: a suggested implementation order sequenced by protection gained per dollar and per disruption, which controls a Microsoft 365 Business Premium licence already covers versus what is a genuine extra cost, a realistic ninety day plan starting with assessment and the free wins, and the four common ways an Essential Eight program derails.
Where to Actually Start
The order that actually works
ASD lists the eight in its own order, but that list is not a project plan. If you are starting from Level Zero with a real budget and a business to run, the practical question is which one to touch first.
This is our suggested order, not an official one. It is sequenced by protection gained per dollar and per disruption caused, which is how most businesses should think about it.
- 1
Multi-factor authentication
Highest protection for the least money and disruption, and the one an insurer asks about first. If you have done the Microsoft 365 pathway this is already behind you.
- 2
Restrict administrative privileges
Costs nothing but a careful afternoon and a bit of discipline afterwards. It also quietly limits the damage of almost every other failure, which is why it earns its place early.
- 3
Regular backups, tested
You may already have backups. What you probably do not have is a tested restore and a record of it. This is the control an assessor can check in ten minutes, so it is worth being genuinely ready.
- 4
Patch applications, then operating systems
Mostly a process problem rather than a product one. Decide who is responsible, decide how quickly, and get visibility of what is actually installed rather than what you think is.
- 5
Restrict Microsoft Office macros
Usually a policy change rather than a purchase. The hard part is finding the one spreadsheet in accounts that genuinely needs macros, and handling it as a documented exception.
- 6
User application hardening
Browser and reader settings, mostly configuration. Fiddly across a fleet without device management, which is why it tends to arrive alongside a tool rather than before one.
- 7
Application control
Last, deliberately. It is the most disruptive of the eight and the one most likely to stall a program if attempted first. Do it when the other seven are steady.
You are aiming for the same level across all eight. This order is about sequencing the work, not about picking favourites and stopping. Until the seventh one is done, your maturity is whatever the seventh one says it is.