SMB1001 and the Essential Eight are two different answers to the same question - how do you prove your business takes cyber security seriously - and the right pick comes down to who is asking. SMB1001 is a five-level certification built for small and medium businesses and certified in Australia by CyberCert; the Essential Eight is the Australian Signals Directorate's set of eight mitigation strategies with maturity levels 0-3, written for government systems and now the de facto benchmark across Australian supply chains. A professional services firm answering client questionnaires usually wants SMB1001; a business chasing government work or prime-contractor status usually needs Essential Eight evidence - and many end up running both.
TL;DR
- SMB1001 is a certifiable, five-level standard (Bronze to Diamond) sized for SMBs; Essential Eight is ASD's government-origin framework, assessed at maturity levels 0-3.
- Essential Eight is mandatory for non-corporate Commonwealth entities at ML2; for private business it is voluntary but demanded by insurers, tenders and prime contractors.
- SMB1001 has no legal mandate but produces a certificate buyers recognise; Essential Eight is a point-in-time maturity measure with no certificate.
- The two share most of their control ground - MFA, patching, backups, access control, awareness training - so evidence collected for one largely maps to the other.
- Practical default for a small Australian business: certify SMB1001 at the level your buyers recognise, and map the same evidence to Essential Eight ML1-2 if contracts demand it.
What each framework actually is
The Essential Eight comprises eight mitigation strategies - application control, patching applications, patching operating systems, multi-factor authentication, restricting administrative privileges, macro restrictions, user application hardening and regular backups - each assessed at a maturity level from 0 to 3. An organisation's overall level is set by its weakest strategy. It was written to protect Australian government systems, and Maturity Level 2 has been mandatory for non-corporate Commonwealth entities since July 2022. The benchmark that frames 2026: only 22 per cent of Commonwealth entities reached overall ML2 in 2025 (ASD, Commonwealth Cyber Security Posture in 2025) - the bar is high even for well-funded agencies.
SMB1001 takes a similar control set and packages it as a small-business certification: five levels, Bronze through Diamond, with self-attested assessment at the lower tiers and third-party auditing at Platinum and above. Developed by Dynamic Standards International (DSI) and certified by CyberCert, it is renewed annually and designed to be achievable by a business with no dedicated security team.
Side-by-side
| SMB1001 | Essential Eight | |
|---|---|---|
| Written for | Small and medium businesses | Australian government systems |
| Structure | 5 levels: Bronze, Silver, Gold, Platinum, Diamond | 8 strategies, maturity levels 0-3 |
| Assessment | Self-attested at lower tiers; audited at Platinum+ | Point-in-time maturity assessment, no certificate |
| Certification body | CyberCert (DSI standard) | None - ASD publishes no certification requirement |
| Renewal | Annual, evidence refreshed each cycle | Continuous; level drifts between assessments |
| Mandatory for | Nothing - it is market-driven | Commonwealth entities at ML2 (PSPF Policy 14) |
| Typical SMB entry | Bronze or Silver | ML1 as floor, ML2 as credible target |
Where they overlap
The overlap is the reason you rarely choose one from scratch. Both frameworks assess:
- Multi-factor authentication on email, remote access and privileged accounts.
- Patch cadence for operating systems and applications.
- Backups - tested, with a restore someone has performed.
- Administrative access control - who has it and when it was last reviewed.
- Staff awareness training, with completion records.
That last line is where both frameworks behave the same and where most SMBs lose points: awareness training needs a running cadence across a workforce that changes, not a screenshot. Patching can be evidenced once; training evidence decays with every hire. A monthly lesson schedule with phishing simulations and per-person human risk reporting produces the records both assessments ask for on the day they ask.
How to choose
Pick by the buyer, not the framework:
- Clients ask a security questionnaire at onboarding? SMB1001 at the level they recognise - the certificate answers the questionnaire in one line.
- Government tenders or a prime contractor in your future? Essential Eight evidence, at least ML1 and moving to ML2. Our guide to SMB1001 and government tenders covers where a certificate still helps in procurement.
- Cyber insurance renewal? Both help; underwriters mainly want evidence that named controls exist and staff are trained.
- No external pressure yet? Start with a gap assessment scored against both - it shows which framework your current posture is closer to and which gaps to close first.
The SMB1001 certification levels benchmark shows what each tier requires, and the Essential Eight maturity levels benchmark scores the alternative in the same shape, so the two can be compared control by control.
Running both without doubling the work
The efficient pattern is one evidence base, two mappings. Run a single control programme - MFA everywhere, patching cadence, tested backups, restricted admin, monthly training - and record the evidence in one place. Certify SMB1001 at the level your market recognises, and when an Essential Eight question arrives, map the same evidence to the maturity levels and close the specific gaps it exposes (usually application control and user application hardening, the two strategies SMBs most often miss). Cyber Aware's security awareness training covers the human-layer evidence both frameworks share, so the training cadence is built once and cited twice.
FAQ
Is SMB1001 easier than Essential Eight? Yes, by design. SMB1001's lower tiers are self-attested and scoped for businesses without a security team, while Essential Eight ML2 demands the same maturity across all eight strategies, set by the weakest.
Is Essential Eight mandatory for private business? No. It is mandatory only for non-corporate Commonwealth entities, but insurers, tenders and prime contractors increasingly demand equivalent evidence.
Can a business be certified in both? Essential Eight has no certification - it is a maturity measure - but a business can certify SMB1001 and assess Essential Eight maturity alongside it; most controls evidence once for both.
Which level of SMB1001 equals Essential Eight ML2? There is no formal equivalence, but Platinum (audited) is the tier most often cited when a buyer expects ML2-style rigour. Compare control by control rather than level by level.
What does each cost? SMB1001 pricing varies by level and provider, with Bronze self-assessment cheapest; Essential Eight costs nothing to read but real money to implement at ML2 - the honest comparison is a gap assessment against both, scored.
Which should a 15-person business start with? SMB1001 Bronze: it certifies the core controls a 15-person team can evidence today, and the same evidence maps to Essential Eight ML1 when a contract asks.
One last thing
Frameworks do not stop breaches; the controls do. Both of these documents describe overlapping versions of the same short list - MFA, patching, backups, admin control, trained staff - and any business running all five well, with records, passes whichever assessment its buyers choose.