---
title: "The Essential Eight Explained in Plain English | StartCloud"
url: https://startcloud.au/learn/what-is-the-essential-eight
description: "The Essential Eight in plain English: the eight ASD controls, the four maturity levels, and who actually asks your business about it. Free module, no sign-up."
lang: en
---

Module 1 of StartCloud's Essential Eight for Australian Business pathway, in five short units with a knowledge check: the framework's origin at the Australian Signals Directorate, the eight mitigation strategies in ASD's own order with a one-line meaning for each, the four maturity levels at a glance, who asks about it in practice (cyber insurers, government tenders, customer security questionnaires), what it deliberately does not cover (operational technology, enterprise mobility, and everything beyond the baseline), and why vague claims of being 'Essential Eight aligned' fail under scrutiny.

# What is the Essential Eight, and who is asking?

Module 1 · Start here Unit 1 of 5 · about 2 min

## Where it comes from

If you run a business in Australia, sooner or later somebody will ask whether you are doing the Essential Eight. It might be your insurer at renewal time, a large customer sending through a security questionnaire, or a government tender with a box that has to be ticked.

So here is what it actually is, because the name gets thrown around a lot by people who have never read it.

It comes from the Australian Signals Directorate

The ASD is the federal agency responsible for signals intelligence and cyber security. They publish a long list called the Strategies to Mitigate Cyber Security Incidents, built from what they actually see while responding to real incidents and running penetration tests. The Essential Eight is the eight strategies they rate as most effective. It is not a vendor framework and nobody is selling it to you.

Here are the eight, in the ASD's own order, with what each one means. The rest of this pathway walks through them properly. For now, just notice that none of them is exotic.

### The eight controls in plain English

1. 1
   Patch applications
   Install security updates for everyday software like web browsers, Microsoft Office and PDF readers quickly, and remove software the vendor no longer supports.
2. 2
   Patch operating systems
   The same for Windows, macOS, servers and network devices. Updates go on promptly, and systems too old to get updates are replaced.
3. 3
   Multi-factor authentication
   A second proof on top of the password, such as an app prompt or a security key, for email, cloud services, remote access and admin accounts.
4. 4
   Restrict administrative privileges
   Admin rights only for the people who actually need them, using separate admin accounts that are never used for email or browsing.
5. 5
   Application control
   Only approved programs are allowed to run, so malware that lands in a downloads or temp folder cannot start.
6. 6
   Restrict Microsoft Office macros
   Macros are blocked unless there is a business need, and macros in files that came from the internet are blocked outright.
7. 7
   User application hardening
   Browsers and Office are set up to refuse risky content like web ads and Java, with features attackers abuse switched off.
8. 8
   Regular backups
   Important data, software and settings are backed up, restores are tested, and the backups are protected from being changed or deleted.

The good news, if you have done the Microsoft 365 pathway

You have already built several of these. Multi-factor authentication was module 1. Restricting admin privileges was module 2. Backups were module 8. This pathway is not asking you to start again, it is giving you the framework those pieces slot into, and the language to describe it when somebody asks.

StartCloud assistant

Online

G'day! 👋 I'm the StartCloud assistant. How can I help you today?

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": [
      "LocalBusiness",
      "ProfessionalService"
    ],
    "@id": "https://startcloud.au/#business",
    "name": "StartCloud",
    "legalName": "Start Technologies Pty Ltd",
    "alternateName": "StartCloud Australia",
    "identifier": {
      "@type": "PropertyValue",
      "propertyID": "ABN",
      "value": "17 676 121 449"
    },
    "slogan": "Go Beyond",
    "description": "StartCloud is Perth's cybersecurity-first AI MSP: managed IT, Essential Eight security, Microsoft 365 and cloud, networking, and practical AI for Australian businesses with 5 to 50 staff.",
    "url": "https://startcloud.au",
    "logo": "https://startcloud.au/og-image.png",
    "image": "https://startcloud.au/og-image.png",
    "telephone": "+61862850001",
    "email": "web@startcloud.com.au",
    "priceRange": "$$",
    "currenciesAccepted": "AUD",
    "paymentAccepted": "Invoice",
    "foundingDate": "2023",
    "contactPoint": {
      "@type": "ContactPoint",
      "telephone": "+61862850001",
      "contactType": "customer service",
      "areaServed": "AU",
      "availableLanguage": "English"
    },
    "address": {
      "@type": "PostalAddress",
      "streetAddress": "Ground Floor West, 6 Gibberd Road",
      "addressLocality": "Balcatta",
      "addressRegion": "WA",
      "postalCode": "6021",
      "addressCountry": "AU"
    },
    "geo": {
      "@type": "GeoCoordinates",
      "latitude": -31.8648813,
      "longitude": 115.8095638
    },
    "openingHoursSpecification": [
      {
        "@type": "OpeningHoursSpecification",
        "dayOfWeek": [
          "Monday",
          "Tuesday",
          "Wednesday",
          "Thursday",
          "Friday"
        ],
        "opens": "07:00",
        "closes": "16:30",
        "description": "General support hours"
      },
      {
        "@type": "OpeningHoursSpecification",
        "dayOfWeek": [
          "Monday",
          "Tuesday",
          "Wednesday",
          "Thursday",
          "Friday",
          "Saturday",
          "Sunday"
        ],
        "opens": "00:00",
        "closes": "23:59",
        "description": "Security Operations Centre (SOC) with 24/7/365 threat monitoring"
      }
    ],
    "areaServed": [
      {
        "@type": "City",
        "name": "Perth"
      },
      {
        "@type": "State",
        "name": "Western Australia"
      },
      {
        "@type": "Country",
        "name": "Australia"
      }
    ],
    "serviceArea": {
      "@type": "GeoCircle",
      "geoMidpoint": {
        "@type": "GeoCoordinates",
        "latitude": -31.8648813,
        "longitude": 115.8095638
      },
      "geoRadius": "50000"
    },
    "knowsAbout": [
      "Cybersecurity",
      "Managed Security Services",
      "Essential Eight",
      "Microsoft 365",
      "Microsoft Azure",
      "IT Support",
      "Network Security",
      "Disaster Recovery",
      "Compliance Management",
      "Microsoft Copilot",
      "AI Readiness",
      "AI Governance",
      "AI Agent Development"
    ],
    "hasOfferCatalog": {
      "@type": "OfferCatalog",
      "name": "IT and Cybersecurity Services",
      "itemListElement": [
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Cybersecurity Services",
            "url": "https://startcloud.au/cybersecurity"
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Managed IT Services and Support",
            "url": "https://startcloud.au/technology"
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Microsoft 365 and Cloud Solutions",
            "url": "https://startcloud.au/cloud"
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "Managed Networking",
            "url": "https://startcloud.au/networking"
          }
        },
        {
          "@type": "Offer",
          "itemOffered": {
            "@type": "Service",
            "name": "AI and Automation",
            "url": "https://startcloud.au/ai"
          }
        }
      ]
    },
    "sameAs": [
      "https://www.linkedin.com/company/startcloudau",
      "https://www.facebook.com/startcloudaus/",
      "https://www.cloudtango.net/providers/12375/startcloud",
      "https://clutch.co/profile/startcloud",
      "https://abr.business.gov.au/ABN/View?abn=17676121449",
      "https://www.yellowpages.com.au/balcatta-wa/bpp/startcloud-581735301",
      "https://www.truelocal.com.au/balcatta-wa/tlp/startcloud-581735301",
      "https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "LearningResource",
    "name": "What Is the Essential Eight, and Who Is Asking?",
    "description": "Module 1 of the Essential Eight for Australian Business pathway: the framework's origin, the eight controls, who asks about it, and what compliance claims actually mean.",
    "educationalLevel": "Beginner",
    "learningResourceType": "Module",
    "isPartOf": {
      "@type": "Course",
      "name": "Essential Eight for Australian Business",
      "url": "https://startcloud.au/learn/essential-eight-for-australian-business",
      "provider": {
        "@type": "Organization",
        "name": "StartCloud",
        "url": "https://startcloud.au"
      }
    },
    "author": {
      "@type": "Organization",
      "name": "StartCloud",
      "url": "https://startcloud.au"
    },
    "datePublished": "2026-08-13",
    "dateModified": "2026-09-24",
    "url": "https://startcloud.au/learn/what-is-the-essential-eight"
  }
]
```