Short answer: SMB1001 is an affordable, tiered certificate for small business, with its lower tiers resting on a director’s attestation. ISO 27001 is a full information security management system audited by an accredited body. Step up when enterprise or international buyers ask for ISO 27001, or when a director’s attestation is no longer enough assurance for your customers.
SMB1001 is designed as a first rung. It gets a small business a credible baseline without the cost and machinery of an international standard. At some point a growing business outgrows it, and the question becomes when to make the step up to ISO 27001. This sets out what changes, what carries over, and how to time the move.
What is the difference between SMB1001 and ISO 27001?
SMB1001 is a five tier certification from Dynamic Standards International, built for small business, where the lower three tiers rest on a company director’s attestation and the top two are independently verified. ISO 27001 is the international standard for an Information Security Management System (ISMS), audited by an accredited certification body against a defined set of requirements and Annex A controls.
The gap is one of kind, not just degree. SMB1001 certifies that a set of controls is present. ISO 27001 certifies that you run an ISMS: governance, risk assessment, a Statement of Applicability (SoA), internal audit and continual improvement across the organisation. One is a control checklist with tiers; the other is a system for governing security.
How do SMB1001 and ISO 27001 compare?
The table sets the practical differences side by side.
| SMB1001 | ISO 27001 | |
|---|---|---|
| Built for | Small and medium business | Any organisation, international |
| Structure | Five tiers, Bronze to Diamond | Single standard, one certificate |
| Assurance | Director attestation at lower tiers, verified at top two | Accredited third party audit |
| Scope | A defined control set | A full management system |
| Recognition | Australian market, supplier assurance | International, enterprise procurement |
| Cost | Low, scaled by size | Higher, tens of thousands once all in |
| Validity | Annual | Three year cycle with surveillance audits |
For the Essential Eight comparison instead, see SMB1001 vs the Essential Eight. For the wider selection logic, see how to choose a cyber security framework in Australia. For a plain language introduction to the standard itself, see what SMB1001 is.
When should you step up to ISO 27001?
When the market asks for it. The clearest signal is a customer, usually enterprise or international, naming ISO 27001 in a security questionnaire or procurement clause. A second signal is that a director’s attestation no longer carries enough weight with the buyers you are chasing, who want an independent audit rather than a signed statement.
Do not make the jump on principle alone. ISO 27001 is a real increase in cost, time and ongoing maintenance, so it should follow demand, not precede it. If your customers still accept SMB1001, the money is better spent elsewhere until that changes.
What carries over from SMB1001 to ISO 27001?
More than nothing, less than everything. The controls you implemented for SMB1001, particularly at the verified Platinum and Diamond tiers, map to parts of ISO 27001 Annex A, so the technical work is not wasted. Access control, backups, patching and incident response all reappear.
What SMB1001 does not build is the management system itself: the risk assessment methodology, the Statement of Applicability, the internal audit programme and the continual improvement cycle that ISO 27001 requires. That is the bulk of the new work in the step up. Cybernion runs both, with an SMB1001 certification service for the first rung and an ISO 27001 service for the step up, so the earlier work feeds the later programme. For a startup weighing the sequence, ISO 27001 for startups sets out the timing.
Frequently asked questions
Is ISO 27001 the same as SMB1001 at a higher level?
No. SMB1001 is a tiered certification for small business with self attested lower tiers. ISO 27001 is an international standard requiring a full information security management system audited by an accredited body. ISO 27001 is broader, more demanding and more widely recognised internationally.
When should a business move from SMB1001 to ISO 27001?
When buyers, especially enterprise or international customers, start asking for ISO 27001 in procurement, or when a director attestation is no longer enough assurance for your customers. SMB1001 is a strong first rung; ISO 27001 is the step up when the market demands it.
Does SMB1001 work count towards ISO 27001?
Partly. The controls you put in place for SMB1001, especially at the higher verified tiers, map to parts of ISO 27001 Annex A. What SMB1001 does not build is the full management system, risk process and continual improvement cycle that ISO 27001 requires.
Is ISO 27001 much more expensive than SMB1001?
Yes. SMB1001 is designed to be affordable for small business. ISO 27001 certification runs into the tens of thousands once you count implementation, tooling, audit and internal time. The step up is a real jump in cost and effort, so it should follow real demand.
Can a business hold both SMB1001 and ISO 27001?
Yes, though most treat SMB1001 as a stepping stone and let it lapse once ISO 27001 is held, since ISO 27001 is the stronger signal. Some keep SMB1001 if particular customers recognise it specifically.
Written by Gaurav Vikash, an ASD endorsed IRAP assessor and senior cyber security leader with 18 years of experience across Australia, the UK and Asia, including CISO and senior security leadership roles. He holds CISSP, CISA, CISM and CRISC and is an ISO 27001 and ISO 42001 Lead Implementer, and speaks regularly at industry conferences.
Sources:
- Dynamic Standards International, SMB1001:2026 Standard, dsi.org, 2026
- ISO/IEC 27001:2022, iso.org, 2022
- CyberCert, the appointed Dynamic Standard Certifier for SMB1001, cybercert.ai, 2026
Last updated: 3 July, 2026