Module 1 of StartCloud's Essential Eight for Australian Business pathway, in five short units with a knowledge check: the framework's origin at the Australian Signals Directorate, the eight mitigation strategies in ASD's own order with a one-line meaning for each, the four maturity levels at a glance, who asks about it in practice (cyber insurers, government tenders, customer security questionnaires), what it deliberately does not cover (operational technology, enterprise mobility, and everything beyond the baseline), and why vague claims of being 'Essential Eight aligned' fail under scrutiny.

Pathway overview

Pathway

Essential Eight for Australian business

0 of 5 units done in this module

What is the Essential Eight, and who is asking?

Module 1 · Start hereUnit 1 of 5 · about 2 min

Where it comes from

If you run a business in Australia, sooner or later somebody will ask whether you are doing the Essential Eight. It might be your insurer at renewal time, a large customer sending through a security questionnaire, or a government tender with a box that has to be ticked.

So here is what it actually is, because the name gets thrown around a lot by people who have never read it.

It comes from the Australian Signals Directorate

The ASD is the federal agency responsible for signals intelligence and cyber security. They publish a long list called the Strategies to Mitigate Cyber Security Incidents, built from what they actually see while responding to real incidents and running penetration tests. The Essential Eight is the eight strategies they rate as most effective. It is not a vendor framework and nobody is selling it to you.

Here are the eight, in the ASD's own order, with what each one means. The rest of this pathway walks through them properly. For now, just notice that none of them is exotic.

The eight controls in plain English

1
Patch applications
Install security updates for everyday software like web browsers, Microsoft Office and PDF readers quickly, and remove software the vendor no longer supports.
2
Patch operating systems
The same for Windows, macOS, servers and network devices. Updates go on promptly, and systems too old to get updates are replaced.
3
Multi-factor authentication
A second proof on top of the password, such as an app prompt or a security key, for email, cloud services, remote access and admin accounts.
4
Restrict administrative privileges
Admin rights only for the people who actually need them, using separate admin accounts that are never used for email or browsing.
5
Application control
Only approved programs are allowed to run, so malware that lands in a downloads or temp folder cannot start.
6
Restrict Microsoft Office macros
Macros are blocked unless there is a business need, and macros in files that came from the internet are blocked outright.
7
User application hardening
Browsers and Office are set up to refuse risky content like web ads and Java, with features attackers abuse switched off.
8
Regular backups
Important data, software and settings are backed up, restores are tested, and the backups are protected from being changed or deleted.

The good news, if you have done the Microsoft 365 pathway

You have already built several of these. Multi-factor authentication was module 1. Restricting admin privileges was module 2. Backups were module 8. This pathway is not asking you to start again, it is giving you the framework those pieces slot into, and the language to describe it when somebody asks.

Who is actually asking

Nobody wakes up wanting to do the Essential Eight. It comes up because somebody else asks, and understanding who is asking tells you how precise your answer needs to be.

Asker 1

Your cyber insurer, at renewal

Insurers have been burned and their questionnaires have grown teeth. Many now ask directly about MFA, backups, patching and admin accounts, which is the Essential Eight wearing a different hat.

Answers affect your premium, and sometimes whether you are covered at all
Getting it wrong on the form can void a claim later
Honest answers plus a plan usually beat optimistic answers

Turns up once a year, always at a busy time

Asker 2

A government tender

Commonwealth entities work to ASD guidance, and that expectation flows downhill to suppliers. If you sell to government, or to somebody who does, the question arrives eventually.

Often phrased as a target maturity level rather than a yes or no
Sometimes requires assessment by an independent party
Can disqualify you before anyone reads your pricing

The one with a deadline attached

Asker 3

Your biggest customer's security questionnaire

Larger businesses now push security requirements onto their suppliers, because their own auditors push it onto them. A mining client or a big builder can ask a small subcontractor for exactly this.

Usually a spreadsheet nobody wants to fill in
Often the first time a small business hears the term
Answering it well is a real competitive advantage

Arrives by email with no warning

There is a fourth reason, and it is the better one

The eight controls are on the list because ASD sees them stop real attacks. Even if nobody ever asks you, a business that does these eight things properly is much harder to hurt. The paperwork is the annoying part. The protection is real.

What it covers, and what it does not

This is the unit that saves you from an expensive misunderstanding. The Essential Eight is deliberately narrow, and ASD is quite open about its limits.

What it is built for

Internet-connected information technology networks
The everyday laptops, servers and cloud services a business runs on
A minimum baseline, chosen because it stops the most common attacks

What it was not designed for

Operational technology, the control systems on a plant or site
Enterprise mobility, meaning fleets of phones and tablets
Being the whole of your security. It is a floor, not a ceiling

The operational technology point matters in Perth

If you are in mining, manufacturing or construction, a good chunk of what keeps you running is not a laptop. ASD says the principles can be applied to those environments but the Essential Eight was not designed for them, and other strategies may suit better. Doing the Essential Eight across your office IT and assuming the site is covered is a mistake worth avoiding early.

Notice what is missing from the eight

There is nothing here about training your staff, nothing about email filtering, nothing about detecting an attack in progress. That is not an oversight, it is scope. ASD is explicit that businesses need more than the Essential Eight, and points to the wider Strategies to Mitigate Cyber Security Incidents and the Information Security Manual for the rest.

What "Essential Eight aligned" really means

You will see the phrase "Essential Eight aligned" on a lot of websites, including plenty of IT providers. In most cases it means very little.

The Essential Eight has a maturity model with four defined levels. A real answer sounds like "we are at Maturity Level One across all eight" or "we are Level One on six and working on the other two". Anything vaguer is usually a way of avoiding the question.

The four maturity levels at a glance

Level Zero: Weaknesses in your overall security that the common attacks at Level One could exploit.
Level One: Protects against opportunistic attackers using widely available tools, the kind of attack most small businesses actually face.
Level Two: Protects against attackers willing to invest more time in a target and in the effectiveness of their tools.
Level Three: Protects against adaptive attackers who rely much less on public tools and hunt for weaknesses like old software or poor logging.

ASD asks you to reach the same level across all eight before climbing to the next, and for most small businesses Level One is the realistic first target. Essential Eight maturity levels is the next module and covers them properly.

Answers that mean nothing

"We follow the Essential Eight." "We are Essential Eight aligned." "Our provider handles that." None of these tell an insurer or a customer anything, and if you write one on a form you may be making a claim you cannot back up.

Answers that hold up

"We have assessed ourselves against all eight. We meet Maturity Level One on six of them, we have a plan and a date for the other two, and here is the evidence." That is a business that knows where it stands, which is worth more than one claiming perfection.

Honest and improving beats vague and confident

Insurers and auditors talk to a lot of businesses. They can tell the difference between somebody who has done the work and somebody repeating a phrase. Saying "we are not there yet on two of them, here is the plan" is a strong answer. Overstating it and then having a claim denied is the outcome nobody wants.

Check where you stand Our free Essential Eight checklist: 24 simple questions across all eight, no email required.Have it assessed for you See how our Essential Eight assessments work for Perth businesses, and what you get at the end.

Sources

Checked against ASD guidance in September 2026, when the current maturity model was the November 2023 version. ASD updates it from time to time, so confirm the current version before relying on it for a tender or an insurance answer.

Knowledge check

5 quick questions. Get 4 right and the module is yours.

1. Who publishes the Essential Eight?

2. Which of these is one of the eight, using its official name?

3. Your business runs control systems on a processing site. Does the Essential Eight cover them?

4. An insurer asks about your Essential Eight position. Which answer is strongest?

5. Is the Essential Eight enough on its own?