Three frameworks keep turning up in tenders, client questionnaires and insurance forms. They do different jobs: one is a tiered certification built for small businesses, one is ASD’s guidance on what to fix first, and one is an international management system standard. Here is how to tell which one you need first.
TL;DR
- The short answer: pick the one your customer, tender or regulator names. If nobody names one, use ASD Essentials to decide what to fix first, SMB1001 if you want a credential you can earn in steps, and ISO/IEC 27001 when clients or contracts ask for an internationally recognised, independently audited certificate.
- ASD Essentials is free government guidance from the Australian Signals Directorate. There is no certificate. You assess whether each security action is working and keep the evidence.
- SMB1001 is a five-level standard for small and medium businesses from Dynamic Standards International (DSI). Certificates are issued by a separate certifier, CyberCert. On its pricing page only Levels 4 and 5 are marked "Verified" and include an external audit; the lower levels rest on a director or owner attestation.
- ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS). Certification comes from an accredited certification body after a two-stage audit, followed by surveillance audits.
- They overlap heavily. Work done for one is reusable evidence for the others, so the order matters more than the choice.
The three frameworks at a glance
| SMB1001 | ASD Essentials | ISO/IEC 27001:2022 | |
|---|---|---|---|
| Published by | Dynamic Standards International, a not-for-profit standards body | Australian Signals Directorate (ASD) | ISO and IEC (international standards bodies) |
| Current version | SMB1001:2026 (released 1 September 2025), updated annually | First published 15 October 2026 | Third edition, October 2022 |
| What it is | Tiered set of controls for small and medium businesses | Principles, actions and domains, with a recommended order of work | Requirements for a management system (clauses 4 to 10), plus a reference set of 93 controls (Annex A) |
| Levels | Five levels you can stop at | No levels: three priority phases set the order of work | None: you are certified or you are not |
| Who checks | The certifier’s platform plus a director or owner attestation; an external audit is added at Levels 4 and 5 | You, or an assessor you engage. ASD does not certify | An accredited certification body, independent of whoever helped you prepare |
| What you get | A certificate and badge for the level | A posture report: ratings per action, principle and domain | A certificate, with surveillance audits during a three-year cycle |
| Scope | Your organisation, certified at the level you choose | Each domain of your environment, chapter by chapter | The scope you define and the auditor accepts |
Sources: DSI SMB1001 page, CyberCert certification page, ASD Essentials FAQ, IEC Webstore listing for ISO/IEC 27001:2022.
What is each one, in plain terms?
SMB1001
DSI publishes SMB1001 as "a multi-tiered cybersecurity certification standard" for small and medium businesses. It has five levels:
- Level 1 covers basic preventive controls. DSI’s FAQ lists engaging a technical support specialist, installing a firewall, antivirus on all devices, automatic software updates and patches, changing passwords routinely and a backup and recovery strategy.
- Level 2 adds stronger preventive measures.
- Level 3 introduces risk management across people, process and technology.
- Levels 4 and 5 add formal governance, policies and risk management practice.
The controls cover five areas: technology management, access management, backup and recovery, policies and procedures, and education and training. DSI doesn’t issue certificates itself. Certification is managed by authorised "Dynamic Standard Certifiers", and DSI currently names CyberCert as the only one, with BSI Group and InfoSecAssure listed as independent verification organisations. CyberCert brands the levels Bronze, Silver, Gold, Platinum and Diamond. Every subscription includes an attestation letter for directors or owners to sign, and only Platinum and Diamond are marked "Verified" and include an external audit fee.
That distinction matters when a client reads your badge. A Level 2 certificate tells them your directors have formally attested to a defined set of controls. It does not tell them an auditor has inspected those controls.
ASD Essentials
ASD Essentials is ASD’s new framework, published on 15 October 2026. ASD calls it an evolution of the Essential Eight, and keeps both on cyber.gov.au during the transition. It organises security into principles (outcomes), actions (what to do) and domains (where each action applies). It then rates each action as not assessed, not effective, partially effective or fully effective, based on evidence (What is the Essentials?, Assessment process guide).
ASD doesn’t issue certificates. Its assessment guide is designed for organisations assessing their own environment, and ASD’s FAQ says it is "not intended to be used to assess the posture of suppliers". So if a client asks you for an "ASD Essentials certificate", what they really want is your assessment results and evidence. Our ASD Essentials guide for small organisations covers the structure and a 90-day plan.
ISO/IEC 27001:2022
ISO/IEC 27001 specifies the requirements for "establishing, implementing, maintaining and continually improving an information security management system". It applies to organisations "regardless of type, size or nature", and every requirement in clauses 4 to 10 is mandatory if you claim conformity (IEC Webstore abstract). Annex A lists 93 controls in four themes: organisational, people, physical and technological. You pick the controls that treat your risks and justify the rest in a Statement of Applicability.
Certification is done by a certification body. In Australia and New Zealand, the accreditation behind that body usually comes from JASANZ, the joint accreditation body for both countries, whose public register lets anyone look up an accredited body or a certified organisation. For the full process, see how ISO 27001 certification works.
Who asks for each?
Government buyers. Commonwealth entities have their own obligations under the Protective Security Policy Framework. The PSPF 2026 requirements still require them to meet Maturity Level Two under ASD’s earlier model, and ASD Essentials adds supplier assurance as a governance principle. Expect agency questionnaires to ask about ASD controls by name, and some tenders to ask for ISO/IEC 27001 certification as well. Some departments go further: JASANZ describes an information security accreditation scheme it built with the federal employment department for its employment service providers.
Enterprise clients. Large companies, especially those with international parents, often ask for ISO/IEC 27001 or an equivalent independent report. Their supplier questionnaires often accept a certificate in place of dozens of individual answers.
Insurers. Cyber insurance forms typically ask about specific controls, such as MFA, backups, patching and incident response, rather than a framework name. Any of the three helps if you have evidence. CyberCert says its Silver level "demonstrates the security baseline most insurers require". Treat that as the certifier’s claim and check it with your broker.
Funders and boards. Not-for-profits and member organisations are often asked by funders to show a recognised security baseline. ASD’s frameworks are the usual Australian reference point, and SMB1001 gives a certificate for smaller organisations that want one.
Nobody yet. Then you have a free choice. Use it to build controls that will count as evidence later, whichever framework is named first.
Scope, effort and evidence compared
Scope. SMB1001 certifies your organisation at the level you choose. ASD Essentials applies per domain, so the same control is rated separately for identity services, internet-facing services, user devices and so on. ISO/IEC 27001 applies to a scope you define, such as "the delivery of managed services from our Sydney office". A tight scope makes certification achievable, but clients will read what it covers.
Effort. SMB1001 at Levels 1 and 2 is mostly technical hygiene that many managed businesses already have. ASD Essentials asks more, because each action is rated on coverage, consistency, currency and evidence quality, and governance is assessed. ISO/IEC 27001 is the most work up front. You need a documented risk assessment, a Statement of Applicability, objectives, an internal audit and a management review, all running before the certification audit.
Evidence.
| What counts | |
|---|---|
| SMB1001 | Proof each control at your level is in place, plus a signed director attestation; auditor-verified at Levels 4 and 5 |
| ASD Essentials | Evidence the action works across every asset in the domain. ASD ranks evidence from poor (a claim that a control exists) to excellent (direct proof it works in the live environment) |
| ISO/IEC 27001 | Documented information required by the clauses, records that the ISMS is operating, and evidence for each control you’ve declared applicable |
How do they overlap?
Most of the work is shared. A control you build once can be evidence for all three:
| Security area | SMB1001 area | ASD Essentials principle | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| MFA and sign-in | Access management | Identity, credential and access management | A.5.15 Access control; A.8.5 Secure authentication |
| Admin rights | Access management | Least privilege access; Secure administration | A.8.2 Privileged access rights |
| Patching and scanning | Technology management | Vulnerability management | A.8.8 Management of technical vulnerabilities |
| Backups and restore tests | Backup and recovery | Regular and proven backups | A.8.13 Information backup |
| Staff training | Education and training | Cyber security awareness training | A.6.3 Information security awareness, education and training |
| Incident response | Policies, plans and procedures | Cyber security incident response | A.5.24 and A.5.26 (incident planning and response) |
| Asset register | Technology management | Asset identification | A.5.9 Inventory of information and other associated assets |
| Logging | Technology management | Centralised event logging | A.8.15 Logging |
| Suppliers | Policies, plans and procedures | Supplier cyber security assurance | A.5.19 to A.5.22 (supplier relationships) |
| Leadership and risk | Policies, plans and procedures (higher levels) | Executive cyber security accountability; Security risk management assurance | Clauses 5 and 6 (leadership, risk assessment and treatment) |
ASD’s FAQ confirms the overlap from its side: the assessment evidence guide "contains references to controls from other frameworks that may serve as evidence", provided they have been implemented. The difference is the lens. SMB1001 asks "is it in place?", ASD Essentials asks "is it working everywhere it should?" and ISO/IEC 27001 asks "is it managed, measured and improved?"
Getting ready for ASD Essentials? We help you assess where you are, close the gaps that matter most, and keep the evidence an assessor will ask for.
Which first? A decision table
| If you are… | Start with | Then |
|---|---|---|
| A small business (5 to 20 staff) with no external requests, wanting a sensible baseline | ASD Essentials phase 1 actions (identity and internet-facing services) as your to-do list | SMB1001 Level 1 or 2 if a client or insurer asks for a credential |
| A small business whose larger clients want "something certified" in the next few months | SMB1001 at the level your client accepts (confirm whether they need the audited levels) | ISO/IEC 27001 if those clients later name it |
| A supplier to Commonwealth or state agencies | ASD Essentials, mapped against what your contracts require today | ISO/IEC 27001 if tenders in your category ask for it |
| A firm holding sensitive client data (legal, financial, health, HR, technology services) | ISO/IEC 27001, scoped to the services clients buy | Use ASD Essentials to set technical priorities inside the ISMS |
| A software or SaaS company selling to enterprises or overseas | ISO/IEC 27001 | ASD Essentials (cloud chapter) for Australian government buyers |
| A not-for-profit reporting to funders | ASD Essentials as the structure for board reporting | SMB1001 if a funder asks for a certificate |
| Already certified to SMB1001 at a lower level | ASD Essentials phase 1 to find what "working everywhere" means for you | SMB1001 higher levels or ISO/IEC 27001, depending on who’s asking |
| Already certified to ISO/IEC 27001 | Map your Statement of Applicability to ASD Essentials actions | Strengthen evidence where ASD rates it weak |
A worked example
A common example: a 40-person professional services firm gets a security questionnaire from a large client, a renewal form from its insurer and a government tender that mentions ISO/IEC 27001 as "desirable".
- The questionnaire and the insurance form both ask about MFA, backups, patching and incident response. Those are ASD Essentials phase 1 work plus backups, and they also match SMB1001 Levels 1 and 2.
- The tender only says "desirable", so ISO/IEC 27001 can be planned rather than rushed.
- A sensible order: fix and evidence the phase 1 actions first, so the questionnaire and insurance answers are true and provable. Then decide between SMB1001 and ISO/IEC 27001 based on which buyers matter most. The firm then builds the ISMS on controls that already work, instead of writing policies for controls that don’t exist yet.
Mistakes to avoid
- Collecting badges instead of fixing gaps. A certificate that doesn’t match reality fails at the first incident and invites hard questions from insurers.
- Assuming one certificate answers every questionnaire. Read what each buyer actually asks for: a named standard, audited assurance, or answers about specific controls.
- Over-scoping ISO/IEC 27001. Start with the services clients buy. You can extend the scope later.
- Treating ASD Essentials as a pass mark. Priority phases are an order of work, not a grade. Report "not assessed" honestly.
- Taking the quickest route to a logo. If a client asks for "independently audited", a director attestation will not satisfy them.
Working towards ISO 27001? As an ISO/IEC 27001:2022 certified company ourselves, we help you build an ISMS that works and prepare for your accredited body’s audit.
Key takeaways
- Let the buyer, regulator or tender decide where you can. Otherwise, start with the controls all three frameworks share.
- SMB1001 is a five-level certification for small and medium businesses. Its lower levels rely on director attestation and only the top two include an external audit.
- ASD Essentials is free guidance with outcome-based ratings and no certificate. Government suppliers should map to it now.
- ISO/IEC 27001 is an independently audited management system standard, certified by an accredited body and kept under surveillance audits.
- Build once, evidence many times: MFA, patching, backups, logging, incident response and supplier checks count in all three.
- Catharsis is certified to ISO/IEC 27001:2022 and helps organisations prepare for ASD Essentials and ISO 27001. Certification itself always comes from an accredited body.
Sources
- Dynamic Standards International, SMB1001:2026
- CyberCert, SMB1001 certification levels and inclusions and home page (certifier’s own claims)
- ASD, ASD Essentials launch notice (15 October 2026)
- ASD’s ACSC, What is the Essentials?
- ASD’s ACSC, ASD Essentials frequently asked questions
- ASD’s ACSC, Assessment process guide
- ASD’s ACSC, Essentials for enterprise IT
- IEC Webstore, ISO/IEC 27001:2022 listing and abstract
- ISO, ISO/IEC 27001:2022
- JASANZ, home page and register of accredited bodies and certified organisations
- JASANZ, When "trust us" isn’t enough: building confidence in information security
- Department of Home Affairs, PSPF Release 2026: list of requirements
Want a second pair of eyes?
Catharsis Cyber Security is a Sydney cyber security company, certified to ISO/IEC 27001:2022. We help organisations protect, test and run their technology, and explain it in plain English.
