When building cyber resilience, many Australian businesses ask:
Should we start with the Essential Eight, the Further Five or SMB1001?
The short answer:
Start with the Essential Eight, then work towards SMB1001, and finish with the Further Five.
Here’s why:
SMB1001 is designed specifically for Australian SMBs and provides a practical, risk-based starting point.
– Covers foundational IT security, backups, continuity, and governance
– Maps to the Essential Eight but adds real-world, operationally relevant controls
– Highly actionable for businesses without large IT teams
Once the groundwork is laid with SMB1001, the Essential Eight becomes your next step.
With both SMB1001 and the Essential Eight in place, you’re ready to implement the Further Five.