11 Nov 2026 · 5 min read | Practice Management | Cyber Security | Compliance
For years, the security advice given to accounting and bookkeeping firms came back to one framework and one number: get to Essential Eight Maturity Level 1.
On 15 October 2026, the Australian Signals Directorate published the ASD Essentials, which it describes as an evolution of the Essential Eight. The framework your insurer, your clients and your professional body have all been pointing at now has a successor.
The short version: the structure changed. The security work didn’t.
Prefer to watch first? Sasha Bellekom, Head of Implementation and Customer Compliance, put together what the Essential Eight is really protecting against, in plain terms, in a short video — watch it here. This article then brings you fully up to date on everything ASD published on 15 October.
What did ASD publish, and when?
On 15 October 2026, one framework became a series of chapters. The first release carries three. Enterprise IT, which is the Essential Eight evolved. Operational technology, for critical infrastructure operators. And cloud, for organisations whose technology is delivered entirely through software-as-a-service and platform-as-a-service. Guidance on AI runs across all three rather than sitting in a chapter of its own.
ASD signalled the change in June 2026 and consulted on the enterprise IT chapter until 12 July. The published version landed in October.
Is it essentially the same thing?
Yes — and ASD has been direct about that.
Every Essential Eight mitigation strategy maps to at least one principle in the new series, and organisations already working to the Essential Eight should expect strong alignment between the controls they have already invested in and the new guidance.
The Essential Eight has not been switched off either. ASD is maintaining both frameworks on cyber.gov.au through a transition period, and has said organisations should continue meeting their current obligations until regulators communicate any associated changes.
Multi-factor authentication, patching, restricted admin access and tested backups matter exactly as much this month as they did last month. Work your firm has already done under the Essential Eight carries forward.
So what actually changed?
Two things worth knowing.
The maturity ladder is going. Organisations no longer work toward a target maturity level. Each recommended action is instead assessed as not assessed, not effective, partially effective or fully effective, and ASD’s transition guidance is blunt about what those mean. A plan existing, or work having started, is not partial effectiveness. Deployment is not effectiveness. Existing maturity ratings don’t automatically convert either, because the two approaches measure different things. One asked whether a prescribed control was in place. The other asks whether it is achieving its purpose.
The accountability line is drawn explicitly. Every recommended action is marked according to who delivers it. Provider means the vendor does it and the firm verifies. Customer means the firm does it outright. Supplied means the provider offers the capability, but somebody at the firm has to switch it on, configure it and keep it running. ASD states the principle behind it plainly: outsourcing a service does not transfer accountability for the outcome that service is meant to achieve.
Which chapter applies to a firm like yours?
Most likely both of the first two.
ASD points organisations running on-premises infrastructure, a hybrid environment or infrastructure-as-a-service to the enterprise IT chapter, and organisations running predominantly software-as-a-service or platform-as-a-service to the cloud chapter — while noting that most organisations will need both over time.
A typical firm sits across that line. Xero, your practice management system and Dext are cloud. The Windows laptops your team opens them on are not. The cloud chapter is the first time ASD has written guidance with a serverless practice in mind, and the enterprise IT chapter is the reason the four-year-old laptop still counts.
Does this change anything with the TPB?
Not yet. The Tax Practitioners Board has been actively educating tax practitioners about the Essential Eight, and its most recent cyber security guidance continues to point firms toward those controls as part of a layered approach to protecting the sensitive information firms hold. That position hasn’t moved.
The ASD Essentials itself is written primarily for Commonwealth entities, critical infrastructure operators and large organisations, and the language inside the chapters reflects that audience. So if a professional indemnity insurer asks about Essential Eight controls at renewal, or a client’s procurement form references maturity levels, answer them as written.
What has changed is the direction of travel — and it’s worth being ready for the version of those questions that arrives next year rather than the one that arrived last year.
What should your firm do now?
Three things, none of which require a project.
Keep meeting what you already have to meet. Insurer requirements, client contracts, any obligation that currently references the Essential Eight. ASD’s own transition guidance says the same.
Know which capabilities are switched on, not just licensed. That’s the Supplied category, and it’s where most firms find the gap. MFA enforced rather than available. Logging switched on and findable. Access actually removed when someone leaves — across Xero, Karbon, Dext and every other application they touched, not just Microsoft 365.
Be able to show it. Effectiveness ratings are an evidence standard. A plan on file isn’t the answer; a record of what was in place, and when, is.
Where the gaps usually sit
The second point is usually a question of ownership rather than effort. Identity sits with Microsoft or Google. Applications sit across twenty-odd cloud platforms. Email filtering sits somewhere else. Backups sit somewhere else again. One provider assumes another has it covered, and the firm assumes the IT provider has all of it.
That’s the gap Practice Protect Core™ helps close: single sign-on and enforced multi-factor authentication, including phishing-resistant MFA, across the applications it protects, role-based permissions, structured onboarding and offboarding, and reporting on authentication and access activity so you can show the what, the who and the when. Complete™ extends that across the wider environment with device security, managed antivirus, relevant patching, conditional access and managed email protection. Backup for Microsoft 365 or Google Workspace is available as an add-on, so you have the ability to restore data from backups. The Cyber Security Compliance Hub supports the governance side with policies and practical compliance resources your firm can use alongside the technical controls.
Which is a more useful way to think about security as the framework evolves: control access, protect the environment, maintain resilience, and support governance — rather than eight boxes to tick.
For firms working across the accounting and finance space — practices, bookkeeping businesses, financial planning, SMSF administration, mortgage and finance broking — the controls themselves are the same. What differs is the obligations sitting on top of them, and those are worth mapping once rather than guessing at.
See where your firm sits
If you’d like to see what’s switched on across your applications, who can reach what, and what you’d be able to evidence if someone asked, book a complimentary security consultation. Under 60 minutes, with a specialist who works with firms in the accounting space every day.
Book a Complimentary Security Consultation
Frequently Asked Questions
Has the Essential Eight been updated or replaced?
+
Is the ASD Essentials essentially the same as the Essential Eight?
+
Do Essential Eight maturity levels still apply?
+
Does my firm need to do anything now?
+
Practice Protect is the only cyber security service built exclusively for firms operating in the accounting space — giving every practice the cyber security compliance confidence, client protection, and operational simplicity that protecting client data now demands. Trusted by 28,000+ professionals across accounting, bookkeeping, advisory and financial services firms.
Disclaimer: This article does not constitute legal advice. For obligations specific to your firm, consult your legal or compliance adviser.
