SMB1001 and the Essential Eight answer different questions: SMB1001 is a certification you can earn and show, while the Essential Eight is a set of eight technical mitigation strategies you implement. For an Australian SMB, run the Essential Eight's controls underneath and certify SMB1001 on top - one gives you the security posture, the other gives you the certificate buyers and insurers recognise.
TL;DR
- The Essential Eight is ASD's set of eight mitigation strategies with four maturity levels; SMB1001 is a five-level certification scheme for small and medium businesses, from Bronze to Diamond.
- The Essential Eight is mandatory for Australian Government entities at Maturity Level 2 under the PSPF, but only 15% of Commonwealth entities reached overall ML2 in 2024 - down from 25% in 2023, per ASD's posture report.
- SMB1001 certifies in weeks at the entry tiers and renews annually; the Essential Eight carries no certificate - assessors grade your implementation.
- They are not competitors: the Essential Eight hardens your systems, SMB1001 proves the state of that hardening plus the human layer to a third party.
What each one is
The Essential Eight is the Australian Signals Directorate's set of eight prioritised mitigation strategies - application control, patch applications, patch operating systems, multi-factor authentication, harden user applications, restrict admin privileges, restrict Microsoft Office macros and regular backups - each assessed at Maturity Levels 1 to 3. It is technical controls: what your systems do, not what your certificate says.
SMB1001 is a certification scheme built for small and medium businesses. Five levels - Bronze, Silver, Gold, Platinum and Diamond - run from 7 requirements at entry to 39 at the top, attested at the lower tiers and audited at Diamond, renewed annually. It covers technical controls, governance and the human layer, and it produces a certificate you can put in a tender.
Side-by-side comparison
| Dimension | SMB1001 | Essential Eight |
|---|---|---|
| What it is | Certification scheme, five levels | Eight mitigation strategies, four maturity levels |
| Built by | CyberCert ecosystem | Australian Signals Directorate |
| Who it binds | Voluntary; Australian SMB market | Mandatory ML2 for Commonwealth entities under the PSPF |
| Scope | Technical controls + governance + human layer | Technical controls only |
| Output | A certificate, renewed annually | No certificate - maturity assessment |
| Entry effort | Weeks at Bronze from existing evidence | Weeks to months of systems work |
| Best fit | Proving maturity to buyers and insurers | Hardening the environment itself |
Where SMB1001 wins
- It is showable. A tender or insurer wants a certificate, not an internal maturity self-assessment.
- It covers people, not just systems. Training records, phishing evidence and policy sign-offs are part of the review - see security awareness training.
- It is tiered to your size. Certify at Bronze quickly and climb levels as the business grows.
Where the Essential Eight wins
- It is the ASD's own benchmark. The strategies target the intrusion techniques ASD sees most, and government work pulls toward it.
- It hardens what attacks actually hit. Patching, MFA, admin restriction and backups stop the attack; no certification does.
- It is granular. Maturity levels let you close one gap at a time, measured against a published model.
Which should you choose
- If you must prove security maturity this quarter - a tender, a client's security questionnaire, a cyber insurance renewal - SMB1001 gives you the artefact fastest.
- If you must stop the attacks themselves, the Essential Eight is the work. No certificate substitutes for patching, MFA and backups.
- Most Australian SMBs do both in sequence: implement the Essential Eight strategies as the technical base, then certify SMB1001 to evidence it - the human-layer evidence both expect is the same thing: training completion records, phishing results, policy acknowledgements. Human risk reporting packages that trail, and a gap assessment shows where you stand before either assessor arrives.
FAQ
Is the Essential Eight mandatory for private businesses? No - the PSPF requires Australian Government entities to reach Maturity Level 2 across all eight strategies. Private businesses adopt it voluntarily, and government contractors often inherit the expectation.
Can a small business get certified in the Essential Eight? There is no Essential Eight certificate. Assessed maturity can be evidenced through schemes such as SMB1001 or ISO 27001, which map to similar control areas.
Which is cheaper? The Essential Eight costs systems work; SMB1001 costs assessment fees plus the underlying controls. Most SMBs find certifying Bronze on top of Essential Eight-aligned basics is the fastest combined path.
Does SMB1001 replace the Essential Eight? No. SMB1001 evidences a control set that includes areas like awareness training the Essential Eight does not name; the Eight harden systems in ways a certification alone does not.
How do staff fit in? Both expect human-layer discipline: the ISM that underpins the Eight expects privileged users trained at least yearly, and SMB1001's higher tiers review training records directly - see how often employees should train.