If you run a small or medium business in Australia, two names keep coming up whenever cyber security is mentioned: the Essential Eight and SMB1001. Insurers ask about them, larger clients put them in contracts, and government tenders increasingly expect them. But they’re not the same thing, and knowing the difference saves you time, money and a fair bit of confusion.
Here’s a plain-English breakdown of what each one is, how they relate, and which your business actually needs.
What is the Essential Eight?
The Essential Eight is a set of eight baseline security strategies published by the Australian Signals Directorate (ASD) and its Australian Cyber Security Centre (ACSC). It covers things like applying security patches, using multi-factor authentication, restricting administrator privileges and backing up your data.
It’s measured in maturity levels, from Level 0 (not really doing it) up to Level 3 (doing it thoroughly), so you can see how far along you are. We explain those in detail in Essential 8 maturity levels: how to measure your cyber security.
The key thing to understand: the Essential Eight is a framework, not a certification. It tells you what good security looks like, but there’s no official body that inspects you and hands you a recognised badge. You can self-assess, and you can have a provider assess you, but you can’t point a client to a public certificate that says “we passed.”
What is SMB1001?
SMB1001 is an Australian certification standard built specifically for small and medium businesses. It’s published by Dynamic Standards International (DSI) and delivered through CyberCert, and it’s revised every year. The current edition is SMB1001:2026.
Unlike the Essential Eight, SMB1001 is a certification you can hold and show. It has five progressive tiers:
- Bronze, Silver and Gold: self-attested (you confirm you meet the controls)
- Platinum and Diamond: independently audited
That tiered approach is what makes it work for smaller businesses. You certify at a level that matches your size, risk and budget, then climb as you grow, rather than facing the all-or-nothing hurdle of a standard like ISO 27001. (Our full overview lives on the SMB1001 page.)
The real difference: a framework vs a credential
Here’s the simplest way to think about it:
- The Essential Eight is what you do: the practical security controls.
- SMB1001 is how you prove it: a recognised, dated certificate you can put in front of a client, insurer or tender panel.
And they’re not competitors. SMB1001 draws on the same kinds of controls as the Essential Eight (and the UK’s Cyber Essentials). In other words, the work you do to meet the Essential Eight is most of the work you need to earn an SMB1001 tier. One feeds directly into the other.
So which one does your business need?
It comes down to why you’re asking:
“I just want to be genuinely secure.” Start with the Essential Eight. It’s the practical baseline every business should be working towards, certification or not. Getting the fundamentals in place (MFA, patching, backups, restricted admin rights) removes most of the risk that actually causes incidents.
“A client, insurer or tender is asking for proof.” This is where SMB1001 earns its keep. A maturity self-assessment against the Essential Eight is hard to show convincingly; an SMB1001 certificate at a named tier is clear, recognised and dated. If someone needs evidence, SMB1001 is the answer.
“Both, honestly.” For most SMBs this is the real answer, and the good news is it’s one piece of work, not two. You implement the Essential Eight controls (which you should be doing anyway), and SMB1001 turns that effort into a credential you can actually show. You get the security and the proof.
How they work together in practice
A typical path looks like this: you assess where you stand against the Essential Eight, close the gaps (most of which are configured within tools you already pay for, like Microsoft 365 Business Premium), then certify the result at the SMB1001 tier your clients and insurers expect. From then on, maintaining your Essential Eight controls is what keeps your SMB1001 certification valid year to year.
If you’d like the step-by-step version, we’ve written a guide to getting SMB1001 certified that walks through exactly how it works.
Where to start
Don’t get stuck choosing between the two; they pull in the same direction. The sensible first move is to find out where you genuinely stand against the Essential Eight, because that tells you both how secure you are and how close you are to an SMB1001 tier.
That’s exactly what we do for businesses across Brisbane as part of our compliance and data-protection service. Get in touch for a no-obligation review and we’ll tell you plainly where you stand and what it would take to certify.
Adam leads the Itopia team in Brisbane, helping professional-services firms get secure, productive and confident with their technology, in plain English.