Standards comparison
ISO 27001, SOC 2, Essential Eight, SMB1001 and ISO 42001 and ASD Cloud Security Guidance, compared.
Short answer: ISO 27001 is the most widely requested security certification in Australia; SOC 2 suits US-facing SaaS; the Essential Eight is a technical maturity baseline, not a certificate; SMB1001 is a proportionate tiered certification for smaller businesses; and ISO 42001 governs how you use and build AI; and the ASD Cloud Security Guidance is advice for securing cloud services, not a certificate.
| Attribute | ISO 27001 | SOC 2 | Essential Eight | SMB1001 | ISO 42001 | ASD Cloud Security Guidance |
|---|---|---|---|---|---|---|
| What it is | International standard for an information security management system (ISMS) | US attestation framework against the AICPA Trust Services Criteria | Australian Cyber Security Centre (ACSC) baseline of eight mitigation strategies | Australian tiered cyber security certification for small and medium businesses | International standard for an AI management system (AIMS) | ASD advisory framework for evaluating, selecting and configuring cloud services, aligned with the ISM |
| Outcome | Certificate | Attestation report (Type I or Type II) | Maturity level (0–3), not a certificate | Certificate at a chosen level | Certificate | Cloud security assessment and configuration findings, not a certificate |
| Who assesses | Accredited certification body (JAS-ANZ in Australia/NZ) | Licensed CPA firm | Self-assessment or independent assessor | Certification body under the SMB1001 scheme | Internal security team, external consultants or IRAP assessors | Internal review against ASD guidance, often supported by an independent assessor |
| Scope | Risk-based; you define the scope and select Annex A controls | Chosen trust criteria for a defined system | Fixed technical controls | Fixed controls that increase by level | Risk-based; AI systems you develop, provide or use | Cloud provider selection, tenant configuration and shared responsibility |
| Ongoing | Annual surveillance audits, recertification every three years | Typically reissued annually | Continuous; mandatory for many government entities | Periodic recertification | Annual surveillance, three-year cycle | Reviewed as cloud services and ASD guidance change |
| Best fit | Enterprise, government and international customers | SaaS selling into the US market | Technical hardening; Australian government alignment | Smaller businesses needing a proportionate, recognised step | Organisations building or relying on AI | Government suppliers and regulated workloads on Microsoft 365, Azure or AWS |
General guidance only; confirm current scheme rules with the relevant body.
Common questions
ISO 27001 or SOC 2: which do Australian customers ask for?+
Australian enterprise and government buyers most often ask for ISO 27001 certification. SOC 2 is more common when selling to US customers. Many organisations start with ISO 27001 and map to SOC 2 later, because the controls overlap substantially.
Is the Essential Eight a certification?+
No. The Essential Eight is an ACSC maturity model. You can be assessed against a maturity level, but there is no Essential Eight certificate. It complements ISO 27001, which provides the management system around those controls.
How does the Essential Eight apply to cloud environments?+
The Essential Eight is a fixed set of mitigation strategies, and several have cloud-specific implementations in platforms such as Microsoft 365, Azure and AWS: multi-factor authentication, restricted administrative privileges, patching, application control and backups. It is distinct from the ASD Cloud Security Guidance, which is separate advice on selecting and configuring cloud services. CNETS assesses your cloud configuration against the Essential Eight maturity levels and the ASD Cloud Security Guidance, then maps the results into your ISO 27001 controls and Statement of Applicability.
What is the ASD Cloud Security Guidance, and how is it different from the Essential Eight?+
The Essential Eight is a baseline of eight mitigation strategies with maturity levels. The ASD Cloud Security Guidance is separate advice from the Australian Signals Directorate on evaluating, selecting and configuring cloud services in line with the Information Security Manual (ISM). Neither is a certification. CNETS uses both to review your cloud setup and maps the findings into your ISO 27001 controls.
How does SMB1001 relate to ISO 27001?+
SMB1001 is a tiered certification designed for smaller businesses, with fixed controls at each level. It can be a proportionate first step; ISO 27001 is broader, risk-based and more widely recognised internationally.
Can an AI policy replace ISO 42001?+
An AI policy states intent. ISO 42001 adds the management system around it: an AI inventory, risk and impact assessments, roles, competence, monitoring, internal audit and management review. A policy alone does not show that AI risks are being managed.
Can we combine ISO 27001 and ISO 42001?+
Yes. Both follow the ISO harmonised structure, so governance, risk, document control, internal audit and management review can be shared in one integrated management system.
Next step
Your next step starts
with a conversation.
Tell us where you want to go. We’ll help you understand what it takes to get there.