{"id":1266,"date":"2026-10-20T10:10:00","date_gmt":"2026-10-19T23:10:00","guid":{"rendered":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/"},"modified":"2026-11-03T21:47:15","modified_gmt":"2026-11-03T10:47:15","slug":"smb1001-vs-asd-essentials-vs-iso-27001","status":"publish","type":"post","link":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/","title":{"rendered":"SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need?"},"content":{"rendered":"\n<p class=\"has-pale-cyan-blue-background-color has-background wp-block-paragraph\">Three frameworks keep turning up in tenders, client questionnaires and insurance forms. They do different jobs: one is a tiered certification built for small businesses, one is ASD&#8217;s guidance on what to fix first, and one is an international management system standard. Here is how to tell which one you need first.<\/p>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#f4f6f8;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\"><strong>Related guides<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/\" target=\"_blank\" rel=\"noreferrer noopener\">ASD Essentials for Small Business: What Changed, What to Do First<\/a><\/li>\n\n\n<li><a href=\"https:\/\/catharsis.net.au\/blog\/iso-27001-certification-process\/\" target=\"_blank\" rel=\"noreferrer noopener\">How Does ISO 27001 Certification Work? Stages, Documents, Audits<\/a><\/li>\n\n\n<li><a href=\"https:\/\/catharsis.net.au\/blog\/what-is-internal-external-penetration-testing\/\" target=\"_blank\" rel=\"noreferrer noopener\">What is Internal &amp; External Penetration Testing?<\/a><\/li>\n\n<\/ul>\n\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#f4f6f8;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<h3 class=\"wp-block-heading\">TL;DR<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>The short answer:<\/strong> pick the one your customer, tender or regulator names. If nobody names one, use ASD Essentials to decide what to fix first, SMB1001 if you want a credential you can earn in steps, and ISO\/IEC 27001 when clients or contracts ask for an internationally recognised, independently audited certificate.<\/li>\n\n\n<li><strong>ASD Essentials<\/strong> is free government guidance from the Australian Signals Directorate. There is no certificate. You assess whether each security action is working and keep the evidence.<\/li>\n\n\n<li><strong>SMB1001<\/strong> is a five-level standard for small and medium businesses from Dynamic Standards International (DSI). Certificates are issued by a separate certifier, CyberCert. On its pricing page only Levels 4 and 5 are marked &quot;Verified&quot; and include an external audit; the lower levels rest on a director or owner attestation.<\/li>\n\n\n<li><strong>ISO\/IEC 27001:2022<\/strong> is the international standard for an information security management system (ISMS). Certification comes from an accredited certification body after a two-stage audit, followed by surveillance audits.<\/li>\n\n\n<li>They overlap heavily. Work done for one is reusable evidence for the others, so the order matters more than the choice.<\/li>\n\n<\/ul>\n\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#f4f6f8;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<h3 class=\"wp-block-heading\">In this post<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"#the-three-frameworks-at-a-glance\">The three frameworks at a glance<\/a><\/li>\n\n\n<li><a href=\"#what-is-each-one-in-plain-terms\">What is each one, in plain terms?<\/a><\/li>\n\n\n<li><a href=\"#who-asks-for-each\">Who asks for each?<\/a><\/li>\n\n\n<li><a href=\"#scope-effort-and-evidence-compared\">Scope, effort and evidence compared<\/a><\/li>\n\n\n<li><a href=\"#how-do-they-overlap\">How do they overlap?<\/a><\/li>\n\n\n<li><a href=\"#which-first-a-decision-table\">Which first? A decision table<\/a><\/li>\n\n\n<li><a href=\"#mistakes-to-avoid\">Mistakes to avoid<\/a><\/li>\n\n\n<li><a href=\"#key-takeaways\">Key takeaways<\/a><\/li>\n\n\n<li><a href=\"#sources\">Sources<\/a><\/li>\n\n<\/ul>\n\n<\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"the-three-frameworks-at-a-glance\">The three frameworks at a glance<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th><\/th>\n<th>SMB1001<\/th>\n<th>ASD Essentials<\/th>\n<th>ISO\/IEC 27001:2022<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Published by<\/td>\n<td>Dynamic Standards International, a not-for-profit standards body<\/td>\n<td>Australian Signals Directorate (ASD)<\/td>\n<td>ISO and IEC (international standards bodies)<\/td>\n<\/tr>\n<tr>\n<td>Current version<\/td>\n<td>SMB1001:2026 (released 1 September 2025), updated annually<\/td>\n<td>First published 15 October 2026<\/td>\n<td>Third edition, October 2022<\/td>\n<\/tr>\n<tr>\n<td>What it is<\/td>\n<td>Tiered set of controls for small and medium businesses<\/td>\n<td>Principles, actions and domains, with a recommended order of work<\/td>\n<td>Requirements for a management system (clauses 4 to 10), plus a reference set of 93 controls (Annex A)<\/td>\n<\/tr>\n<tr>\n<td>Levels<\/td>\n<td>Five levels you can stop at<\/td>\n<td>No levels: three priority phases set the order of work<\/td>\n<td>None: you are certified or you are not<\/td>\n<\/tr>\n<tr>\n<td>Who checks<\/td>\n<td>The certifier&#8217;s platform plus a director or owner attestation; an external audit is added at Levels 4 and 5<\/td>\n<td>You, or an assessor you engage. ASD does not certify<\/td>\n<td>An accredited certification body, independent of whoever helped you prepare<\/td>\n<\/tr>\n<tr>\n<td>What you get<\/td>\n<td>A certificate and badge for the level<\/td>\n<td>A posture report: ratings per action, principle and domain<\/td>\n<td>A certificate, with surveillance audits during a three-year cycle<\/td>\n<\/tr>\n<tr>\n<td>Scope<\/td>\n<td>Your organisation, certified at the level you choose<\/td>\n<td>Each domain of your environment, chapter by chapter<\/td>\n<td>The scope you define and the auditor accepts<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Sources: <a href=\"https:\/\/dsi.org\/smb1001\/\" target=\"_blank\" rel=\"noreferrer noopener\">DSI SMB1001 page<\/a>, <a href=\"https:\/\/cybercert.ai\/en-au\/certify\/\" target=\"_blank\" rel=\"noreferrer noopener\">CyberCert certification page<\/a>, <a href=\"https:\/\/www.cyber.gov.au\/publication\/frequently-asked-questions\" target=\"_blank\" rel=\"noreferrer noopener\">ASD Essentials FAQ<\/a>, <a href=\"https:\/\/webstore.iec.ch\/publication\/79694\" target=\"_blank\" rel=\"noreferrer noopener\">IEC Webstore listing for ISO\/IEC 27001:2022<\/a>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-is-each-one-in-plain-terms\">What is each one, in plain terms?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">SMB1001<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">DSI publishes SMB1001 as &quot;a multi-tiered cybersecurity certification standard&quot; for small and medium businesses. It has five levels:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Level 1 covers basic preventive controls. DSI&#8217;s FAQ lists engaging a technical support specialist, installing a firewall, antivirus on all devices, automatic software updates and patches, changing passwords routinely and a backup and recovery strategy.<\/li>\n\n\n<li>Level 2 adds stronger preventive measures.<\/li>\n\n\n<li>Level 3 introduces risk management across people, process and technology.<\/li>\n\n\n<li>Levels 4 and 5 add formal governance, policies and risk management practice.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The controls cover five areas: technology management, access management, backup and recovery, policies and procedures, and education and training. DSI doesn&#8217;t issue certificates itself. Certification is managed by authorised &quot;Dynamic Standard Certifiers&quot;, and DSI currently names CyberCert as the only one, with BSI Group and InfoSecAssure listed as independent verification organisations. CyberCert brands the levels Bronze, Silver, Gold, Platinum and Diamond. Every subscription includes an attestation letter for directors or owners to sign, and only Platinum and Diamond are marked &quot;Verified&quot; and include an external audit fee.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That distinction matters when a client reads your badge. A Level 2 certificate tells them your directors have formally attested to a defined set of controls. It does not tell them an auditor has inspected those controls.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">ASD Essentials<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">ASD Essentials is ASD&#8217;s new framework, published on 15 October 2026. ASD calls it an evolution of the Essential Eight, and keeps both on cyber.gov.au during the transition. It organises security into <strong>principles<\/strong> (outcomes), <strong>actions<\/strong> (what to do) and <strong>domains<\/strong> (where each action applies). It then rates each action as not assessed, not effective, partially effective or fully effective, based on evidence (<a href=\"https:\/\/www.cyber.gov.au\/publication\/what-is-the-essentials\" target=\"_blank\" rel=\"noreferrer noopener\">What is the Essentials?<\/a>, <a href=\"https:\/\/www.cyber.gov.au\/publication\/assessment-process-guide\" target=\"_blank\" rel=\"noreferrer noopener\">Assessment process guide<\/a>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ASD doesn&#8217;t issue certificates. Its assessment guide is designed for organisations assessing their own environment, and ASD&#8217;s FAQ says it is &quot;not intended to be used to assess the posture of suppliers&quot;. So if a client asks you for an &quot;ASD Essentials certificate&quot;, what they really want is your assessment results and evidence. Our <a href=\"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/\" target=\"_blank\" rel=\"noreferrer noopener\">ASD Essentials guide for small organisations<\/a> covers the structure and a 90-day plan.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">ISO\/IEC 27001:2022<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">ISO\/IEC 27001 specifies the requirements for &quot;establishing, implementing, maintaining and continually improving an information security management system&quot;. It applies to organisations &quot;regardless of type, size or nature&quot;, and every requirement in clauses 4 to 10 is mandatory if you claim conformity (<a href=\"https:\/\/webstore.iec.ch\/publication\/79694\" target=\"_blank\" rel=\"noreferrer noopener\">IEC Webstore abstract<\/a>). Annex A lists 93 controls in four themes: organisational, people, physical and technological. You pick the controls that treat your risks and justify the rest in a Statement of Applicability.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Certification is done by a certification body. In Australia and New Zealand, the accreditation behind that body usually comes from <a href=\"https:\/\/www.jasanz.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">JASANZ<\/a>, the joint accreditation body for both countries, whose <a href=\"https:\/\/register.jasanz.org\/certified-organisations\" target=\"_blank\" rel=\"noreferrer noopener\">public register<\/a> lets anyone look up an accredited body or a certified organisation. For the full process, see <a href=\"https:\/\/catharsis.net.au\/blog\/iso-27001-certification-process\/\" target=\"_blank\" rel=\"noreferrer noopener\">how ISO 27001 certification works<\/a>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"who-asks-for-each\">Who asks for each?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Government buyers.<\/strong> Commonwealth entities have their own obligations under the Protective Security Policy Framework. The <a href=\"https:\/\/www.protectivesecurity.gov.au\/system\/files\/2026-07\/pspf-release-2026-list-requirements_0.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">PSPF 2026 requirements<\/a> still require them to meet Maturity Level Two under ASD&#8217;s earlier model, and ASD Essentials adds supplier assurance as a governance principle. Expect agency questionnaires to ask about ASD controls by name, and some tenders to ask for ISO\/IEC 27001 certification as well. Some departments go further: JASANZ describes an <a href=\"https:\/\/www.jasanz.org\/blog\/fsqundaxqicpk73xzlzrhi8fu5peuj\" target=\"_blank\" rel=\"noreferrer noopener\">information security accreditation scheme<\/a> it built with the federal employment department for its employment service providers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Enterprise clients.<\/strong> Large companies, especially those with international parents, often ask for ISO\/IEC 27001 or an equivalent independent report. Their supplier questionnaires often accept a certificate in place of dozens of individual answers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Insurers.<\/strong> Cyber insurance forms typically ask about specific controls, such as MFA, backups, patching and incident response, rather than a framework name. Any of the three helps if you have evidence. CyberCert says its Silver level &quot;demonstrates the security baseline most insurers require&quot;. Treat that as the certifier&#8217;s claim and check it with your broker.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Funders and boards.<\/strong> Not-for-profits and member organisations are often asked by funders to show a recognised security baseline. ASD&#8217;s frameworks are the usual Australian reference point, and SMB1001 gives a certificate for smaller organisations that want one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Nobody yet.<\/strong> Then you have a free choice. Use it to build controls that will count as evidence later, whichever framework is named first.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"scope-effort-and-evidence-compared\">Scope, effort and evidence compared<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Scope.<\/strong> SMB1001 certifies your organisation at the level you choose. ASD Essentials applies per domain, so the same control is rated separately for identity services, internet-facing services, user devices and so on. ISO\/IEC 27001 applies to a scope you define, such as &quot;the delivery of managed services from our Sydney office&quot;. A tight scope makes certification achievable, but clients will read what it covers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Effort.<\/strong> SMB1001 at Levels 1 and 2 is mostly technical hygiene that many managed businesses already have. ASD Essentials asks more, because each action is rated on coverage, consistency, currency and evidence quality, and governance is assessed. ISO\/IEC 27001 is the most work up front. You need a documented risk assessment, a Statement of Applicability, objectives, an internal audit and a management review, all running before the certification audit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Evidence.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th><\/th>\n<th>What counts<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>SMB1001<\/td>\n<td>Proof each control at your level is in place, plus a signed director attestation; auditor-verified at Levels 4 and 5<\/td>\n<\/tr>\n<tr>\n<td>ASD Essentials<\/td>\n<td>Evidence the action works across every asset in the domain. ASD ranks evidence from poor (a claim that a control exists) to excellent (direct proof it works in the live environment)<\/td>\n<\/tr>\n<tr>\n<td>ISO\/IEC 27001<\/td>\n<td>Documented information required by the clauses, records that the ISMS is operating, and evidence for each control you&#8217;ve declared applicable<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-do-they-overlap\">How do they overlap?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most of the work is shared. A control you build once can be evidence for all three:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th>Security area<\/th>\n<th>SMB1001 area<\/th>\n<th>ASD Essentials principle<\/th>\n<th>ISO\/IEC 27001:2022 Annex A<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>MFA and sign-in<\/td>\n<td>Access management<\/td>\n<td>Identity, credential and access management<\/td>\n<td>A.5.15 Access control; A.8.5 Secure authentication<\/td>\n<\/tr>\n<tr>\n<td>Admin rights<\/td>\n<td>Access management<\/td>\n<td>Least privilege access; Secure administration<\/td>\n<td>A.8.2 Privileged access rights<\/td>\n<\/tr>\n<tr>\n<td>Patching and scanning<\/td>\n<td>Technology management<\/td>\n<td>Vulnerability management<\/td>\n<td>A.8.8 Management of technical vulnerabilities<\/td>\n<\/tr>\n<tr>\n<td>Backups and restore tests<\/td>\n<td>Backup and recovery<\/td>\n<td>Regular and proven backups<\/td>\n<td>A.8.13 Information backup<\/td>\n<\/tr>\n<tr>\n<td>Staff training<\/td>\n<td>Education and training<\/td>\n<td>Cyber security awareness training<\/td>\n<td>A.6.3 Information security awareness, education and training<\/td>\n<\/tr>\n<tr>\n<td>Incident response<\/td>\n<td>Policies, plans and procedures<\/td>\n<td>Cyber security incident response<\/td>\n<td>A.5.24 and A.5.26 (incident planning and response)<\/td>\n<\/tr>\n<tr>\n<td>Asset register<\/td>\n<td>Technology management<\/td>\n<td>Asset identification<\/td>\n<td>A.5.9 Inventory of information and other associated assets<\/td>\n<\/tr>\n<tr>\n<td>Logging<\/td>\n<td>Technology management<\/td>\n<td>Centralised event logging<\/td>\n<td>A.8.15 Logging<\/td>\n<\/tr>\n<tr>\n<td>Suppliers<\/td>\n<td>Policies, plans and procedures<\/td>\n<td>Supplier cyber security assurance<\/td>\n<td>A.5.19 to A.5.22 (supplier relationships)<\/td>\n<\/tr>\n<tr>\n<td>Leadership and risk<\/td>\n<td>Policies, plans and procedures (higher levels)<\/td>\n<td>Executive cyber security accountability; Security risk management assurance<\/td>\n<td>Clauses 5 and 6 (leadership, risk assessment and treatment)<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">ASD&#8217;s FAQ confirms the overlap from its side: the assessment evidence guide &quot;contains references to controls from other frameworks that may serve as evidence&quot;, provided they have been implemented. The difference is the lens. SMB1001 asks &quot;is it in place?&quot;, ASD Essentials asks &quot;is it working everywhere it should?&quot; and ISO\/IEC 27001 asks &quot;is it managed, measured and improved?&quot;<\/p>\n\n\n\n<div class=\"wp-block-group has-pale-cyan-blue-background-color has-background\" style=\"padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px;margin-top:32px;margin-bottom:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\"><strong>Getting ready for ASD Essentials?<\/strong> We help you assess where you are, close the gaps that matter most, and keep the evidence an assessor will ask for.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/asd-essentials\/?utm_source=blog&amp;utm_medium=article&amp;utm_campaign=value-guides&amp;utm_content=smb1001-vs-asd-essentials-vs-iso-27001-asd-essentials\" target=\"_blank\" rel=\"noreferrer noopener\">See ASD Essentials readiness<\/a><\/div>\n\n<\/div>\n\n<\/div><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"which-first-a-decision-table\">Which first? A decision table<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th>If you are\u2026<\/th>\n<th>Start with<\/th>\n<th>Then<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>A small business (5 to 20 staff) with no external requests, wanting a sensible baseline<\/td>\n<td>ASD Essentials phase 1 actions (identity and internet-facing services) as your to-do list<\/td>\n<td>SMB1001 Level 1 or 2 if a client or insurer asks for a credential<\/td>\n<\/tr>\n<tr>\n<td>A small business whose larger clients want &quot;something certified&quot; in the next few months<\/td>\n<td>SMB1001 at the level your client accepts (confirm whether they need the audited levels)<\/td>\n<td>ISO\/IEC 27001 if those clients later name it<\/td>\n<\/tr>\n<tr>\n<td>A supplier to Commonwealth or state agencies<\/td>\n<td>ASD Essentials, mapped against what your contracts require today<\/td>\n<td>ISO\/IEC 27001 if tenders in your category ask for it<\/td>\n<\/tr>\n<tr>\n<td>A firm holding sensitive client data (legal, financial, health, HR, technology services)<\/td>\n<td>ISO\/IEC 27001, scoped to the services clients buy<\/td>\n<td>Use ASD Essentials to set technical priorities inside the ISMS<\/td>\n<\/tr>\n<tr>\n<td>A software or SaaS company selling to enterprises or overseas<\/td>\n<td>ISO\/IEC 27001<\/td>\n<td>ASD Essentials (cloud chapter) for Australian government buyers<\/td>\n<\/tr>\n<tr>\n<td>A not-for-profit reporting to funders<\/td>\n<td>ASD Essentials as the structure for board reporting<\/td>\n<td>SMB1001 if a funder asks for a certificate<\/td>\n<\/tr>\n<tr>\n<td>Already certified to SMB1001 at a lower level<\/td>\n<td>ASD Essentials phase 1 to find what &quot;working everywhere&quot; means for you<\/td>\n<td>SMB1001 higher levels or ISO\/IEC 27001, depending on who&#8217;s asking<\/td>\n<\/tr>\n<tr>\n<td>Already certified to ISO\/IEC 27001<\/td>\n<td>Map your Statement of Applicability to ASD Essentials actions<\/td>\n<td>Strengthen evidence where ASD rates it weak<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">A worked example<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A common example: a 40-person professional services firm gets a security questionnaire from a large client, a renewal form from its insurer and a government tender that mentions ISO\/IEC 27001 as &quot;desirable&quot;.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>The questionnaire and the insurance form both ask about MFA, backups, patching and incident response. Those are ASD Essentials phase 1 work plus backups, and they also match SMB1001 Levels 1 and 2.<\/li>\n\n\n<li>The tender only says &quot;desirable&quot;, so ISO\/IEC 27001 can be planned rather than rushed.<\/li>\n\n\n<li>A sensible order: fix and evidence the phase 1 actions first, so the questionnaire and insurance answers are true and provable. Then decide between SMB1001 and ISO\/IEC 27001 based on which buyers matter most. The firm then builds the ISMS on controls that already work, instead of writing policies for controls that don&#8217;t exist yet.<\/li>\n\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"mistakes-to-avoid\">Mistakes to avoid<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Collecting badges instead of fixing gaps.<\/strong> A certificate that doesn&#8217;t match reality fails at the first incident and invites hard questions from insurers.<\/li>\n\n\n<li><strong>Assuming one certificate answers every questionnaire.<\/strong> Read what each buyer actually asks for: a named standard, audited assurance, or answers about specific controls.<\/li>\n\n\n<li><strong>Over-scoping ISO\/IEC 27001.<\/strong> Start with the services clients buy. You can extend the scope later.<\/li>\n\n\n<li><strong>Treating ASD Essentials as a pass mark.<\/strong> Priority phases are an order of work, not a grade. Report &quot;not assessed&quot; honestly.<\/li>\n\n\n<li><strong>Taking the quickest route to a logo.<\/strong> If a client asks for &quot;independently audited&quot;, a director attestation will not satisfy them.<\/li>\n\n<\/ul>\n\n\n\n<div class=\"wp-block-group has-pale-cyan-blue-background-color has-background\" style=\"padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px;margin-top:32px;margin-bottom:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\"><strong>Working towards ISO 27001?<\/strong> As an ISO\/IEC 27001:2022 certified company ourselves, we help you build an ISMS that works and prepare for your accredited body&#8217;s audit.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/isms-iso27001\/?utm_source=blog&amp;utm_medium=article&amp;utm_campaign=value-guides&amp;utm_content=smb1001-vs-asd-essentials-vs-iso-27001-isms-iso27001\" target=\"_blank\" rel=\"noreferrer noopener\">See ISO 27001 readiness<\/a><\/div>\n\n<\/div>\n\n<\/div><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"key-takeaways\">Key takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Let the buyer, regulator or tender decide where you can. Otherwise, start with the controls all three frameworks share.<\/li>\n\n\n<li>SMB1001 is a five-level certification for small and medium businesses. Its lower levels rely on director attestation and only the top two include an external audit.<\/li>\n\n\n<li>ASD Essentials is free guidance with outcome-based ratings and no certificate. Government suppliers should map to it now.<\/li>\n\n\n<li>ISO\/IEC 27001 is an independently audited management system standard, certified by an accredited body and kept under surveillance audits.<\/li>\n\n\n<li>Build once, evidence many times: MFA, patching, backups, logging, incident response and supplier checks count in all three.<\/li>\n\n\n<li>Catharsis is certified to ISO\/IEC 27001:2022 and helps organisations prepare for <a href=\"https:\/\/catharsis.net.au\/asd-essentials\/\" target=\"_blank\" rel=\"noreferrer noopener\">ASD Essentials<\/a> and <a href=\"https:\/\/catharsis.net.au\/isms-iso27001\/\" target=\"_blank\" rel=\"noreferrer noopener\">ISO 27001<\/a>. Certification itself always comes from an accredited body.<\/li>\n\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"sources\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Dynamic Standards International, <a href=\"https:\/\/dsi.org\/smb1001\/\" target=\"_blank\" rel=\"noreferrer noopener\">SMB1001:2026<\/a><\/li>\n\n\n<li>CyberCert, <a href=\"https:\/\/cybercert.ai\/en-au\/certify\/\" target=\"_blank\" rel=\"noreferrer noopener\">SMB1001 certification levels and inclusions<\/a> and <a href=\"https:\/\/cybercert.ai\/en-au\/\" target=\"_blank\" rel=\"noreferrer noopener\">home page<\/a> (certifier&#8217;s own claims)<\/li>\n\n\n<li>ASD, <a href=\"https:\/\/www.asd.gov.au\/news\/2026-10-15-asd-essentials-evolving-our-approach-cyber-security-resilience\" target=\"_blank\" rel=\"noreferrer noopener\">ASD Essentials launch notice<\/a> (15 October 2026)<\/li>\n\n\n<li>ASD&#8217;s ACSC, <a href=\"https:\/\/www.cyber.gov.au\/publication\/what-is-the-essentials\" target=\"_blank\" rel=\"noreferrer noopener\">What is the Essentials?<\/a><\/li>\n\n\n<li>ASD&#8217;s ACSC, <a href=\"https:\/\/www.cyber.gov.au\/publication\/frequently-asked-questions\" target=\"_blank\" rel=\"noreferrer noopener\">ASD Essentials frequently asked questions<\/a><\/li>\n\n\n<li>ASD&#8217;s ACSC, <a href=\"https:\/\/www.cyber.gov.au\/publication\/assessment-process-guide\" target=\"_blank\" rel=\"noreferrer noopener\">Assessment process guide<\/a><\/li>\n\n\n<li>ASD&#8217;s ACSC, <a href=\"https:\/\/www.cyber.gov.au\/publication\/essentials-for-enterprise-it\" target=\"_blank\" rel=\"noreferrer noopener\">Essentials for enterprise IT<\/a><\/li>\n\n\n<li>IEC Webstore, <a href=\"https:\/\/webstore.iec.ch\/publication\/79694\" target=\"_blank\" rel=\"noreferrer noopener\">ISO\/IEC 27001:2022 listing and abstract<\/a><\/li>\n\n\n<li>ISO, <a href=\"https:\/\/www.iso.org\/standard\/27001\" target=\"_blank\" rel=\"noreferrer noopener\">ISO\/IEC 27001:2022<\/a><\/li>\n\n\n<li>JASANZ, <a href=\"https:\/\/www.jasanz.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">home page<\/a> and <a href=\"https:\/\/register.jasanz.org\/certified-organisations\" target=\"_blank\" rel=\"noreferrer noopener\">register of accredited bodies and certified organisations<\/a><\/li>\n\n\n<li>JASANZ, <a href=\"https:\/\/www.jasanz.org\/blog\/fsqundaxqicpk73xzlzrhi8fu5peuj\" target=\"_blank\" rel=\"noreferrer noopener\">When &quot;trust us&quot; isn&#8217;t enough: building confidence in information security<\/a><\/li>\n\n\n<li>Department of Home Affairs, <a href=\"https:\/\/www.protectivesecurity.gov.au\/system\/files\/2026-07\/pspf-release-2026-list-requirements_0.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">PSPF Release 2026: list of requirements<\/a><\/li>\n\n<\/ul>\n\n\n\n<div class=\"wp-block-group has-light-green-cyan-background-color has-background\" style=\"padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px;margin-top:40px;margin-bottom:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<h2 class=\"wp-block-heading\">Want a second pair of eyes?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Catharsis Cyber Security is a Sydney cyber security company, certified to ISO\/IEC 27001:2022. We help organisations protect, test and run their technology, and explain it in plain English.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/contact-us\/?type=contact&amp;service=consult&amp;utm_source=blog&amp;utm_medium=article&amp;utm_campaign=value-guides&amp;utm_content=smb1001-vs-asd-essentials-vs-iso-27001-contact\" target=\"_blank\" rel=\"noreferrer noopener\">Talk to us<\/a><\/div>\n\n\n<div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/contact-us\/?type=contact&amp;service=security-health-check&amp;utm_source=blog&amp;utm_medium=article&amp;utm_campaign=value-guides&amp;utm_content=smb1001-vs-asd-essentials-vs-iso-27001-end-health-check\" target=\"_blank\" rel=\"noreferrer noopener\">Free security health check<\/a><\/div>\n\n<\/div>\n\n<\/div><\/div>\n\n\n\n<style>pre.wp-block-code{max-width:100%;overflow-x:auto}pre.wp-block-code code{white-space:pre}.wp-block-list a,.wp-block-table a{overflow-wrap:anywhere;word-break:break-word}<\/style>\n","protected":false},"excerpt":{"rendered":"<p>Three frameworks keep turning up in tenders, client questionnaires and insurance forms. They do different jobs: one is a tiered certification built for small businesses, one is ASD&#8217;s guidance on what to fix first, and one is an international management system standard. Here is how to tell which one you need first.<\/p>\n","protected":false},"author":4,"featured_media":1265,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[163,244,195,243,166,220,242,245],"class_list":["post-1266","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security-explained","tag-asd-essentials","tag-certification","tag-cyber-insurance","tag-cyber-security-frameworks","tag-government-suppliers","tag-iso-27001","tag-smb1001","tag-tenders"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need? - Catharsis | Blog<\/title>\n<meta name=\"description\" content=\"SMB1001, ASD Essentials or ISO 27001: which framework do you need? Who asks for each, what proof each needs, how they overlap and a which-first table.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need? - Catharsis | Blog\" \/>\n<meta property=\"og:description\" content=\"SMB1001, ASD Essentials or ISO 27001: which framework do you need? Who asks for each, what proof each needs, how they overlap and a which-first table.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/\" \/>\n<meta property=\"og:site_name\" content=\"Catharsis | Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-19T23:10:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-03T10:47:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/smb1001-vs-asd-essentials-vs-iso-27001.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Catharsis\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Catharsis\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/\"},\"author\":{\"name\":\"Catharsis\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/person\\\/ab309c676ceb9762b5c09091d50f4074\"},\"headline\":\"SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need?\",\"datePublished\":\"2026-10-19T23:10:00+00:00\",\"dateModified\":\"2026-11-03T10:47:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/\"},\"wordCount\":2524,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/smb1001-vs-asd-essentials-vs-iso-27001.jpg\",\"keywords\":[\"ASD Essentials\",\"certification\",\"cyber insurance\",\"cyber security frameworks\",\"government suppliers\",\"ISO 27001\",\"SMB1001\",\"tenders\"],\"articleSection\":[\"Cyber Security Explained\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/\",\"name\":\"SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need? - Catharsis | Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/smb1001-vs-asd-essentials-vs-iso-27001.jpg\",\"datePublished\":\"2026-10-19T23:10:00+00:00\",\"dateModified\":\"2026-11-03T10:47:15+00:00\",\"description\":\"SMB1001, ASD Essentials or ISO 27001: which framework do you need? Who asks for each, what proof each needs, how they overlap and a which-first table.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/#primaryimage\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/smb1001-vs-asd-essentials-vs-iso-27001.jpg\",\"contentUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/smb1001-vs-asd-essentials-vs-iso-27001.jpg\",\"width\":1280,\"height\":720,\"caption\":\"SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need?\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/smb1001-vs-asd-essentials-vs-iso-27001\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/\",\"name\":\"Catharsis | Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#organization\",\"name\":\"Catharsis | Blog\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/catharsis_au.jpg\",\"contentUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/catharsis_au.jpg\",\"width\":215,\"height\":60,\"caption\":\"Catharsis | Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/person\\\/ab309c676ceb9762b5c09091d50f4074\",\"name\":\"Catharsis\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g\",\"caption\":\"Catharsis\"},\"description\":\"Catharsis Cyber Security is a Sydney cyber security company, certified to ISO\\\/IEC 27001:2022. We help organisations protect, test and run their technology: managed security, penetration testing, security-first managed IT, secure AI and secure development.\",\"sameAs\":[\"https:\\\/\\\/catharsis.net.au\\\/\"],\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/author\\\/catharsis-team\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need? - Catharsis | Blog","description":"SMB1001, ASD Essentials or ISO 27001: which framework do you need? Who asks for each, what proof each needs, how they overlap and a which-first table.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/","og_locale":"en_US","og_type":"article","og_title":"SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need? - Catharsis | Blog","og_description":"SMB1001, ASD Essentials or ISO 27001: which framework do you need? Who asks for each, what proof each needs, how they overlap and a which-first table.","og_url":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/","og_site_name":"Catharsis | Blog","article_published_time":"2026-10-19T23:10:00+00:00","article_modified_time":"2026-11-03T10:47:15+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/smb1001-vs-asd-essentials-vs-iso-27001.jpg","type":"image\/jpeg"}],"author":"Catharsis","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Catharsis","Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/#article","isPartOf":{"@id":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/"},"author":{"name":"Catharsis","@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/person\/ab309c676ceb9762b5c09091d50f4074"},"headline":"SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need?","datePublished":"2026-10-19T23:10:00+00:00","dateModified":"2026-11-03T10:47:15+00:00","mainEntityOfPage":{"@id":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/"},"wordCount":2524,"commentCount":0,"publisher":{"@id":"https:\/\/catharsis.net.au\/blog\/#organization"},"image":{"@id":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/#primaryimage"},"thumbnailUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/smb1001-vs-asd-essentials-vs-iso-27001.jpg","keywords":["ASD Essentials","certification","cyber insurance","cyber security frameworks","government suppliers","ISO 27001","SMB1001","tenders"],"articleSection":["Cyber Security Explained"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/","url":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/","name":"SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need? - Catharsis | Blog","isPartOf":{"@id":"https:\/\/catharsis.net.au\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/#primaryimage"},"image":{"@id":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/#primaryimage"},"thumbnailUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/smb1001-vs-asd-essentials-vs-iso-27001.jpg","datePublished":"2026-10-19T23:10:00+00:00","dateModified":"2026-11-03T10:47:15+00:00","description":"SMB1001, ASD Essentials or ISO 27001: which framework do you need? Who asks for each, what proof each needs, how they overlap and a which-first table.","breadcrumb":{"@id":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/#primaryimage","url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/smb1001-vs-asd-essentials-vs-iso-27001.jpg","contentUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/smb1001-vs-asd-essentials-vs-iso-27001.jpg","width":1280,"height":720,"caption":"SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need?"},{"@type":"BreadcrumbList","@id":"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/catharsis.net.au\/blog\/"},{"@type":"ListItem","position":2,"name":"SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need?"}]},{"@type":"WebSite","@id":"https:\/\/catharsis.net.au\/blog\/#website","url":"https:\/\/catharsis.net.au\/blog\/","name":"Catharsis | Blog","description":"","publisher":{"@id":"https:\/\/catharsis.net.au\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/catharsis.net.au\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/catharsis.net.au\/blog\/#organization","name":"Catharsis | Blog","url":"https:\/\/catharsis.net.au\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2019\/01\/catharsis_au.jpg","contentUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2019\/01\/catharsis_au.jpg","width":215,"height":60,"caption":"Catharsis | Blog"},"image":{"@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/person\/ab309c676ceb9762b5c09091d50f4074","name":"Catharsis","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g","caption":"Catharsis"},"description":"Catharsis Cyber Security is a Sydney cyber security company, certified to ISO\/IEC 27001:2022. We help organisations protect, test and run their technology: managed security, penetration testing, security-first managed IT, secure AI and secure development.","sameAs":["https:\/\/catharsis.net.au\/"],"url":"https:\/\/catharsis.net.au\/blog\/author\/catharsis-team\/"}]}},"_links":{"self":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts\/1266","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/comments?post=1266"}],"version-history":[{"count":1,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts\/1266\/revisions"}],"predecessor-version":[{"id":1293,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts\/1266\/revisions\/1293"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/media\/1265"}],"wp:attachment":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/media?parent=1266"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/categories?post=1266"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/tags?post=1266"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}