Is SMB1001 the same as ISO 27001?

No. ISO 27001 certifies an information security management system (ISMS): you assess your own risks and choose the controls that address them. SMB1001 is a prescriptive control set: the standard tells you which controls apply at each of its five tiers, Bronze, Silver, Gold, Platinum and Diamond. They overlap on access control, MFA, incident response, backup, supplier security and policies, but they certify different things.

Can SMB1001 replace ISO 27001?

Often, yes. Three times now a customer has asked one of our clients for ISO 27001, and all three accepted SMB1001 Platinum or above once someone asked what they actually needed. Most buyers want independent certification of a credible framework. ISO 27001 is still required when a contract names it in writing, or the buyer confirms nothing else will do.

Do I need SMB1001 if I am getting ISO 27001?

You need what SMB1001 Gold gives you: a defined set of technical controls. ISO 27001 lists controls in Annex A, but your own risk assessment decides which apply, and the standard does not tell you how to implement them. SMB1001 Gold prescribes a technical floor, including endpoint protection, MFA on every business app, enforced DMARC, a tested incident response plan and an asset register.

Which SMB1001 tier should I certify alongside ISO 27001?

Certify at SMB1001 Gold, and take controls from the higher tiers where your risks call for them. Application control, stronger MFA and external vulnerability scanning are common examples. A Platinum or Diamond certificate adds an independent audit on top of the one your ISO 27001 certification body already does every year, so one expensive certification is enough.

Does SMB1001 map to ISO 27001?

Yes. SMB1001 publishes control mappings to ISO 27001, as well as to the Essential Eight, UK Cyber Essentials and the US CMMC. A mapping shows where the controls overlap and helps you reuse evidence. It does not make an SMB1001 certificate equivalent to an ISO 27001 certificate.

Which is better for a small business, SMB1001 or ISO 27001?

For most Australian small businesses, SMB1001. It is faster, cheaper, and tells you exactly what to implement, and Platinum or Diamond give you independent audit. ISO 27001 is the better choice when a customer or contract names it specifically, or when you need a management system for a larger or more complex organisation.

Can a small business get ISO 27001 certified?

Yes. ISO 27001 has no minimum size. The commitment is running the management system: a risk assessment, a Statement of Applicability, policies, internal audits and management reviews, then a certification audit and annual surveillance audits. Make sure someone in the business can own that governance work before you start.

How much does SMB1001 cost compared to ISO 27001?

For both, the certificate is the smallest cost. CyberCert charges A$95 a year to certify SMB1001 at Bronze, A$195 at Silver and A$395 at Gold. Platinum is A$595 plus a A$3,000 audit, and Diamond A$995 plus a A$5,000 audit, all including GST. Those fees cover certification only, not the security tools the controls require or the cost of managing them, which is where most of the money goes. ISO 27001 usually costs considerably more again, because you pay for the time to build and run a management system, plus a certification body for an initial audit and annual surveillance audits across a three-year cycle. And ISO still leaves the tools to you.

How long does SMB1001 take compared to ISO 27001?

ISO 27001 often takes 6 to 12 months to a first certificate, because you are building a management system: scope, risk assessment, Statement of Applicability, internal audit and management review. SMB1001 takes weeks to months, depending on how many of the controls you already have in place.

Which do cyber insurers prefer, SMB1001 or ISO 27001?

Insurers mostly want evidence that specific controls exist and are maintained: MFA, endpoint protection, backups and email security. SMB1001 lines up directly with that, and SMB1001 Gold makes cyber insurance itself a requirement. ISO 27001 shows your security is governed, but which controls are in place depends on your own risk assessment, so an insurer may still ask for specifics.

What about the Essential Eight?

The Essential Eight is a good set of hardening strategies, but there is no certification, so there is no independent way to prove you meet it. ASD also announced in June 2026 that it will retire the Essential Eight over roughly two years in favour of its new Essentials series. It still applies in the meantime.

Does DJC hold ISO 27001 and SMB1001?

Yes. DJC Systems holds ISO 27001 and ISO 9001, and is certified to SMB1001 Diamond, the top tier of the standard. We have been through both kinds of audit ourselves, which is why our advice on which one you need is based on what each audit actually asks of you.

SMB1001 vs ISO 27001: Do Both, Certify at Gold

I had a conversation with a long-standing client last week that I suspect plenty of businesses are about to have.

A customer of theirs has started asking about ISO 27001. They had done their homework, and they had already spotted the thing most people miss: ISO 27001 does not give you any cyber security tools. It certifies how you manage security. It says nothing about what is actually running on your laptops, your email or your Microsoft 365 tenant. You can hold the certificate and still have nothing new on any device.

So the question they brought to us was a good one. If we do ISO, what do we do about the tools?

Our answer was to certify at SMB1001 Gold, and take what they need from the higher tiers without certifying to them. ISO is the expensive certification, and they are going through it anyway. We could not see the point of paying for a second one.

Search “SMB1001 vs ISO 27001” and you will find plenty of posts telling you to climb SMB1001 first and graduate to ISO later. That is half right. Here is the other half.

The short answer

SMB1001 and ISO 27001 certify different things. ISO 27001 certifies how you manage security. SMB1001 certifies which security controls you have in place.
Check whether you need ISO 27001 at all. Many customers who ask for it will accept SMB1001 Platinum or above.
If ISO 27001 is required, certify at SMB1001 Gold alongside it. Gold gives you the technical floor ISO does not prescribe. Take higher-tier controls where your risks call for them, but skip the second certification.
SMB1001 raises the bar every year. Renewing Gold keeps your controls current with the standard.

First, check whether you need ISO 27001 at all

Before anyone budgets for ISO 27001, ask the customer one question: do you need ISO 27001 specifically, or do you need independent certification?

Three times now a customer has asked one of our clients for ISO 27001. All three times, when the question was asked, SMB1001 Platinum or above was accepted. What they really wanted was a credible framework with someone independent checking it. ISO was simply the name they knew.

ISO 27001 is still the right answer when:

a contract names it explicitly, or
the buyer confirms in writing that nothing else will do.

If neither is true, SMB1001 Platinum may get you there in weeks rather than a year. If one of them is true, read on.

SMB1001 vs ISO 27001: the key differences

The two standards answer different questions, which is why comparing them line by line misleads people.

	ISO/IEC 27001	SMB1001
What it is	An information security management system (ISMS)	A prescriptive control set across five tiers
How controls are chosen	You assess your risks, then choose and justify controls	The standard tells you which controls apply at each tier
Published by	ISO and IEC	Dynamic Standards International (DSI)
Certified by	JAS-ANZ accredited certification bodies	CyberCert, using independent third-party assessors
Independent audit	Every year: certification, then surveillance audits	Platinum and Diamond. Bronze, Silver and Gold are attested by a director
Certificate life	Three years, with annual surveillance audits	One year, then recertify
Scope	You define it	The whole organisation, no carve-outs
How often the standard changes	Rarely: the current edition is from 2022, the one before from 2013	Every year, with each tier raised
Typical time to first certificate	Often 6 to 12 months	Weeks to months

ISO 27001 is strongest on governance and risk. SMB1001 is strongest on specific technical controls.

Both improve over time, but in different places. ISO 27001’s continual improvement happens inside your own management system: you review your risks, your controls and your results, and get better against your own yardstick. The standard itself changes rarely. SMB1001 improves from the outside. Dynamic Standards International revises it every year, and each revision raises the bar at the same tier. Gold went from 23 controls to 27 in the 2026 edition, and to 28 in 2027. In 2027, application control moved down from Diamond to Platinum, and AI governance arrived across the upper tiers: an AI governance framework at Platinum and control of unauthorised AI use at Diamond, on top of the AI use policy Gold has required since 2026. A Gold certificate next year will mean more than one this year. The overlap is bigger than most people expect: access control and MFA, incident response, backup, supplier security, staff awareness, asset registers and written policies all appear in both.

Does ISO 27001 give you security tools?

ISO 27001:2022 has 93 controls in its Annex A. That sounds like a technical checklist. It is not. Your own risk assessment decides which of them apply, you justify your choices in a Statement of Applicability, and the standard does not tell you how to implement any of them.

That is the point of a management system, and it is a strength. It also means two certified businesses can run very different technology underneath the same certificate. The ISO auditor checks that your system works: that you identified the risks, chose controls, run them and review them. The auditor does not hand you an EDR agent.

Something has to provide the technical floor. That is where SMB1001 comes in.

Certify at SMB1001 Gold, borrow from above

SMB1001 Gold prescribes a solid technical floor. Under the current edition it includes, among others:

endpoint protection on every device
MFA on every business application and social media account
SPF, DKIM and an enforced DMARC policy on your email
an incident response plan, which from SMB1001:2027 has to be tested every year
an asset register
remote desktop only over a VPN
a signed cyber security policy and an AI use policy
cyber insurance

That is most of the tooling an ISO 27001 risk assessment would ask for in a typical SMB, already decided, already defined, and certified across the whole organisation rather than just the scope you chose for ISO.

Gold is the floor, not the ceiling. The controls in Platinum and Diamond are still worth having where your risks call for them, and your ISO risk assessment will usually find a few. Application control is the obvious one: it moved down to Platinum in SMB1001:2027, and for plenty of businesses it is justified well before that. Stronger MFA, external vulnerability scanning and tested backups are others. We would expect to cherry-pick some of these for almost any business on the ISO path. We wrote about what changed at Gold and Platinum in SMB1001:2027 earlier this month.

What does not make sense is certifying to those higher tiers as well. Platinum and Diamond certification adds an independent audit, and that is its main value: someone outside the business checking that the controls are real and maintained. If you hold ISO 27001, a certification body is already doing that every year as part of your surveillance audits. Paying for a Platinum or Diamond certificate on top means paying for two independent audits of much the same thing.

So the controls can come from any tier. The certificate only needs to come from Gold.

There is a bonus in renewing Gold every year alongside ISO. Because SMB1001 tightens each edition, your technical floor rises with the standard, rather than only when your own risk review catches up. ISO keeps your management system honest. SMB1001 keeps your floor current.

Who does what on the ISO 27001 path

It works best with three roles, kept separate:

Your ISO partner builds the management system: scope, risk assessment, Statement of Applicability, policies, internal audit and certification readiness. That is governance work, and you should pick whoever you trust for it.
Your technology partner runs the security controls, including SMB1001 Gold, and produces the evidence the management system needs. For our clients, that is our managed cyber security service.
The certification body is independent. It audits the management system and issues the ISO certificate.

The mistake to avoid is assuming the ISO partner covers the second role. Most governance consultancies do not run security tools, and should not.

SMB1001, ISO 27001 and the Essential Eight

The Essential Eight is a sensible set of hardening strategies. Nothing wrong with the controls. The problem is that there is no certification, so there is no independent way to prove you meet them, which is exactly what customers and insurers keep asking for.

It is also on the way out. In June 2026 the Australian Signals Directorate announced it will retire the Essential Eight over roughly two years, in favour of its new Essentials series. It still applies in the meantime, and some contracts still name it, but it is not a foundation we would build a new certification plan on.

Which should you choose? Three realistic paths

Pick the path for whoever you need to convince:

SMB1001 Platinum. Independently audited, prescriptive controls, renewed every year. Suits most businesses proving maturity to customers, supply chains and insurers.
SMB1001 Diamond. Everything in Platinum, plus testing, encryption, personnel vetting and supplier assurance. Suits businesses with higher-risk data or privileged access to their customers’ systems.
ISO 27001 plus SMB1001 Gold. A certified management system on top of a prescribed technical floor, with higher-tier controls added where your risks justify them. Suits businesses whose buyer names ISO 27001 specifically.

What we would not recommend is ISO 27001 plus a Platinum or Diamond certificate. That is two audits for one outcome.

We have walked both paths

DJC holds ISO 27001 and ISO 9001, and we are certified to SMB1001 Diamond. So when we say one audit is enough, it is because we know what each one actually asks of you.

SMB1001 is published by Dynamic Standards International, its custodian, and certified independently by CyberCert. References here are to SMB1001:2026 and SMB1001:2027. Nothing here is an endorsement by DSI.

Book Your Free SMB1001 Readiness Check: 20 minutes with Julian or me. If ISO 27001 is on your horizon, we will help you work out whether you really need it, and if you do, what your technical floor should look like underneath it.

SMB1001 vs ISO 27001: if ISO is the goal, certify at Gold