SMB1001 and ISO 27001 both certify that a business manages information security deliberately - the difference is scope, cost and who expects to see the certificate. Choose SMB1001 if you run a small or medium Australian business that needs fast, affordable evidence for tenders and cyber insurance; choose ISO 27001 if you sell to enterprises or overseas, where the ISO/IEC 27001:2022 certificate is the expected answer.
TL;DR
- SMB1001 is built for small and medium businesses: five levels from Bronze to Diamond, with 7 requirements at the bottom and 39 at the top, attested at the lower tiers and audited at Diamond.
- ISO 27001 is the world's best-known information security standard: more than 70,000 certificates across 150 countries were reported in the ISO Survey 2022.
- SMB1001 renews annually with tier-based assessment; ISO 27001 certifies for three years with a surveillance audit each year in between.
- A common path: certify SMB1001 now, run the gap work for ISO 27001 in parallel, and switch when enterprise buyers ask.
Who each certification is built for
SMB1001 is a certification scheme designed for small and medium businesses. It runs on five levels - Bronze, Silver, Gold, Platinum and Diamond. The entry levels are attested, meaning an assessor reviews your evidence rather than running a full audit, while Diamond is audited end to end. The lower tiers start at 7 requirements and the top tier reaches 39, and the certificate is renewed annually so the evidence stays current.
ISO/IEC 27001:2022 is an international standard that defines what an information security management system (ISMS) must include: a defined scope, a risk assessment and treatment plan, policies, the controls in Annex A, internal audits, management review and continual improvement. Certification is issued by an accredited certification body. It suits organisations of any size, but the management-system overhead - the risk register, the Statement of Applicability, the internal audit programme - is the real cost, not the audit day itself.
Side-by-side comparison
| Dimension | SMB1001 | ISO 27001 |
|---|---|---|
| Built for | Small and medium businesses | Organisations of any size |
| Structure | Five levels: Bronze to Diamond | One standard, maturity you define |
| Requirements | 7 at Bronze, 39 at Diamond | Full ISMS plus Annex A controls |
| Assessment | Attested at lower tiers, audited at Diamond | Accredited third-party audit |
| Renewal | Annual | Three-year certificate, annual surveillance audits |
| Recognition | Australian SMB and tender market | Global - 70,000+ certificates in 150 countries |
| Typical time | Weeks per level | Months of ISMS build-out first |
| Best fit | Fast, affordable, local evidence | Enterprise and international procurement |
Where SMB1001 wins
- Speed to a certificate. Bronze can be attested from evidence you mostly already have - MFA, backups, an email filter and staff training records.
- Cost that scales with the level you pick. You certify at the tier that matches your risk instead of standing up an entire ISMS to reach a first certificate.
- Local recognition. Australian procurement teams and insurers increasingly accept SMB1001 as evidence of cyber security maturity in tenders.
Where ISO 27001 wins
- Global recognition. The certificate is understood by buyers in every market - the ISO Survey 2022 counted over 70,000 certificates across 150 countries.
- Depth of the management system. The risk register, internal audits and management review build a security programme, not just a control checklist.
- Procurement fit. Enterprise and government buyers overseas ask for ISO 27001 by name, and a supplier questionnaire that starts with the ISMS usually ends there too.
Which should you choose
- If you are an Australian SMB chasing tenders or a better cyber insurance premium, SMB1001: it is the fastest credible evidence you can put in a bid.
- If you are selling to enterprises or into overseas markets, ISO 27001: procurement teams ask for it by name and recognise it without explanation.
- If you want both, sequence them: certify SMB1001 now, run a gap assessment against the ISO controls, and move when the pipeline demands it.
Whichever route you take, certification bodies look for the same human-layer evidence: staff security awareness training with completion records, phishing simulation results and policy acknowledgements. ISO 27001 names it directly in Annex A control A.6.3, and SMB1001's higher tiers expect the same discipline. Security awareness training covers what a platform-delivered cadence includes, and human risk reporting shows how to package that evidence for an assessor.
FAQ
Is SMB1001 recognised outside Australia? It is designed for and best recognised in the Australian market. For international procurement, ISO 27001 is the certificate buyers know.
Can SMB1001 lead into ISO 27001? Yes - the Diamond level is audited and the control areas overlap heavily, so the evidence you build for SMB1001 carries straight into an ISO 27001 gap assessment.
How long does each certification take? SMB1001 Bronze can be attested in weeks from existing evidence. ISO 27001 typically takes months of ISMS build-out before the Stage 1 and Stage 2 audits.
Does either replace the Essential Eight? No. The Essential Eight is ASD's set of eight mitigation strategies, and its maturity levels are a separate benchmark. Certifications and the Essential Eight complement each other.
Which one helps win government tenders? Both carry weight: SMB1001 is accepted in Australian SMB tenders as maturity evidence, while ISO 27001 is the standard answer in enterprise and federal contexts.
Do the certifications require staff training? ISO 27001 requires it directly - Annex A control A.6.3 covers awareness, education and training. SMB1001's higher tiers expect training records and phishing evidence as part of the review.