ISO 27001 or SMB1001 for an SMB: which buyer is asking?
ISO 27001 is the audited international standard big procurement asks for; SMB1001 is the Australian tiered standard sized for SMBs to certify now.
Two standards, two different questions. ISO 27001 answers: can you prove to anyone, anywhere, that a managed security system operates here. SMB1001 answers: can you prove to an Australian buyer that the fundamentals are in place.
Which answer you need
Most businesses only need one of those answers at a time, and the contract in front of you usually decides which.
Black Shard prepares clients for both standards and certifies against neither.
Side by side.
| Criteria | SMB1001 | ISO 27001 |
|---|---|---|
| Who asks for it | SMB1001Australian buyers, insurers and supply chains that want proof of baseline cyber hygiene from an SMB. It gives a small business a registry-verifiable answer where before there was nothing to point at. | ISO 27001Enterprise and government procurement, multinationals and international buyers. When a tender or contract clause names a certification, it almost always names ISO 27001. If your buyers are offshore, this is the standard they recognise. |
| Assessment model | SMB1001At Gold, a company director signs off against the standard's twenty-seven controls, and CyberCert issues the certificate onto a public registry. Buyers can check the listing and ask for the evidence behind each control. | ISO 27001Independent audit by a certification body: a stage one review of your documentation, a stage two audit of the system in operation, then surveillance audits to keep the certificate. |
| Scope and effort | SMB1001A fixed control set per tier, applied to the business as a whole. The effort is closing controls: multi-factor authentication, patching, backups, access management, policies, training. Most of it is work an SMB should be doing anyway. | ISO 27001You define the scope of an Information Security Management System, assess risk, justify every included and excluded control in a Statement of Applicability against Annex A, and then operate the machinery: policies, risk register, internal audit, management review. The standard certifies the management system. |
| Timeframe shape | SMB1001The timeline is the gap-closing work itself. Once the controls are in place and evidenced, the certificate issues and the registry listing goes up. | ISO 27001The ISMS must operate long enough to generate the evidence an auditor assesses, and the stage one and stage two audits are scheduled around a certification body's calendar. The runway is set by evidence and audit scheduling. |
| Cost shape | SMB1001The lighter of the two. The spend is mostly the remediation itself, and the certification step is small against it. What drives the effort: the people and systems in scope, the number of environments and tenancies, and how much documented process already exists. | ISO 27001The heavier of the two, structurally: certification-body fees at the initial audit, surveillance fees every year after, and the internal cost of operating an ISMS on top of the gap-closing work. |
| Recognition | SMB1001Australian. It is asked for in Australian supply chains, and the certificate itself can be checked in due diligence. It carries little weight offshore. | ISO 27001The international default. Recognised across markets and industries, and the certification large procurement teams are trained to look for. If recognition is the whole game, ISO 27001 wins it. |
All criteria
- Maintenance
- SMB1001: Renewed annually, always against the current edition, because the standard itself is revised every year. That is why a certificate carries its year, and why the controls have to hold between renewals.
- ISO 27001: Surveillance audits each year and recertification on a three-year cycle, with internal audits and management reviews running in between. The ISMS is a standing operational commitment, and it needs an owner.
When SMB1001 is the right call
- You are an Australian SMB and no contract in front of you names ISO 27001.
- Buyers or insurers ask whether you hold any certification at all, without naming one, and you need a verifiable answer.
- You want a credential now and a structured uplift path.
- Your security budget should go into controls first: multi-factor authentication, patching and backups before documentation.
- You expect to pursue ISO 27001 later. The control work transfers; nothing is thrown away.
When ISO 27001 is the right call
- A tender, panel or enterprise contract names it. That settles the question.
- Your buyers are offshore or multinational and will not recognise an Australian SMB standard.
- Counterparties specifically require an independent third-party audit.
- You are large enough that a managed ISMS earns its keep: risk formally owned, internal audit, board-level reporting.
- You handle data at a scale or sensitivity where an independently audited management system is warranted.
What are SMB1001 and ISO 27001, exactly?
SMB1001 is an Australian cybersecurity certification standard built for small and medium businesses. It is tiered, running from Bronze upward, so a business certifies at the level it can sustain and steps up as it matures.
Certificates, the registry and the ISMS
Certification is issued through CyberCert and listed on a public registry, and the standard is revised annually, which is why certificates carry a year: a current certificate reads SMB1001:2026. At Gold, a director formally attests to twenty-seven controls, the fundamentals of patching, multi-factor authentication, backups, access control and staff training.
ISO 27001 is the international standard for information security management systems. It does not certify a list of controls so much as a system of management: you define the scope of the ISMS, assess risk, justify every included and excluded control in a Statement of Applicability against Annex A, and then run the machinery of policies, risk register, internal audit and management review. An accredited certification body audits the documentation, then the system in operation, and returns every year to check it is still alive.
That difference in kind explains everything else. One standard certifies that the fundamentals are implemented in a business of your size, and does it quickly and verifiably. The other certifies that a management system exists, operates and is independently audited, and is recognised in nearly every market on earth. Neither is a lesser version of the other. They answer different buyers.
Why do so many businesses do SMB1001 first?
Because the demand usually arrives before the budget does. The first time most Australian SMBs are asked to prove their security posture, it is a supplier questionnaire, an insurer's renewal form or a mid-sized client's procurement checklist. SMB1001 answers that demand with a certificate the counterparty can verify, and the work behind it is control implementation your business needed regardless.
Stepping up to ISO 27001
The step up later is not wasted motion. The controls SMB1001 forces into place are the same controls an ISO 27001 auditor expects to find operating. Run in this order, the sequence arrives at the ISO program with the technical half largely done and an evidence habit already formed; the new work is the management system itself.
The one trap in the sequence: if a live contract names ISO 27001, SMB1001 does not substitute. Read the clause before choosing the path. Where the clause is explicit and the timeline is long, start the ISO program and certify SMB1001 in parallel as the interim proof point.
What does ISO 27001 ask of an SMB?
ISO 27001 does not change with company size. Its requirements apply to every organisation regardless of type, size or nature, so an SMB certifies against the same clauses and the same Annex A reference controls as a multinational.
Scope, audits and the management system
What scales is the scope: the business sets the boundary of its Information Security Management System around the information, systems, locations and people its buyers care about, and the certificate covers that boundary only.
Inside the boundary the full management system applies: a risk assessment and treatment plan, a Statement of Applicability, documented policies, internal audit and management review, then a certification body's stage one and stage two audits, surveillance audits each year and recertification on a three-year cycle. In an SMB the same few people usually own all of it alongside their other work, and that operating load sits on top of certification-body fees and the gap-closing work.
Scope is the first decision, and for a small business it carries the most weight. Scope too wide and a small team is committed to machinery across the whole business; scope too narrow and the certificate does not answer the question the buyer is asking. Read the contract clause first, then draw the boundary around what it covers.
Where Black Shard stands
Black Shard prepares organisations for both standards and certifies against neither.
What each program covers
For SMB1001: a gap review against your target tier, step-by-step remediation, and an evidence pack ready for the certifying assessor. For ISO 27001: scoping of your ISMS, a gap analysis against Annex A controls, and the core policies and documentation an auditor expects. Either way the engagement runs as a defined program with milestones toward your certification or audit date.
We start with the current environment, identify what is met, partial or missing, prioritise against the target and date, and collect evidence as controls land.
Questions, answered
Can we do SMB1001 first and step up to ISO 27001 later?
Yes, and it is a sensible sequence. The controls SMB1001 forces you to implement, multi-factor authentication, patching, backups and access management, are the controls an ISO 27001 auditor expects under Annex A. The policies and evidence from one feed the other, so the later ISO program starts from a working baseline.
Does Black Shard certify us against either standard?
No. Preparation and certification do not come from the same hands. Assessors and auditors certify, and our job ends at the audit door: the gap review, the remediation plan, and the evidence pack are ours, the certificate is theirs.
Is SMB1001 recognised outside Australia?
Not meaningfully. It is an Australian standard with an Australian registry, and its weight is in Australian supply chains, where it is asked for. Offshore buyers and multinational procurement teams look for ISO 27001. If your revenue depends on international counterparties, treat SMB1001 as a domestic proof point and plan for ISO 27001 as the standard those buyers will read.
What does each certification cost?
No figures are published. SMB1001 spend is mostly the remediation work. ISO 27001 adds certification-body audit fees, annual surveillance fees and the internal cost of operating an ISMS. Readiness work with us runs to your audit date, driven by the people and systems in scope, the environments and tenancies, and the documented process you already have.
Which SMB1001 tier should we target?
The tier the people asking you for proof will accept. The standard runs from Bronze upward, each tier adding controls, and Gold (Level 3) is the common target for an SMB running a defined program. A gap review maps your current state against the target tier's controls before you commit.
Can a small business get ISO 27001 certified?
Yes. The standard applies to any organisation, and a small business scopes its ISMS to the systems, people and locations its buyers care about. The obligations stay the same at any size: risk assessment, a Statement of Applicability, internal audit, management review and an annual surveillance audit. Where nothing names ISO 27001, SMB1001 is the lighter first certificate.
Is ISO 27001 overkill for a small business?
Often, if nobody is asking for it. An ISMS is a standing commitment: risk register, internal audits, management reviews, surveillance fees. With no contractual driver, the same budget spent on SMB1001 buys implemented controls and a verifiable certificate. The moment a contract names ISO 27001, certify against what your buyers ask for.