ISO 27001 vs Essential Eight: which one does your business actually need? Australian business owners hear about both, often in the same conversation with an insurer, a client or a tender panel. They're related, but they do different jobs. For many businesses, the right answer is to use both.
This guide compares ISO 27001 and the Essential Eight in plain English: what each one is, how they differ, who tends to ask for which, and how they fit together.
ISO 27001 vs Essential Eight: the short answer
The Essential Eight is a set of eight technical mitigation strategies from the Australian Signals Directorate (ASD). It tells you what to do to make the most common cyber attacks much harder. ISO 27001 is an international standard for running an information security management system. It tells you how to manage security as an ongoing business process, and it can be independently certified.
Put simply, the Essential Eight is a focused technical baseline. ISO 27001 is the management system that can sit around it.
Is one better than the other?
Not really. They answer different questions. If you want to know which technical controls will stop most common attacks, the Essential Eight is the place to look. If you need to prove to clients that your whole approach to information security is managed and independently audited, ISO 27001 is the answer.
Can a business have both?
Yes, and many do. The Essential Eight can be the technical foundation inside an ISO 27001 information security management system. The two complement each other rather than compete.
What is the Essential Eight?
The Essential Eight is a set of prioritised mitigation strategies published by the Australian Signals Directorate, Australia's lead agency for cyber security. It focuses on eight strategies that make systems much harder to compromise. The Australian Cyber Security Centre (ACSC), part of ASD, publishes the Essential Eight Maturity Model, which describes what each maturity level looks like for each of the eight mitigation strategies. ASD also publishes the broader Information Security Manual, a much wider cyber security framework that's used for government systems.
The eight strategies
- Application control
- Patch applications
- Configure Microsoft Office macro settings
- User application hardening
- Restrict administrative privileges
- Patch operating systems
- Multi-factor authentication
- Regular backups
What are the Essential Eight maturity levels?
Progress against the Essential Eight is measured with maturity levels, from Maturity Level Zero to Maturity Level Three. Each level describes how thoroughly the strategies are implemented. A business decides which level it's aiming for, usually based on the threats it faces, and is assessed against that level. Most businesses choose a target maturity level based on their business context, the sensitive data they hold and what their clients or contracts expect. Moving up a level is often called an Essential Eight uplift.
Is there an Essential Eight certification?
No. There's no formal Essential Eight certificate. A business can be assessed against a maturity level, and it can show evidence of that assessment, but there's no certification body issuing an Essential Eight certificate the way there is for ISO 27001.
What is ISO 27001?
ISO/IEC 27001 is an international standard published by ISO and IEC. The current version is ISO/IEC 27001:2022. It sets out the requirements for an information security management system (ISMS): a structured, risk-based way of protecting the confidentiality, integrity and availability of information.
What does ISO 27001 require?
The requirements sit in clauses 4 to 10. A business must define the scope of its ISMS, get leadership commitment, assess its information security risks, choose controls to treat them, train its people, and keep checking and improving through internal audits and management reviews. Annex A provides 93 controls in four themes, organisational, people, physical and technological, that a business can draw on. Because of that breadth, ISO 27001 covers physical security, supplier risk, incident management and legal and regulatory compliance, not just technology. It acts as the governance layer over your security practices.
How does ISO 27001 certification work?
Certification is carried out by an independent certification body. In Australia, certification bodies are accredited by JAS-ANZ. There's a stage 1 audit, which reviews documentation and readiness, and a stage 2 audit, which checks the system works in practice. The certificate lasts three years, with surveillance audits in between and recertification at the end. In other words, ISO 27001 certification is renewed every three years, and the business has to show at each stage that the system is still working.
ISO 27001 vs Essential Eight: key differences
Here's how the two compare side by side. For business leaders, the key differences come down to three questions: what are you trying to prove, who are you proving it to, and how much structure do you need?
- Origin: ISO 27001 is international, published by ISO and IEC. The Essential Eight is Australian, published by the ASD.
- Type: ISO 27001 is a risk-based management system standard. The Essential Eight is a set of prioritised technical mitigation strategies.
- Certification: ISO 27001 can be certified by an accredited certification body. The Essential Eight is assessed against maturity levels, with no formal certificate.
- Scope: ISO 27001 covers people, processes, physical security and technology. The Essential Eight covers technical controls on devices, applications, accounts and backups.
- Approach: ISO 27001 asks you to choose controls based on your own risk assessment. The Essential Eight prescribes the same eight strategies for everyone, with maturity levels to aim for.
- Recognition: ISO 27001 is recognised by clients and partners around the world. The Essential Eight is widely referenced in Australia, including by government and insurers.
Which is more technical?
The Essential Eight. It's almost entirely about technical controls: what's allowed to run, how software is patched, who has admin rights, how people log in and how data is backed up. ISO 27001 includes technical controls too, but it spends just as much time on governance, risk, people and process.
Which is more work?
For most small businesses, ISO 27001 is the bigger project, because it asks for a full management system with documentation, risk assessment, internal audits and an external certification audit. The Essential Eight can be very demanding at the higher maturity levels, but it's narrower in scope. In practice, most small businesses can make real progress on the Essential Eight faster than they can build a full ISO 27001 ISMS, because there are fewer moving parts and no external audit process.
Which one are you being asked for?
Often the simplest way to decide is to look at who's asking and what they've actually asked for.
When the Essential Eight is the answer
Australian government agencies, and many suppliers to government, tend to refer to the Essential Eight. Cyber insurers also commonly ask about the same areas it covers, such as MFA, patching and backups. If an insurer's questionnaire is asking about those controls, the Essential Eight is the practical place to start.
When ISO 27001 is the answer
Larger clients, international partners and many tenders ask for ISO 27001 certification, or evidence of an equivalent information security management system. If a client or tender specifically asks for ISO 27001 certification, the Essential Eight on its own won't satisfy it. Enterprise clients overseas may not know the Essential Eight at all, but they'll recognise an ISO 27001 certificate from an accredited certification body.
When you need both
If you're dealing with a mix of government work, insurers and larger corporate clients, you'll likely end up needing both. Take a 30-person engineering firm in Western Sydney that tenders for state government projects and also works for a large private developer. The government contracts may point to the Essential Eight, while the developer's supplier questionnaire asks for ISO 27001. Doing both is often less work than it sounds.
How ISO 27001 and the Essential Eight work together
The two fit together well. Many businesses use the Essential Eight as the technical baseline inside an ISO 27001 information security management system.
How the Essential Eight maps to Annex A
Several Essential Eight strategies line up with Annex A controls in ISO 27001:2022:
- Multi-factor authentication maps to the authentication and access control controls.
- Patch applications and patch operating systems map to management of technical vulnerabilities.
- Restrict administrative privileges maps to privileged access rights.
- Regular backups maps to information backup.
- Application control and user application hardening map to configuration management and protection against malware.
Because of that overlap, work done for one framework counts towards the other. Existing controls built for one framework become evidence for the other, which is why many Australian businesses treat the Essential Eight as the technical baseline and ISO 27001 as the structured approach that ties everything together.
A practical order of work
For many Australian small businesses, a sensible path looks like this. Start with the Essential Eight to get the technical basics right and lower the risk of a common attack. Then, if clients or tenders require it, build an ISO 27001 information security management system around those controls, adding risk management, policies, people and physical controls, and the audit cycle.
A typical Essential Eight uplift might start with multi-factor authentication and regular backups, then move on to patching applications, patching operating systems and restricting administrative privileges, before tackling application control and user application hardening. Each step lowers your cyber risk against common cyber threats, and each one becomes evidence you can reuse later in an ISO 27001 audit.
How Static Computers can help
Static Computers is an ISO 27001 certified Sydney managed IT provider, founded in 2006. We help businesses with both frameworks: putting Essential Eight controls in place, and preparing for ISO 27001 certification with a gap analysis, technical controls, policies and evidence, plus support with tenders and supplier questionnaires. We never certify anyone ourselves. ISO 27001 certification is always done by an independent, accredited certification body.
Frequently asked questions
Is the Essential Eight the same as ISO 27001?
No. The Essential Eight is a set of eight technical mitigation strategies from the ASD. ISO 27001 is an international management system standard for information security. They overlap on technical controls but serve different purposes.
Does ISO 27001 include the Essential Eight?
Not by name, but many Essential Eight strategies map onto ISO 27001 Annex A controls. A business can use the Essential Eight as its technical baseline within an ISO 27001 ISMS.
Can you be certified to the Essential Eight?
No. There's no formal Essential Eight certificate. Businesses are assessed against maturity levels from Zero to Three.
Which should a small business do first?
If nobody is asking for ISO 27001 yet, the Essential Eight is usually the more practical starting point because it targets the most common attacks. If a client or tender requires ISO 27001 certification, plan for ISO 27001 and use the Essential Eight as its technical foundation.
Where to go next
Read our guide to ISO 27001 certification for Australian businesses, or see our Essential Eight guide for more on the eight strategies and maturity levels. If you'd like to know where your business stands against both, book a complimentary IT review.