Is SMB1001 equivalent to ISO 27001?

No. They are different kinds of standard. SMB1001 is a defined list of controls at each of five levels; ISO 27001 certifies a management system that you design around your own risks, audited by an accredited certification body. SMB1001 Diamond approaches ISO 27001 in rigour and DSI publishes a mapping between the two, but a customer who requires ISO 27001 will usually require ISO 27001.

Which is cheaper, SMB1001 or ISO 27001?

SMB1001, at every level. The certification fee is modest, there is no audit until Platinum, and the controls are concrete rather than a management system you must build and run. ISO 27001 involves stage 1 and stage 2 certification audits, annual surveillance audits, and the effort to operate the ISMS, which for a small business is typically a six-to-twelve-month project with materially higher cost.

Can SMB1001 be a stepping stone to ISO 27001?

Yes, and that is how we usually sequence it for growing businesses. Gold puts in place controls (MFA, EDR, backups, email authentication, incident response, asset register, policies) that map directly onto ISO 27001 Annex A controls, and the evidence pack you build for attestation becomes audit evidence later. You get a recognised certificate now instead of waiting a year for ISO.

Do we need ISO 27001 if we hold SMB1001 Diamond?

Only if someone who matters to your revenue requires it. Diamond is independently audited and very thorough, and for Australian SMB supply chains it is more than enough. Enterprise and government tenders, and international customers, tend to specify ISO 27001 by name.

Does IronSights do both?

Yes. We hold ISO 27001 ourselves, we run ISO 27001 readiness and gap work through our audit and assurance practice, and we take SMBs through SMB1001 at every level. That is why we can tell you honestly when the cheaper one is the right one.

SMB1001 vs ISO 27001

SMB1001 or ISO 27001? Proportionate, or the global standard.

One is a tiered checklist written for small and medium businesses with a director's attestation at the lower levels. The other is the international management-system standard that enterprise and government tenders name. We hold ISO 27001 ourselves and deliver both, so here is the honest comparison.

See the comparison ISO 27001 vs Essential Eight

	SMB1001	ISO 27001
What it is	A tiered control standard written for businesses of roughly 5 to 200 people. Five levels, each a defined list of controls.	The international standard for an information security management system (ISMS). Risk-based: you define scope, assess risk, and select controls (93 in Annex A of the 2022 edition) to treat it.
Who publishes it	Dynamic Standards International (Australia), revised annually. Current edition SMB1001:2026.	ISO and IEC jointly. Current edition ISO/IEC 27001:2022.
How you are verified	Director attestation at Bronze, Silver and Gold; independent audit at Platinum and Diamond.	Independent certification audit by an accredited certification body (JAS-ANZ accredited in Australia), then surveillance audits each year on a three-year cycle.
Time to certify	Weeks at Bronze or Silver; one to three months for Gold; a quarter for Platinum or Diamond.	Typically six to twelve months for a small business, longer where there is no existing management system.
Cost shape	Modest annual fee plus the uplift to close gaps; audit fee only at Platinum and Diamond.	Certification body fees for stage 1, stage 2 and surveillance audits, plus consultant or internal time to build and run the ISMS. Materially more than SMB1001 at every stage.
Who asks for it	Australian SMB customers, insurers, professional bodies (the Queensland Law Society recommends it), supply-chain questionnaires.	Enterprise and government procurement, international customers, regulated sectors, and anyone whose tender template says "ISO 27001 or equivalent".
Ongoing effort	Keep the controls in place, re-attest annually against the new edition.	Run the management system continuously: risk reviews, internal audits, management review, corrective actions, and the external surveillance audit every year.

How to choose

Start with who is going to read the certificate.

SMB1001

Nobody has named ISO 27001, but customers and your insurer want proof

Gold is proportionate, fast and recognised by the people asking. Platinum if a tender wants third-party assurance.

ISO 27001

A contract, tender or parent company names ISO 27001

There is no substitute. "Or equivalent" is sometimes negotiable with SMB1001 Diamond, but do not plan on it.

Both, in sequence

You are 50 to 200 people and selling to enterprise or government

SMB1001 Gold now for the SMB buyers and insurer, with the controls and evidence built so they become Annex A evidence when you start the ISO program.

SMB1001

You are a small firm that simply wants to be demonstrably secure

Certify at the level you can evidence and step up annually. An ISMS is a management discipline most ten-person firms cannot staff, and SMB1001 was written for exactly that gap.

Doing both

SMB1001 Gold now, ISO 27001 when the tender arrives.

The controls Gold asks for (MFA everywhere, EDR, tested backups, enforced email authentication, an incident response plan, an asset register, written policies) are the same controls an ISO 27001 auditor wants to see evidenced under Annex A. Build them once, with the evidence pack, and you have a certificate in months instead of a year, plus a head start on the ISMS.

Our audit and assurance practice runs the ISO 27001 readiness work when you need it; the SMB1001 uplift is designed so nothing has to be redone.

What carries over

Identity and access controls: individual accounts, MFA, restricted admin, access reviews.
Endpoint and email controls: EDR, patching, SPF, DKIM and DMARC.
Backup, recovery and incident response plans, with the test records to prove them.
The asset register and the policy set, which become ISMS documents with a scope statement on top.

Common questions

Asked and answered.

Is SMB1001 equivalent to ISO 27001?
No. They are different kinds of standard. SMB1001 is a defined list of controls at each of five levels; ISO 27001 certifies a management system that you design around your own risks, audited by an accredited certification body. SMB1001 Diamond approaches ISO 27001 in rigour and DSI publishes a mapping between the two, but a customer who requires ISO 27001 will usually require ISO 27001.
Which is cheaper, SMB1001 or ISO 27001?
SMB1001, at every level. The certification fee is modest, there is no audit until Platinum, and the controls are concrete rather than a management system you must build and run. ISO 27001 involves stage 1 and stage 2 certification audits, annual surveillance audits, and the effort to operate the ISMS, which for a small business is typically a six-to-twelve-month project with materially higher cost.
Can SMB1001 be a stepping stone to ISO 27001?
Yes, and that is how we usually sequence it for growing businesses. Gold puts in place controls (MFA, EDR, backups, email authentication, incident response, asset register, policies) that map directly onto ISO 27001 Annex A controls, and the evidence pack you build for attestation becomes audit evidence later. You get a recognised certificate now instead of waiting a year for ISO.
Do we need ISO 27001 if we hold SMB1001 Diamond?
Only if someone who matters to your revenue requires it. Diamond is independently audited and very thorough, and for Australian SMB supply chains it is more than enough. Enterprise and government tenders, and international customers, tend to specify ISO 27001 by name.
Does IronSights do both?
Yes. We hold ISO 27001 ourselves, we run ISO 27001 readiness and gap work through our audit and assurance practice, and we take SMBs through SMB1001 at every level. That is why we can tell you honestly when the cheaper one is the right one.

The SMB1001 guide

Next step

Not sure which one your customers actually need?

Bring the tender, the questionnaire or the insurer's letter to the tier-selection call. Twenty minutes, and you leave with a recommendation and a plan.

Book the tier-selection call →

SMB1001 is a standard of Dynamic Standards International and certification is issued by CyberCert, an independent certification body; IronSights prepares you for it and does not issue certificates. Figures quoted are from public sources at the time of writing (August 2026); confirm current pricing and control lists at cybercert.ai.