--- title: "Essential Eight: Where to Actually Start | StartCloud" url: https://startcloud.au/learn/essential-eight-where-to-start description: "Module 7 of our free Essential Eight pathway: a practical order to tackle the eight controls, what Microsoft 365 already gives you, what actually costs money, a realistic ninety day plan, and the four ways these programs usually derail." lang: en --- Module 7 of StartCloud's Essential Eight for Australian Business pathway, in five short units with a knowledge check: a suggested implementation order sequenced by protection gained per dollar and per disruption, which controls a Microsoft 365 Business Premium licence already covers versus what is a real extra cost, a realistic ninety day plan starting with assessment and the free wins, and the four common ways an Essential Eight program derails. # Where to actually start Module 7 · Plan Unit 1 of 5 · about 3 min ## The order that actually works ASD lists the eight in its own order, but that list is not a project plan. If you are starting from Level Zero with a real budget and a business to run, the practical question is which one to touch first. This is our suggested order, not an official one. It is sequenced by **protection gained per dollar and per disruption caused**, which is how most businesses should think about it. 1. 1 Multi-factor authentication Highest protection for the least money and disruption, and the one an insurer asks about first. If you have done the Microsoft 365 pathway this is already behind you. 2. 2 Restrict administrative privileges Costs nothing but a careful afternoon and a bit of discipline afterwards. It also limits the damage of almost every other failure, which is why it earns its place early. 3. 3 Regular backups, tested You may already have backups. What you probably do not have is a tested restore and a record of it. This is the control an assessor can check in ten minutes, so it pays to be ready. 4. 4 Patch applications, then operating systems Mostly a process problem rather than a product one. Decide who is responsible, decide how quickly, and get visibility of what is actually installed rather than what you think is. 5. 5 Restrict Microsoft Office macros Usually a policy change rather than a purchase. The hard part is finding the one spreadsheet in accounts that actually needs macros, and handling it as a documented exception. 6. 6 User application hardening Browser and reader settings, mostly configuration. Fiddly across a fleet without device management, which is why it tends to arrive alongside a tool rather than before one. 7. 7 Application control Last, deliberately. It is the most disruptive of the eight and the one most likely to stall a program if attempted first. Do it when the other seven are steady. Remember the rule from module 2 You are aiming for the same level across all eight. This order is about sequencing the work, not about picking favourites and stopping. Until the seventh one is done, your maturity is whatever the seventh one says it is. StartCloud assistant Online G'day! 👋 I'm the StartCloud assistant. How can I help you today? ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "LocalBusiness", "ProfessionalService" ], "@id": "https://startcloud.au/#business", "name": "StartCloud", "legalName": "Start Technologies Pty Ltd", "alternateName": "StartCloud Australia", "identifier": { "@type": "PropertyValue", "propertyID": "ABN", "value": "17 676 121 449" }, "slogan": "Go Beyond", "description": "StartCloud is Perth's cybersecurity-first AI MSP: managed IT, Essential Eight security, Microsoft 365 and cloud, networking, and practical AI for Australian businesses with 5 to 50 staff.", "url": "https://startcloud.au", "logo": "https://startcloud.au/og-image.png", "image": "https://startcloud.au/og-image.png", "telephone": "+61862850001", "email": "web@startcloud.com.au", "priceRange": "$$", "currenciesAccepted": "AUD", "paymentAccepted": "Invoice", "foundingDate": "2023", "contactPoint": { "@type": "ContactPoint", "telephone": "+61862850001", "contactType": "customer service", "areaServed": "AU", "availableLanguage": "English" }, "address": { "@type": "PostalAddress", "streetAddress": "Ground Floor West, 6 Gibberd Road", "addressLocality": "Balcatta", "addressRegion": "WA", "postalCode": "6021", "addressCountry": "AU" }, "geo": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "07:00", "closes": "16:30", "description": "General support hours" }, { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday" ], "opens": "00:00", "closes": "23:59", "description": "Security Operations Centre (SOC) with 24/7/365 threat monitoring" } ], "areaServed": [ { "@type": "City", "name": "Perth" }, { "@type": "State", "name": "Western Australia" }, { "@type": "Country", "name": "Australia" } ], "serviceArea": { "@type": "GeoCircle", "geoMidpoint": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "geoRadius": "50000" }, "knowsAbout": [ "Cybersecurity", "Managed Security Services", "Essential Eight", "Microsoft 365", "Microsoft Azure", "IT Support", "Network Security", "Disaster Recovery", "Compliance Management", "Microsoft Copilot", "AI Readiness", "AI Governance", "AI Agent Development" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "IT and Cybersecurity Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity Services", "url": "https://startcloud.au/cybersecurity" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT Services and Support", "url": "https://startcloud.au/technology" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft 365 and Cloud Solutions", "url": "https://startcloud.au/cloud" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed Networking", "url": "https://startcloud.au/networking" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI and Automation", "url": "https://startcloud.au/ai" } } ] }, "sameAs": [ "https://www.linkedin.com/company/startcloudau", "https://www.facebook.com/startcloudaus/", "https://www.cloudtango.net/providers/12375/startcloud", "https://clutch.co/profile/startcloud", "https://abr.business.gov.au/ABN/View?abn=17676121449", "https://www.yellowpages.com.au/balcatta-wa/bpp/startcloud-581735301", "https://www.truelocal.com.au/balcatta-wa/tlp/startcloud-581735301", "https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj" ] }, { "@context": "https://schema.org", "@type": "LearningResource", "name": "Where to Actually Start", "description": "Module 7 of the Essential Eight for Australian Business pathway: implementation order, what your licence already covers, a ninety day plan, and what derails these programs.", "educationalLevel": "Intermediate", "learningResourceType": "Module", "isPartOf": { "@type": "Course", "name": "Essential Eight for Australian Business", "url": "https://startcloud.au/learn/essential-eight-for-australian-business", "provider": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" } }, "author": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" }, "datePublished": "2026-08-13", "dateModified": "2026-08-13", "url": "https://startcloud.au/learn/essential-eight-where-to-start" } ] ```