Essential Eight
vs SMB1001
The Essential Eight is ASD’s framework of eight technical strategies, designed mainly to protect internet-connected IT networks, with several written around Microsoft software. SMB1001 is a cyber security standard built for small and medium businesses, whatever devices and systems they use, and certified in tiers. ASD’s newer framework, the ASD Essentials, is superseding the Essential Eight, and both apply during the transition.
- SMB1001 Gold achieved
- CyberCert Partner
- Microsoft 365 and Google Workspace
SMB1001 Gold achieved through CyberCert. We run these controls in our own business.
Essential Eight mitigation strategies
ASD Essentials chapters so far
SMB1001 tiers we help clients certify at
Achieved through CyberCert
The difference in plain terms
The Essential Eight
Eight mitigation strategies published by the Australian Signals Directorate (ASD): patching applications and operating systems, multi-factor authentication, restricting administrative privileges, application control, restricting Microsoft Office macros, user application hardening and regular backups. Each strategy is rated from Maturity Level 0 to 3. There is no certificate: you reach a maturity level and document it.
The ASD Essentials
ASD’s newer framework, launched on 15 October 2026, which is superseding the Essential Eight. It describes security outcomes as principles, actions and domains, with chapters for enterprise IT, cloud and operational technology, and rates each action by how effective it is rather than by maturity level. There is no certificate for it either.
SMB1001
A cyber security standard written for small and medium businesses, published by Dynamic Standards International and certified through CyberCert. Its controls describe what a business needs in place rather than settings for a particular product, so you can meet them on Microsoft 365 or Google Workspace, Windows or Mac. You certify at a tier, starting at Bronze, and each tier includes everything in the ones before it. Certification lasts a year, and anyone can check it on CyberCert’s public register.
- Essential Eight: a framework, measured in maturity levels
- ASD Essentials: the framework superseding it, with effectiveness ratings
- SMB1001: a standard, certified in tiers
- Essential Eight: several strategies written around Microsoft software
- SMB1001: built for small and medium businesses, on the platforms they use
Essential Eight and SMB1001 compared
Australian Signals Directorate (ASD)
A framework of eight technical mitigation strategies
Organisations of every size, including government
Mainly internet-connected IT networks, with several strategies written around Microsoft software
Maturity Levels 0 to 3 for each strategy
No. You reach and document a maturity level
Your assessment report and evidence
Technical controls on devices, apps, accounts and backups
Australian Government (non-corporate Commonwealth) entities, at Maturity Level 2, while that obligation stands
Essential Eight maturity model: November 2023 edition, being superseded by the ASD Essentials (both apply during the transition). SMB1001: 2026 edition. Both checked October 2026.
Three names, three different jobs
ASD’s newer framework now sits alongside the other two. Here is each one on its own terms.
Essential Eight
Eight technical strategies, measured strategy by strategy.
- Maturity Levels 0 to 3
- No certificate
- Being superseded by the ASD Essentials
- Still applies where an obligation names it
ASD Essentials
Security outcomes set out as principles, actions and domains.
- Chapters for enterprise IT, cloud and OT
- Effectiveness ratings for each action
- No certificate
- Written mainly for larger organisations
SMB1001
Requirements for small and medium businesses, certified in tiers.
- Published by Dynamic Standards International
- Certified through CyberCert
- Renewed every year
- Listed on a public register
ASD’s Essentials publications don’t mention SMB1001. If you run only on Microsoft 365 or Google Workspace, the Essentials chapter that fits is ASD Essentials for cloud; with servers or a hybrid set-up, it’s ASD Essentials for enterprise IT. See our ASD Essentials guide.
Why the difference matters
A framework is guidance. It sets out what good security looks like, leaves you to decide how far to go and measures your progress. The Essential Eight is a framework: ASD publishes it as eight mitigation strategies with maturity levels, alongside its other frameworks such as the Information Security Manual. The ASD Essentials, which is superseding it, is a framework too. There is no certificate, so you show where you stand with your assessment and evidence.
A standard sets defined requirements that you either meet or don’t. A standards body publishes it, and an accredited certifier certifies you against it. SMB1001 is a standard: Dynamic Standards International publishes it, certifiers such as CyberCert are accredited to certify against it, and certified businesses appear on a public register.
For a small or medium business, the standard usually does more. It covers the whole business, not just its computers, and gives you a certificate that a client, insurer or tender panel can check for themselves. The framework remains a strong way to measure technical hardening, especially if you work with government.
- Framework: guidance that sets out what good looks like and measures progress
- Standard: set requirements, certified by an accredited certifier
- Essential Eight: a framework, with no certificate
- SMB1001: a standard, with a certificate and public register
Where they overlap, and where they differ
SMB1001 builds the core Essential Eight controls in from the first tier. Automatic patching and backups start at Bronze. Multi-factor authentication on email and removing admin rights from everyday accounts come in at Silver, and Gold extends multi-factor authentication to every business application.
It then covers the rest of the business, which the Essential Eight doesn’t ask about. By Gold that includes a firewall, endpoint detection and response, a password manager, email authentication, business or cyber insurance, a written cyber security policy, an incident response plan, an invoice fraud policy, a digital asset register, a policy on the responsible and secure use of AI, and staff security awareness training.
Where the Essential Eight goes further is locking down computers running Microsoft software. One strategy is entirely about Microsoft Office macros, others name tools such as PowerShell, and ASD says the Essential Eight was designed to protect internet-connected IT networks, not mobile devices. SMB1001 brings in application control and restricting untrusted Office macros only at Diamond, its top tier for critical suppliers with physical or administrator access to a customer’s systems. That keeps Bronze to Gold focused on outcomes a business can meet whether it runs Google Workspace and Macs or Microsoft 365 and Windows.
- Both: patching, backups, multi-factor authentication, admin rights
- SMB1001 adds: EDR, firewall, policies, training, insurance, incident response
- Essential Eight goes further on: application control, Office macros, application hardening
- SMB1001 fits Microsoft 365 or Google Workspace, Windows or Mac
Which one should you aim for?
For most small and medium businesses, SMB1001 is the natural place to start. The Essential Eight earns its place in a few specific situations.
You want one standard for the whole business
SMB1001. It covers your technology, people and processes, and gives you a certificate to show for it.
A tender or client wants a certificate
SMB1001. It gives you a certificate and a public register entry that a buyer can check in seconds.
You run Google Workspace or Macs
SMB1001. Its controls describe outcomes rather than product settings, while several Essential Eight strategies are written around Windows and Microsoft Office.
Your insurer sent a questionnaire
SMB1001 covers the controls insurers ask about most, such as multi-factor authentication, patching, admin rights and backups, and gives you documented evidence. Neither SMB1001 nor the Essential Eight guarantees cover or a premium.
You work with government agencies
Add the Essential Eight while it applies. Maturity Level 2 has been the baseline for Commonwealth entities, and obligations that use Essential Eight terms continue during the transition, so government buyers may still ask suppliers about it.
You want to follow ASD's newer framework
Look at the ASD Essentials. ASD wrote it mainly for larger organisations, but says smaller businesses can use it where relevant. If you run only on Microsoft 365 or Google Workspace, start with the cloud chapter.
You are a critical supplier to a larger organisation
If you have physical or administrator access to a customer’s systems, you may be asked for a higher SMB1001 tier, an Essential Eight maturity level or another standard. We’ll help you work out what your contract actually asks for.
Which SMB1001 tier are you closest to?
Answer a few quick questions in our free readiness check, or book a free security assessment that checks your actual settings.
Both are evolving
The Essential Eight is being superseded by the ASD Essentials
ASD launched the ASD Essentials on 15 October 2026 as an evolution of the Essential Eight. Both apply during the transition: ASD keeps both on cyber.gov.au and hasn’t set an end date for the Essential Eight. Maturity levels don’t convert into Essentials ratings, but ASD says existing controls and tooling carry over, along with evidence that is still current and relevant. Our ASD Essentials guide explains the chapters and the mapping.
SMB1001 is reviewed every year
The current edition is SMB1001:2026. Because certificates are renewed every year, each renewal is made against the edition in force at the time.
Neither change is a reason to wait. The controls in both carry forward, and we keep clients up to date as each new version takes effect.
We do both, and we hold the certificate
We achieved SMB1001 Gold through CyberCert, and as a CyberCert Partner we help clients get certified at Bronze, Silver or Gold. We start the certification process on your behalf and help you complete each control. SMB1001 also asks businesses to engage a technical support specialist (TSS), and as your managed service provider, that’s our role: we confirm the technical controls we look after are in place.
We also run Essential Eight maturity assessments for clients who still have to report against it, and document the evidence. Most of the technical work is shared, so progress on one counts towards the other.
- SMB1001 readiness and Essential Eight assessments
- Technical controls set up and monitored
- Policies, incident response plan and staff training
- Evidence prepared for your certification and renewals
Certified, not just advising
SEQ IT achieved SMB1001 Gold through CyberCert and is a CyberCert Partner. The controls we recommend are the ones we run in our own business.
SMB1001 Gold
Partner
Partner and Cloud Solution Provider (CSP)
Google Cloud Partner
Essential Eight vs SMB1001: common questions
Is SMB1001 the same as the Essential Eight?
No. The Essential Eight is a framework: eight technical strategies from ASD, measured in maturity levels, with no certificate. SMB1001 is a certifiable standard for small and medium businesses. It includes the core Essential Eight controls and adds business controls such as policies, staff training, incident response and insurance.
Which is better for a small business?
For most small and medium businesses, SMB1001. It was written for them, it covers the whole business rather than just its computers, its controls can be met on Microsoft 365 or Google Workspace, Windows or Mac, and it gives you a certificate others can check. The Essential Eight is worth adding when a government client or contract still asks about maturity levels during the transition.
What is the difference between a framework and a standard?
A framework is guidance: it sets out what good looks like and measures how far you have gone. The Essential Eight is a framework, measured in maturity levels, with no certificate. A standard sets requirements you either meet or don’t, and an accredited certifier certifies you against it. SMB1001 is a standard, so certified businesses get a certificate and a public register entry that others can check.
Does the Essential Eight work with Google Workspace or Macs?
Partly. ASD designed it to protect internet-connected IT networks, and says its principles may be applied to mobile devices although it was not designed for them. Several strategies include requirements written for Microsoft software such as Office and PowerShell. SMB1001’s controls describe outcomes rather than product settings, which makes it a more natural fit for Google Workspace and Mac businesses.
Does SMB1001 Gold mean we meet Essential Eight Maturity Level 1?
They measure different things. Gold covers the Essential Eight controls insurers and clients ask about most: patching, backups, multi-factor authentication and admin rights. Application control, restricting Office macros and user application hardening sit outside Gold, so if a government client still asks for Maturity Level 1 during the transition, we add those on top of your Gold controls.
Is the Essential Eight mandatory for small businesses?
No. For private businesses it is voluntary, although clients and government buyers often ask about it, and in our experience most insurer questionnaires still use Essential Eight style questions. The Protective Security Policy Framework requires non-corporate Commonwealth entities to reach Maturity Level 2, and that stands until regulators announce changes.
Is there an Essential Eight certificate?
No. There is no Essential Eight certificate, and ASD describes no certificate for the ASD Essentials either. An Essential Eight assessment confirms which maturity level you have reached for each strategy. If you need a certificate to show others, SMB1001 is the usual choice for small and medium businesses.
How long does SMB1001 certification last?
One year. Certificates are renewed annually, and each renewal is made against the edition of the standard in force at the time. Your certification appears on CyberCert’s free public register, so clients and insurers can check it.
Is the Essential Eight being replaced?
Yes. It is being superseded by the ASD Essentials, which ASD launched on 15 October 2026, and both apply during the transition. ASD hasn’t set an end date for the Essential Eight, so keep meeting any obligation that names it and keep improving your controls in the meantime.
How does the ASD Essentials compare with SMB1001?
They do different jobs. The ASD Essentials is ASD’s framework for planning and measuring security, rating how effective each action is, with no certificate. SMB1001 is a standard you certify against through CyberCert. ASD’s Essentials publications don’t mention SMB1001, and controls such as MFA, patching and backups appear in both.
Which is better for cyber insurance?
Both help, and SMB1001 gives you more to show. In our experience, most cyber insurance questionnaires still ask Essential Eight style questions about multi-factor authentication, patching, admin rights and backups, which SMB1001 covers by Gold, and a certificate gives you documented evidence to point to. Neither guarantees cover or a lower premium. See cyber insurance readiness.
Do we need both?
Not usually. SMB1001 suits most small and medium businesses on its own. If a government client asks about maturity levels, we add the Essential Eight, and because most of the technical work is shared, you are not starting from scratch.
Related services
SMB1001 certification
Get certified at Bronze, Silver or Gold with a CyberCert Partner.
SMB1001 readiness check
A free check of which tier you are closest to.
Essential Eight and ASD Essentials
The transition, which chapter fits, and Essential Eight assessments.
ASD Essentials guide
Chapters, priority phases, ratings and the Essential Eight mapping.
Google Workspace vs Microsoft 365
How the two platforms compare for security and cost.
Cyber insurance readiness
Answer your insurer’s questions with evidence.
Not sure where to start?
Tell us what is driving the question: a tender, a client questionnaire, your insurer or simply wanting to be safer. We’ll show you where you stand and the right standard for your business.
- SMB1001 Gold achieved
- CyberCert Partner
- Australian-based team
Prefer to talk? Call 1300 619 750, Monday to Friday.
Tell us what you need and we’ll get back to you.