Essential Eight for Accounting Practices

The Essential Eight gives your accounting practice eight security measures to implement with your IT provider. Choose a maturity target, assign the work and record evidence that each measure operates across the devices and services handling client information.

What the Essential Eight Covers

The Essential Eight is a set of mitigation strategies developed by the Australian Signals Directorate (ASD) for internet-connected IT networks. Its Australian Cyber Security Centre (ACSC) publishes the official Essential Eight guidance.

The eight strategies are application control, patch applications, restrict Microsoft Office macros, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups. Application control limits which software can run. User application hardening means configuring applications to reduce opportunities for malicious activity.

Together, these measures address common ways attackers enter systems, expand access and damage information. Your practice also needs its wider cyber security arrangements, including incident response and staff responsibilities. Completing the eight measures does not establish that every professional or legal duty has been met.

Choose a Maturity Target

Choose a target maturity level with your IT provider after examining the consequences of an attack on your practice. Consider stolen client records, unauthorised access to tax software and an outage that prevents staff completing work.

The ASD maturity model has four levels.

• Level Zero records weaknesses below Level One.
• Level One addresses commonly available attack methods.
• Level Two addresses more capable, selective attacks, including attempts to defeat weaker multi-factor sign-in.
• Level Three addresses more adaptive attacks and requires further protection.

Higher levels change both the technical requirements and their coverage. For example, Level Two requires phishing-resistant multi-factor authentication for staff accessing online services. A password plus a second sign-in step does not automatically meet that requirement.

Implement the same level across all eight strategies before progressing to the next level. Record the target separately from the starting assessment. A practice aiming for Level Two can still have unmet Level One requirements.

1. Agree which systems the assessment covers and name the principal responsible for that scope.
2. Have the IT provider compare the starting position with each requirement for the selected level.
3. Record the evidence beside each result and assign every gap to an owner.
4. Approve a sequence of changes, including safe testing and arrangements for staff whose work could be interrupted.

A target is a planning decision. Claiming an achieved level requires assessment evidence for the complete set of applicable requirements.

Map the Practice’s Devices and Services

List every device and service that handles client information before assigning the changes. Include staff laptops used at home, office computers, servers, network devices and any personal devices permitted to access practice files.

For each device, record its operating system and installed applications. Include browsers and extensions, email software, PDF readers, office software, tax software and remote-access tools. Record who manages updates and whether the vendor still supports the installed version.

Make a separate account and service inventory. Include ordinary staff accounts, administrator accounts, outsourced IT access, sign-in methods, document storage and backup arrangements. Identify who can change access permissions or delete backups. Distinguish a stored client document from a downloaded copy on a laptop.

Consider this hypothetical example. A client sends a supporting document to a staff member, who opens it on a practice laptop and files it in the practice’s cloud document service. Another staff member then accesses it to prepare the client’s work.

The practice and its IT provider manage the laptop’s approved software, patching and staff access. The practice manages which colleagues can open the stored document and whether sharing permits access outside the team. The document-service vendor manages parts of the hosted infrastructure.

Record that division of responsibility. Request the vendor’s information about the service’s sign-in options, infrastructure patching and recovery arrangements. Ask whether the practice can restore an accidentally deleted file independently. A cloud subscription alone does not answer those questions.

Assign the Eight Mitigations

Assign each mitigation to a named person and attach the requirements for your chosen maturity level. The checklist below gives starting actions and evidence to collect. Your IT provider must translate them into settings appropriate to your devices and services.

Mitigation	Accountable owner	Starting action	Dependency	Completion evidence
Application control	IT provider, approved by principal	Limit running software to the practice-approved set.	Complete application inventory and a way to handle legitimate additions.	Approved software runs and a harmless unapproved test application is blocked.
Patch applications	IT provider	Identify missing application updates and apply them within the relevant requirement.	Application versions, vendor support and agreed downtime.	Scan results and installed versions show the update succeeded.
Restrict Microsoft Office macros	IT provider, with practice manager	Disable macros where there is no demonstrated business need. Apply the required restrictions where macros are needed.	List of spreadsheets or documents that require macros.	Policy settings and a harmless test document show the restrictions operate.
User application hardening	IT provider	Apply the required restrictions to browsers and other applications for the selected level.	Application inventory and assessment of effects on staff work.	Settings and controlled tests show prohibited behaviours are blocked.
Restrict administrative privileges	Principal and IT provider	Approve privileged access by task and separate it from ordinary staff use.	Account inventory and documented reasons for administrator access.	Account records and sign-in tests confirm the approved access boundaries.
Patch operating systems	IT provider	Identify missing operating-system updates and replace unsupported versions.	Device inventory, vendor support and recovery arrangements.	Device versions and scan results confirm the required patch position.
Multi-factor authentication	Practice manager and IT provider	Apply the required sign-in methods to each in-scope service and account.	Service capabilities, staff enrolment and recovery arrangements.	Sign-in tests confirm enforcement, including for administrator access.
Regular backups	Principal and IT provider	Back up the information, applications and settings needed to recover practice work.	Agreed recovery needs, retention and protected backup access.	A controlled restoration returns the selected information and required settings.

Use ASD’s application restrictions guidance for software execution and its macro guidance for Office documents. Blocking a spreadsheet macro does not replace restrictions on other executable files.

For patching, use the application and operating-system guidance. A report that an update was sent to a laptop can miss an installation failure or pending restart. Confirm the installed result.

Use the separate guidance for administrative privileges and multi-factor authentication when configuring accounts. Match the method to the selected level and service, including its recovery route.

Keep exceptions in the same working record. State the affected system, reason and temporary protection, with an owner and a review point. An unresolved exception stays visible until it has been addressed or assessed through the applicable exception requirements.

Verify That the Changes Work

Verify the operating result after each change, then review the combined evidence for the selected target. Use approved test accounts and harmless files. Keep client records out of test material where a synthetic document will demonstrate the same result.

A checklist records assigned work. A maturity assessment evaluates the requirements within a defined scope. An operating test shows what a particular device or service actually does under the tested conditions. ASD’s assessment guide treats simulated activity as stronger evidence than a policy statement.

Ask your IT provider to demonstrate the checks before closing the relevant items. Record the device or service, account type, expected result and actual result. A screenshot showing a setting is useful, but an attempted action can reveal whether that setting is enforced.

ASD’s backup guidance requires recovery exercises to test restoring data, applications and settings to a common point in time.

For a backup test, agree an isolated restoration destination first. Restore a synthetic client folder with its expected files and necessary settings. Check that an authorised staff account can open the restored files. Record whether the restoration meets the practice’s agreed recovery needs without overwriting live work.

If a sign-in bypasses the required second factor, examine excluded accounts and alternative sign-in routes. If an unapproved application runs, check whether the rules cover that location and device. A failed restoration requires investigation of the backup contents and recovery method before the item closes.

What an External Assessment Includes

Bluechip’s published Essential Eight gap-assessment service illustrates one provider’s assessment arrangement. Its initial consultation covers the IT environment and desired maturity level. Bluechip then connects the organisation with an assessor. The published steps continue with a report and remediation roadmap, followed by a debrief and support to address gaps.

That service is separate from ASD’s model and from your internal checklist. Before commissioning an assessment, agree the included devices and services, selected target, testing permissions and evidence expected for each mitigation. The report must make exclusions clear and identify the owners of proposed remediation.

Bluechip describes the assessor as certified. Ask who issues the credential, what it covers and who performs the assessment. An assessor’s credential describes the assessor. The practice’s maturity result depends on the evidence and scope in its assessment report.

Review unresolved exceptions with the principal and IT provider before relying on the result. A provider’s report or certification wording alone does not prove that the practice meets a maturity level or every legal duty.

Keep Client Forms Within the Plan

Include client forms in the same device, access and evidence records as other practice work. Identify which staff can read sensitive details, when they need that access and which service holds the information.

Tax Genie keeps each Tax File Number (TFN) hidden until a staff member reveals it and logs every reveal. It removes every TFN before AI review. These features give the practice specific handling steps to include in its client-form procedures.

For a staff role permitted to reveal TFNs, record who approves that permission and when the practice reviews it. Include the staff device and sign-in route in the wider assessment. A product feature is evidence about that feature, while the maturity assessment covers the practice’s defined environment.

Give the client-form access review an owner and attach its results to the implementation record. Close the plan only when the evidence supports the recorded result and every remaining exception has a named decision-maker and review point.