A startup can reach a credible Essential Eight starting point in 90 days by working in a fixed order: multi-factor authentication, then patching, then admin rights and backups, and the rest last. ASD advises reaching the same maturity level across all eight strategies first, so aim for Level One everywhere.
Why would a startup bother?
Usually because a customer, a government buyer or an insurer asks. The Essential Eight is a short list of ASD's most effective mitigation strategies, and the maturity model is how you describe where you stand. It was designed for internet connected IT networks, which suits a cloud first company with laptops and a SaaS stack.
A heads up on timing. ASD has released ASD Essentials, a principles based successor, with a transition guide. Press coverage says the Essential Eight remains published alongside it and that existing controls count toward the new framework, with a recommendation to verify rather than assume equivalence. Starting with identity and internet facing systems fits both, so the plan below does not waste work.
Days 1 to 15: know what you have
You cannot patch or restrict what you have not listed. Write down every laptop, server, cloud account, SaaS tool with sign in, and the people who hold administrative rights. A spreadsheet is fine.
Pick a target. Level One is a sensible first goal. ASD describes Level Zero as the state where Level One requirements are not met, so Level One is the first real line.
Days 16 to 40: identity and multi-factor authentication
Turn on multi-factor authentication for everyone, starting with administrators and anyone with access to production. ASD guidance says it must apply to re-authentication as well as sign in, and encourages FIDO2 certified solutions. Remove or document every exception.
Days 41 to 65: patching
Patch applications and patch operating systems are two strategies, and they are where most startups have gaps. Set up automatic updates on laptops, decide who owns servers and cloud images, and start producing a monthly report of what is missing and how old it is.
If you ship software, list the open source dependencies in it as well. A command line scan against your repositories gives you a first inventory. This is an input to your patching, not a substitute for the operating system and application patching the strategy describes.
ASD assessment guidance expects all the controls in the patching strategies to be effective before they count as implemented, so a half finished rollout does not score.
Days 66 to 80: admin rights and backups
Give people only the privileges their duties need. Privileged work should happen in a dedicated account, not the account used for email and browsing. Then fix backups: confirm what is backed up, set retention to your business needs, make sure normal user accounts cannot change or delete backups, and run a restore test. ASD guidance says to test restores at least annually. Do the first one now.
Days 81 to 90: the rest, and the paper trail
Look at application control, Microsoft Office macros and user application hardening. Where you do not use Office macros, turn them off by policy. Application control is the hardest for a small team, so write down the plan and a date even if the rollout is later.
Then spend the last week on evidence. Export the settings, the reports and the restore test result, date them, and file them. Write a one page statement of target level, current level per strategy and open gaps.
What to do
- Inventory devices, accounts, SaaS and administrators.
- Set Level One across all eight as the 90 day target.
- Enforce multi-factor authentication for everyone, with no undocumented exceptions.
- Turn on automatic patching and start a monthly missing patch report.
- Split privileged accounts from daily accounts.
- Verify backups are protected from normal users and run a restore test.
- Disable unused macros and write an application control plan.
- Collect dated evidence and a one page gap statement.
- Check cyber.gov.au for the current status of ASD Essentials.
Quick check
Should a startup aim for Maturity Level Three first?
No. ASD advises reaching the same level across all eight strategies before moving up. Level One everywhere is a better first target than Level Three on a few.
Which strategies come first?
Multi-factor authentication and patching give the most for the effort and cover identity and internet facing risk. Application control usually takes longest, so plan it early but finish it last.
Sources
- ASD Essential Eight maturity model
- ASD Essential Eight assessment process guide
- ASD Essential Eight maturity model FAQ
- ASD: Transitioning from the Essential Eight
- iTnews: ASD's Essential Eight replacement moves away from maturity ladder
Last reviewed: 18 October 2026.
