If you run a small business in Perth, you have probably heard the terms Essential Eight, Essentials and SMB1001 used in the same sentence, usually by someone who assumes you already know the difference. Most business owners do not, and that is completely fair. Cyber security standards are often written by specialists for other specialists, which makes it hard to work out which one actually applies to you.

The short version is this. The Essential Eight is being retired, the new Essentials is aimed at larger organisations, and SMB1001 was built for businesses like yours. Let us walk through what each one is, who it suits, and how to choose without losing a weekend to reading government guidance.

What is happening to the Essential Eight?

For years, the Essential Eight has been the Australian Government’s go-to cyber security baseline. It is a list of eight technical controls, such as patching, multi-factor authentication, application control and backups, with maturity levels from one to three. In October 2026, the Australian Signals Directorate (ASD) launched a new series called the Essentials, and ASD has indicated the Essential Eight will be retired in around two years. During the transition, both frameworks remain available on the ASD website, and existing obligations still apply until regulators advise otherwise.

That last point matters. If a contract, tender or insurer asks for the Essential Eight today, they still mean it today. The framework is changing, but the paperwork around it will take a while to catch up.

Who is the new Essentials really for?

The Essentials is a threat-informed, outcome-based framework made up of chapters for different environments. The first three cover enterprise IT, operational technology and cloud. ASD says it is designed for Commonwealth entities, critical infrastructure owners and operators, and large organisations. You can read the full series on cyber.gov.au.

In plain terms, it is aimed at the higher end of town. It assumes you have security architects, dedicated internal teams and the budget to match. That is a sensible approach for a government department or a major resources company, but it is a big ask for a 25 person accounting practice or a family-run construction business.

When a small business might still need the Essential Eight

There is one situation where small businesses get pulled into this world. Some government tenders, particularly those linked to defence contractors, ask suppliers to hold Essential Eight Maturity Level One or Two before they can even respond. If that is your goal, then you will need to meet that requirement, and we can help you assess where you stand today.

We will also be upfront about one thing. We have seen businesses that believed they were Level One compliant when they clearly were not. Achieving it properly can involve extra licensing and real remediation work, so we only recommend it when a tender genuinely depends on it.

Why SMB1001 suits small business so well

If you are not chasing government or defence contracts, it is fair to ask why you would follow a standard designed for someone else. SMB1001 was developed for small and medium businesses, and it was put together by the Australian IT industry rather than any one provider. It is not the Fabio Suffell way, the Qbit way or anyone else’s opinion of good security. It is what the industry has said small businesses actually need.

There are a few reasons it works so well:

• It is easy to understand. The requirements are written in plain language, so you can see what is being asked and why.
• It has a clear pathway. Certification progresses from Bronze through to Platinum, so you can start at a sensible level and build from there as your business grows.
• It covers more than technology. SMB1001 looks at people, policies and processes as well as systems, including staff awareness training, which many technical frameworks leave out.
• It is certifiable. Instead of saying you are secure, you can prove it to clients, partners and insurers.
• It expects you to get help. The standard allows you to use a managed service provider to meet many requirements, which is how most small businesses already operate.

SMB1001 also lines up well with the Essential Eight, so the work you do towards one will not be wasted if your needs change later.

The cyber insurance angle

Here is the part that gets a business owner’s attention. Cyber insurers have openly told us that when a prospective client holds one of these standards, particularly SMB1001 Gold, getting cover becomes easier and the premiums are far more competitive. Over a few years, that can save a business thousands of dollars. Insurers are not being generous. They simply see a certified business as a lower risk, because someone independent has checked that the basics are in place.

This is a practical return on the investment, and it is one that many small businesses overlook when they think about cyber security purely as a cost. Of course, every insurer and policy is different, so always speak to your broker about what your policy requires.

So which one should you follow?

Here is how we put it to our clients. If you are not chasing government or defence work, there is little reason to follow a framework designed for large organisations. Choose the standard built for your size, and make sure it is one you can prove.

• Pursuing government or defence tenders: keep your Essential Eight evidence current for now and plan your move to the Essentials before your contract requires it.
• Small or medium business with no tender requirements: SMB1001 is almost always the better fit.
• Large or complex environments, including operational technology: the Essentials is designed for you, using the chapters that match your setup.

Many businesses also find that SMB1001 gives them a head start on the others, because the controls overlap. You are not choosing between safety and paperwork. You are choosing the pathway that suits your size and your goals.

How Qbit helps you get there

Qbit has held SMB1001 Gold certification ourselves, alongside ISO 27001, ISO 9001, ISO 14001 and ISO 45001, so we know first-hand what it takes. When you join us as a managed IT services Perth client, our Managed Services and Managed Security Services agreements bring your business to the SMB1001 Silver standard as presented, with multi-factor authentication, patching, endpoint protection, backup, password management and staff awareness training built in. From there you can work towards Gold or beyond if you wish.

We support Perth businesses across accounting, legal, medical, mining, construction and education, so the advice you get is shaped around your industry rather than a generic checklist. Whether you need IT support Perth day to day, cyber security services Perth for protection, or a clear plan for meeting a client or insurer requirement, we can pull it together under one roof. If your business has fewer than 15 staff, our Service Bank option can also guide you through certification.

If a tender does require the Essential Eight, we will tell you honestly what is involved, assess where you stand, and avoid selling you more than you need. If it does not, we will point you to the standard that gives you the best protection for your money.

Ready to find out where your business stands? Book a free IT assessment with Qbit and we will show you which level you are at today, what it takes to reach the next one, and how it could help with your insurance renewal. Call us on (08) 6364 0600 or visit qbit.com.au to get started.