SMB1001 and the Essential Eight both trace back to the same Australian cyber security guidance, but they answer different questions. SMB1001 certifies that your business meets a defined security standard and hands you a certificate you can show clients. The Essential Eight is a prioritised set of eight mitigation strategies from the Australian Signals Directorate that you mature against over time. This guide compares the two on cost, effort and outcomes, so you can pick the right one — or plan both.
Key takeaways
- SMB1001 is a certifiable standard with Bronze to Diamond tiers and annual renewal; the Essential Eight is a maturity framework assessed at Maturity Levels 0-3 per strategy.
- Choose SMB1001 when a client, insurer or tender asks for proof of certification; choose the Essential Eight when you want a hardening roadmap or government supply expects it.
- The two overlap heavily: SMB1001's controls map onto the eight Essential Eight strategies, so work done for one usually counts toward the other.
- Staff training matters under both — phishing and social engineering drive most breaches of small businesses regardless of which framework you adopt.
What the Essential Eight is
The Essential Eight is the Australian Signals Directorate's baseline of eight mitigation strategies: application control, patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, Microsoft Office macro restrictions, user application hardening and regular backups. Each strategy is assessed at a Maturity Level from 0 to 3, and most small businesses target Maturity Level 1 first. The framework is published and maintained for free by the Australian Cyber Security Centre at cyber.gov.au — your cost sits in implementing and evidencing the controls, not in licensing the framework.
What SMB1001 is
SMB1001 is a cyber security standard built for small and medium businesses by CyberCert and aligned with the same Australian guidance. It packages the controls into five certification tiers — Bronze, Silver, Gold, Platinum and Diamond — and a certificate is issued by an accredited certification body. Bronze and Silver are reviewed against defined criteria and renewed annually; Gold and above add an independent audit. Pricing starts at about $95 per year at Bronze and scales with tier, which is why many small businesses treat SMB1001 as the fastest route to a certificate they can attach to a tender response or client due-diligence form.
SMB1001 vs Essential Eight side by side
| SMB1001 | Essential Eight | |
|---|---|---|
| What it is | Certifiable standard for small and medium businesses | Maturity framework from the ASD / ACSC |
| Outcome | A certificate clients can verify | A maturity rating (ML0-ML3) per strategy |
| Who checks | Accredited certification body | Self-assessment or an ASD-endorsed assessor |
| Cost | From about $95/year at Bronze, scaling by tier | Framework is free; implementation and assessment cost |
| Tiers / levels | Bronze, Silver, Gold, Platinum, Diamond | Maturity Levels 0-3 per strategy |
| Renewal | Annual | Re-assessed as needed |
| Best for | Proving security posture to clients, insurers and tenders | A prioritised roadmap to harden your systems |
Which one should your business pick?
Pick SMB1001 when someone outside your business needs to verify your security: a client's supplier onboarding form, a cyber insurance application, a government or corporate tender, or a franchise head office. A certificate answers those questions in one document.
Pick the Essential Eight when your goal is internal: you want a ranked list of what to fix first, you are preparing for government supply chains where the ISM and Essential Eight are the reference, or you already know a buyer will mature-audit you against it.
Pick both, in sequence when you want certification now and maturity later: most businesses reach SMB1001 Bronze quickly, then use the Essential Eight as the roadmap for the controls that Bronze and Silver assume.
Can you do both without doubling the work?
Yes — SMB1001's controls are drawn from the same Australian guidance as the Essential Eight, so implementing one strategy at a time moves you forward in both frameworks. A practical order for a small business: turn on multi-factor authentication everywhere, patch applications and operating systems on a fixed schedule, restrict who has admin rights, set reliable backups, then lock down Office macros and application installs. Documenting training completion alongside gives you the human-layer evidence both frameworks and insurers ask about.
Related questions
Does SMB1001 replace the Essential Eight?
No — SMB1001 is a commercial certification built for small businesses; the Essential Eight is the ASD's framework for organisations of any size. They are aligned in content, not interchangeable in status: a tender that names the Essential Eight expects Essential Eight evidence.
Is the Essential Eight mandatory for Australian businesses?
Not for most private businesses. It is mandatory for Australian Government entities at set maturity levels, and non-government organisations often adopt it voluntarily or because clients and insurers expect it.
Which one is faster to achieve?
SMB1001 Bronze is usually faster because the tier is scoped for small businesses and the review is lighter. Reaching Essential Eight Maturity Level 1 across all eight strategies typically takes a small business 3-6 months of part-time effort.
FAQ
How much does each one cost? The Essential Eight framework itself is free from cyber.gov.au; you pay for implementation and any assessment. SMB1001 starts around $95 per year at Bronze, $195 at Silver and $495 at Gold, with audit fees at Platinum and above.
Can a five-person business realistically do this? Yes. Both frameworks were designed with small businesses in mind: SMB1001 Bronze assumes minimal IT staff, and Essential Eight Maturity Level 1 is achievable with the built-in tools most businesses already own, such as Microsoft 365 security settings.
Where does staff training fit? Neither framework certifies your people by itself, but phishing is the top breach cause for small businesses — documented awareness training strengthens both an SMB1001 review and an Essential Eight assessment, and it is what insurers actually ask about at renewal.