No — the Essential Eight does not require a dedicated security champion, and no control in the framework names a role. What it requires is that all eight strategies are implemented at your chosen maturity level, with evidence kept, and that the human layer behind them holds up. A security champion is one way to organise that accountability — not the requirement itself. For most small Australian teams, one named owner plus distributed responsibility is more realistic than hiring for the title. Cyber Aware covers the human side of the framework with short daily lessons and phishing simulations.
TL;DR
- No Essential Eight control mandates a "security champion" role.
- What is required: eight strategies implemented, maturity level met, evidence retained.
- Every strategy has a human failure mode — that is where training earns its place.
- Commonwealth entities must implement the Essential Eight; business adoption is voluntary but increasingly buyer-driven.
- A gap assessment shows which strategies are missing an owner before you structure anything.
Why this matters
The Essential Eight is an ASD prioritisation of eight mitigation strategies: application control, patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, user application hardening, restrict Microsoft Office macros, and regular backups (ASD Essential Eight). Commonwealth entities are required to implement it under the Protective Security Policy Framework; for everyone else it is voluntary — but insurers, government tenders and supply-chain questionnaires keep raising the bar for proof.
The reason the "do we need a champion" question matters is cost. Small businesses read a framework and assume it needs a hire. In Australia, ASD received more than 84,700 cybercrime reports in FY2024-25 — one every six minutes — with small businesses averaging $56,600 per self-reported loss (ASD Annual Cyber Threat Report 2024-25). A framework misread as a hiring requirement delays adoption; the losses meanwhile do not wait.
What the Essential Eight actually requires
The framework specifies controls and maturity levels (ML1 through ML3), not headcount. An assessment checks that each strategy is implemented to the claimed maturity and that evidence exists — configurations, patch records, backup tests, admin privilege reviews. Nothing in that list is satisfied by a job title, and nothing is blocked by not having one.
The human layer, though, decides whether several of the controls survive contact with real life:
- MFA is defeated by MFA fatigue — staff approving push prompts because they are conditioned to tap yes.
- Restrict admin privileges is undermined by staff sharing administrator accounts to "get work done".
- Patching depends on staff letting updates run, including on any device outside IT control.
- Office macro restrictions are beaten by a staff member enabling content to open what looks like an invoice.
- Regular backups fail quietly when staff keep the only copy of critical work on a local drive.
- Application control and hardening are undone by unapproved software installs.
So the honest answer is: no dedicated champion required — but every strategy needs a named owner, and the behaviours that keep them working need training. The human element stays involved in roughly 60% of breaches (Verizon 2025 DBIR, 22,052 incidents analysed — full report PDF), and a control without a trained human behind it is a control that looks good in an audit.
Champion model, distributed ownership, or MSP: what fits
| Model | Best for | The risk to manage |
|---|---|---|
| Dedicated security champion | Teams 20+ with real IT estate | Becomes a bottleneck; champion leaves and ownership evaporates |
| One accountable owner, distributed tasks | Under ~20 staff | Tasks named but nobody accountable unless the owner is formally designated |
| MSP as technical owner | No internal IT at all | Execution outsourced, but decisions and evidence still need an internal owner |
Small teams routinely over-index on the champion model because it reads like best practice. In practice, the owner needs three things: authority to say "we do it this way", an hour a week, and a dashboard. None of those require a security background.
How to assign accountability without hiring
- Run a gap assessment first. Until you know which strategies are missing, incomplete or ownerless, any ownership model is a guess. The assessment doubles as the evidence baseline assessors ask for.
- Designate one accountable person. In writing. It can be the office manager, the founder or the bookkeeper — accountability does not follow the title, it follows the designation.
- Map each strategy to whoever executes it. The owner is accountable; a patch schedule can be executed by your IT provider, backups by your MSP, admin privilege reviews by the owner.
- Train the human layer. Short daily lessons and monthly phishing simulations keep the MFA, macro and patch behaviours alive — the behaviours no configuration can enforce alone.
- Keep the evidence and the trend. Completion records, simulation click rates over time in human risk reporting, patch logs. When an assessor or a client asks, the evidence answers; nobody has to reconstruct it.
Related questions admins ask
Is there such a thing as Essential Eight "certification"?
Not in the certificate sense. The Essential Eight is assessed against maturity levels — by ASD's own process for Commonwealth entities, or by an independent assessor for everyone else. Be wary of any vendor selling an "Essential Eight certificate".
Can our MSP be our security owner?
They can own execution, and many do. Accountability should stay internal: the person who answers for the organisation's posture is an employee or the owner, not a vendor who can be switched off by a missed invoice.
What maturity level should a small business target?
ML1 as the working baseline, ML2 where the risk justifies it. ML3 is designed for organisations holding high-value information and is rarely proportionate for a small business.
Does the human layer count as "evidence"?
Increasingly, yes. Assessors and insurers look beyond configuration to training records and simulation history — proof that the behaviours the controls depend on are being maintained, not just installed.
FAQ
Does Essential Eight require a dedicated security champion? No. The framework specifies controls, maturity levels and evidence — not roles. What it needs in practice is one named accountable person and an owner for each strategy.
Can a small business implement the Essential Eight without security staff? Yes. ML1 is a set of configurations and routines your existing IT provider can execute, with an internal owner making decisions and holding evidence.
Where does awareness training fit in the Essential Eight? Training is not one of the eight strategies, but it is what keeps several of them working — MFA hygiene, macro awareness, patching behaviour and backup discipline are all human behaviours with documented failure modes.
What is the fastest way to know if we're ready? A gap assessment. It scores you against the strategies and produces the evidence baseline before an assessor ever asks.
One last thing
If the phrase "security champion" is what has stalled your implementation, rename the problem: what you need is an owner, a gap assessment and evidence. Two of those three you can produce this week.