SMB1001 vs Essential Eight vs ASD Essentials: which should a Melbourne small business follow?
SMB1001 vs Essential Eight vs the new ASD Essentials: who publishes each, which you can certify, who is asking (insurers, ARNECC, QLS) and where to start.
SMB1001 vs Essential Eight comes down to certificate versus controls. SMB1001 is a five-level cyber security standard for small and medium businesses that you can be certified against; the Essential Eight is a baseline from the Australian Signals Directorate, measured in maturity levels rather than certified. For most Melbourne small businesses it isn't either/or: build the shared controls once, keep the evidence, and certify only when someone asks.
A draft conveyancing rule and a law society recommendation have already put SMB1001 in front of some firms. Then, on 15 October 2026, came ASD Essentials, which will replace the Essential Eight over the next year or two. Here's how the three compare, who is asking for SMB1001, and where a ten or fifty-person business should start.
What is SMB1001?
SMB1001 is a certifiable cyber security standard for small and medium-sized businesses, written by Dynamic Standards International (DSI), a not-for-profit standards body registered as a charity with the ACNC. The current edition, SMB1001:2026 (International Edition), was released on 1 September 2025, and DSI says a steering committee of experts updates the standard every year.
Its controls sit under five core areas: technology management; access management; backup and recovery; policies, plans and procedures; and education and training. DSI says SMB1001 aligns with Australia's Essential 8, so much of the work done for one framework carries across to the other.
DSI writes the standard; CyberCert, which DSI names as the official Dynamic Standard Certifier for SMB1001, issues the certificates, with BSI Group and InfoSecAssure listed as independent verification organisations. Our cyber security glossary has a one-line definition.
How do the SMB1001 levels work?
There are five levels, each building on the one below, and you don't need to climb all of them. CyberCert badges them Bronze to Diamond. The real dividing line sits between Gold and Platinum: at the first three levels a director signs off that the controls are in place, and the top two add an external audit.
| Level | Badge | Who CyberCert pitches it at | How it's verified |
|---|---|---|---|
| 1 | Bronze | Businesses just starting out that need the basics in place | Director attestation |
| 2 | Silver | Businesses that rely on email and business apps | Director attestation |
| 3 | Gold | Businesses wanting professional, best-practice security | Director attestation |
| 4 | Platinum | Businesses with mature security built on best-practice cyber risk management | Director attestation plus external audit |
| 5 | Diamond | The highest maturity across all five core areas | Director attestation plus external audit |
The table summarises CyberCert's certification page as at 15 October 2026. Under CyberCert's terms (last updated 1 July 2026), a certificate is valid for 12 months from issue, and the version of the standard that applies is the one current when your director signs, or when the audit is completed if that's later.
SMB1001 vs Essential Eight vs ASD Essentials: how do they compare?
In one line: the Essential Eight and ASD Essentials describe what good security looks like, while SMB1001 gives you a certificate you can show someone else.
| Compared on | SMB1001 | Essential Eight | ASD Essentials |
|---|---|---|---|
| Published by | Dynamic Standards International (not-for-profit) | Australian Signals Directorate | Australian Signals Directorate |
| Written for | Small and medium businesses | Australian organisations generally | Organisations generally; the first version covers enterprise IT, cloud and operational technology |
| How results are expressed | Five levels, Bronze to Diamond | Maturity Level Zero to Three | No single rating; evidence-backed effectiveness ratings per security area, plus priority phases that describe scope, not how secure you are |
| Can you get a certificate? | Yes, through CyberCert, valid 12 months and listed on a public register | No ASD-issued certificate; you're assessed against the maturity model | No certification scheme reported at its 15 October 2026 release |
| Who checks your work | Your director and a technical support specialist; an external auditor at Platinum and Diamond | You, your IT provider or an independent assessor | Organisations report area by area, backed by evidence |
| Who points you to it | The Queensland Law Society (Gold for law firms), ARNECC's draft conveyancing rules, and CyberCert pitches Silver at insurers | Insurer questionnaires, tenders, government supply chains, ARNECC's draft rules | Government agencies, from next year |
| Status | SMB1001:2026 is current; revised yearly | Current; stays on ASD's website during the transition | Released 15 October 2026 with a transition guide; no mandatory date set |
Sources: iTnews for ASD Essentials; DSI and CyberCert for SMB1001.
Which framework should a Melbourne small business follow?
Follow the controls, not the badge. Whichever framework you end up quoting, the heavy lifting is the same: MFA on email and every remote login, patching on a schedule, fewer people with admin rights, backups you've actually test-restored, and staff who can spot a phishing email. ASD Essentials points the same way, telling organisations to start with identity services and the edge devices that connect their networks to the internet. In a small office, that usually means the firewall and the VPN.
So do the work once, and keep one dated evidence pack that answers all three: MFA coverage, patch reports, an admin account list, restore-test records and training completions. Then let whoever is asking decide which label goes on the front:
Nobody wants a certificate yet.
Work to the Essential Eight and watch the ASD Essentials transition.
A client, panel or professional body names SMB1001.
Certify at the level they name, and go higher only if it helps you win work.
Your insurer or broker is asking.
Answer their questionnaire with evidence, then ask the broker whether a certificate changes anything for your policy.
You supply government.
Keep your Essential Eight evidence current. Agencies will be assessed against both frameworks next year, and an agency's security questions can flow down to its suppliers.
That's the approach behind Key IT's Essential 8 compliance service: security-certified engineers put the controls in, then document each one with proof rather than a tick in a box.
Who is asking for SMB1001?
Conveyancers and lawyers using PEXA or Sympli
In its stakeholder briefing on Model Participation Rules version 8 (19 June 2026), ARNECC proposes a cyber "safe harbour": compliance may be deemed where a subscriber certifies against one of the specified frameworks. The list includes the Essential Eight and SMB1001, which the briefing describes as endorsed by QLS and LPLC, the Legal Practitioners' Liability Committee that provides professional indemnity insurance to Victorian solicitors and barristers. The same draft would require MFA on all remote access, all subscriber administrator accounts and email.
It is still a draft. ARNECC's Model Participation Rules page lists version 8 only as consultation drafts dated 25 May 2026, with consultation closed. Our IT for conveyancers page turns the draft into a practice checklist.
Law firms
The Queensland Law Society recommends its members work towards Gold certification. It is also candid that implementing SMB1001 doesn't create a "safe harbour" or guarantee protection; what it gives a firm is an evidence-based way to show it is taking reasonable steps.
Insurers and brokers
CyberCert says Silver certification demonstrates the security baseline most insurers require. Treat that as the certifier's claim: your own insurer's questionnaire decides your cover. Our guides to the controls insurers ask about in 2026 and to answering security questionnaires walk through what they actually check.
How do you get SMB1001 certified?
Through CyberCert, in six steps:
Pick the level.
Whoever is asking usually names it. If not, CyberCert's selector uses DSI's Certification Categorization Matrix to suggest one.
Close the gaps.
Put in every control for that level, recording the evidence as you go.
Nominate a technical support specialist.
CyberCert's terms require one at every level. It can be someone inside your business or an approved outside provider, but they must hold their own certification at least equal to the level they're supporting.
Get the dual sign-off.
The specialist confirms the technical controls are in place first; only then can a director or authorised officer attest that every applicable control has been implemented.
Pass the audit, if your level needs one.
Platinum and Diamond add an independent external audit, and CyberCert charges an audit fee on top of the certification fee for those levels.
Display it and renew it.
Certificates appear on CyberCert's public verification register and run for 12 months.
Ask about step three early: check whether your IT provider is an approved technical support specialist, and at which level. One who isn't can still do the controls and evidence work, but someone who qualifies has to sign off.
Frequently asked questions
Is SMB1001 better than the Essential Eight?
Neither is better; they do different jobs. The Essential Eight is ASD's baseline of technical controls, measured by maturity level. SMB1001 is a certifiable standard built for small and medium businesses, with a badge you can show clients and insurers. DSI says the two align, so most businesses should build the shared controls once and certify only when someone asks.
Does SMB1001 Gold need an external audit?
No. According to CyberCert, Bronze, Silver and Gold are director attested: a director or authorised officer signs that the controls are in place, after your technical support specialist has confirmed the technical ones. The external audit starts at Platinum. CyberCert's terms let it revoke a certificate where the requirements aren't met, so treat the director's signature as a real commitment.
Which SMB1001 level does a small business need?
The one your client, insurer or professional body names. The Queensland Law Society recommends Gold for law firms, and CyberCert positions Silver as the level most insurers look for. With nobody asking, Bronze or Silver makes a sensible first certificate. In Key IT's view, Gold suits firms that handle client money or sensitive records.
Does ASD Essentials replace SMB1001?
No. ASD Essentials is ASD's successor to the Essential Eight, released on 15 October 2026, while SMB1001 is a separate standard from Dynamic Standards International. ASD is keeping the Essential Eight on its website through the transition, and when Essentials becomes mandatory is still unsettled.
Do Victorian conveyancers have to get SMB1001 certified?
Not as at 15 October 2026. ARNECC's version 8 Model Participation Rules are still consultation drafts. If adopted as proposed, a subscriber certified against one of the specified frameworks, such as the Essential Eight or SMB1001, could be deemed compliant with the cyber requirement. The draft's MFA rules are worth adopting now regardless.
How long does SMB1001 certification last?
Twelve months from the date of issue under CyberCert's terms. DSI revises the standard yearly, and CyberCert applies the version that's current when your director signs, or when the audit finishes if that's later. Plan for a small annual refresh of controls and evidence rather than treating certification as a one-off project.
Can Key IT certify my business for SMB1001?
No IT provider issues the certificate; CyberCert, DSI's official certifier, does. Key IT's security-certified engineers can put the controls in place and build the evidence pack; on managed plans, Key IT's 24/7 SOC service then watches for intrusions. If you're aiming for a certificate, ask any provider, including us, about their technical support specialist status first.
More insights
ASD Essentials replaces the Essential Eight
ASD Essentials, released 15 Oct 2026, will replace the Essential Eight. What changes for Melbourne…
Read article →Essential 8Essential Eight in 2026: who's judging you
Essential Eight in 2026: the controls haven't changed since 2023, but insurers and big clients now…
Read article →ScamsSPF, DKIM and DMARC explained
SPF, DKIM and DMARC explained in plain English: stop scammers sending email as your business, keep…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.