Essential Eight to ASD Essentials: What Changes?

Your accounting practice has spent time setting up multi-factor authentication, checking updates and testing backups. Now there is a new framework name to understand. Does that work need to start again?

ASD launched ASD Essentials on 15 October 2026. Its announcement says both Essential Eight and Essentials will remain available during the transition, and organisations should continue to meet current regulatory obligations until changes are communicated. Read the official launch announcement before acting on a claimed deadline.

The practical starting point is to examine your existing work, not replace every security product. For a partner or practice manager, the immediate task is to understand what the evidence covers and what still needs a decision.

Keep the evidence, check the scope

ASD's transition guidance connects existing Essential Eight work with the enterprise IT chapter of Essentials. It does not automatically convert an old maturity rating into a new effectiveness rating.

Imagine a fictional practice that has tested sign-in protection for staff email. The result may be useful, but the practice also uses a separate payroll service and an external support account. Before making a wider claim, the reviewer needs to know whether those accounts were included.

Create a short evidence register. For each record, note the system, date, person responsible and any limitation. “Email accounts checked in September; payroll service not reviewed” gives the next reviewer a useful starting point. “MFA completed” hides the unanswered question.

Do the same with exceptions. A workbook approved for one team should not quietly become a practice-wide exception. Ask whether the business need still exists and who has authority to renew it.

Choose a chapter that fits your environment

The new series includes enterprise IT, cloud and operational technology guidance. Do not choose solely from the name of your main application.

The cloud chapter addresses environments delivered entirely through software-as-a-service and platform-as-a-service. These are applications and platforms consumed as services. A practice using online accounting software may still operate other infrastructure, so the whole environment needs to be considered.

For example, list where client documents sit, how staff sign in, which devices access the files and who manages the underlying systems. Include third-party support and any locally hosted practice application. Keep this inventory separate from a list of software subscriptions: ownership and responsibility matter as much as product names.

Our ASD Essentials overview explains the main terms and chapter choices. For the original framework, use the Essential Eight guide.

Do not turn a phase into a pass mark

The enterprise IT chapter groups technical work into priority phases, with governance and response capabilities continuing across the work. A phase describes a sequence, not a replacement name for an Essential Eight maturity level. See the enterprise IT chapter.

Assessment also needs context. Under the Essentials assessment guide, actions are assessed within applicable domains. The ratings distinguish an unassessed action from one shown not to work, as well as partial and full effectiveness.

Suppose the practice can restore a workbook, but nobody has checked whether staff could reach it during an identity-service outage. The workbook result is useful evidence. It does not answer the wider recovery question. Write down what was tested and what remains unknown rather than combining both into a green status.

Ask for reporting that makes those boundaries visible. A report should help a partner decide where to spend time and money, not require them to guess what a percentage includes.

Use a small working session to plan the next checks

A useful first session can focus on one critical workflow, such as completing payroll or retrieving client workpapers. Invite its business owner and the person responsible for its technology. The following is a suggested planning exercise, not an official assessment method.

Start with these questions:

• Which accounts, devices and services are required to complete the work?
• Which current evidence describes those systems?
• What does the evidence not show?
• Who owns each missing check or unresolved exception?
• What can be tested safely without disrupting client work?

Agree a small number of next actions with dates and owners. If a change could interrupt a practice application, test it in a controlled setting and agree a recovery approach before rolling it out. Do not use a busy payment or lodgement run as a test window.

ASD's implementation planning guide provides the wider planning approach. Our Essential Eight to ASD Essentials mapping page adds an ungated CSV worksheet with eight starting points. It is a preparation tool, not a complete checklist or a certificate.

The next step does not need to be a large technology purchase. It can be a clearer view of the systems you depend on, the evidence you trust and the checks you still need. Talk to SuperStack IT about the scope of a review and what help would be useful. Please describe the workflow without sending client records, passwords or detailed security reports through the enquiry form.

Guidance checked 28 October 2026. This article is general information, not an assessment of your practice or advice that a particular regulatory or contractual requirement has been met.