SMB1001

A certification standard from Dynamic Standards International, built specifically for small and medium business. Five tiers: Bronze, Silver, Gold, Platinum, Diamond. You start where you are and climb as far as you need to.

It's based on the same body of controls as ISO 27001, but staged. Most security standards assume an organisation with a security function. SMB1001 assumes you don't have one, and builds from there.

Who asks for it. Larger customers who want assurance from a smaller supplier. Some insurers. Increasingly, grant bodies.

What's involved. Months, not years. Real work, but achievable without a compliance department, and the lower tiers are within reach of a business that's never done any of this before.

Worth knowing. This is usually the right place to start, and it's often the one that satisfies the customer who asked, without the cost of the standard they named. Nova Sec is certified to Level 3 (Gold), so it's a process Nova Sec has been through rather than one it's read about.

ISO/IEC 27001

The international standard for information security management. Not a checklist of controls but a system for running security: you work out what you're protecting, what could go wrong, what you're going to do about it, and how you'll know it's working. Then you keep doing it.

That's what makes it heavier than the others, and why buyers take it seriously. It isn't proof that you bought the right tools. It's proof that someone is actually managing this.

Who asks for it. Government tenders, both federal and state. Enterprise customers with a formal supplier assurance programme. Large healthcare and financial services organisations vetting the small businesses they buy from. If you're a manufacturer in someone's supply chain, this is often what lands on your desk.

What's involved. Six to twelve months for most small businesses, and it doesn't end when you get the certificate. It has to be maintained, audited and renewed.

What Nova Sec does. The implementation. Scope, risk assessment, the statement of applicability, policies, controls, evidence, internal audit, management review, and getting you through the certification audit.

Worth knowing. The certificate itself is issued by an accredited certification body after an independent audit. Nobody can sell you one, and that separation is exactly what makes it worth having. Nova Sec builds the system and takes you to the audit. The auditor decides.

ASD Essential Eight

Eight controls from the Australian Signals Directorate, aimed at the attacks that actually happen. Multi-factor authentication. Patching your systems and your applications. Backups that work. Limiting who has administrator rights. Controlling what software is allowed to run. Blocking Office macros. Hardening browsers. Keeping operating systems current.

Who asks for it. Australian tenders and government buyers. Increasingly, cyber insurers, who now want evidence of maturity before they'll write or renew a policy. Enterprise customers doing due diligence on a small supplier.

How it's measured. Four maturity levels, zero to three. Level One is a realistic target for most small businesses and is what insurers generally look for. Levels Two and Three are for organisations facing more capable attackers.

Worth knowing. ASD confirmed in June 2026 that the Essential Eight will be retired over the next couple of years and replaced by a broader "Essentials" series. That sounds alarming and mostly isn't. Both frameworks run side by side for now, the controls carry across, and the Essential Eight is still what tenders and insurers are asking for today.

If someone has asked you for Essential Eight maturity, that's still the question. Nova Sec follows the source and will tell you when it changes.

Privacy law

Not a certification. Law, and it probably already applies to you.

There are three Acts in play for a Victorian business, and the first job is working out which ones you're under. Most people guess, and the OAIC found that 85% of Australians either wrongly believed the Privacy Act covers small business or didn't know either way. That confusion runs both ways, and plenty of businesses assume they're exempt when they aren't.

Privacy Act 1988 (Cth). Applies to Commonwealth agencies and any private business turning over more than $3 million a year. It sets out thirteen Australian Privacy Principles, and it contains the Notifiable Data Breaches scheme.

Below $3 million there's a small business exemption, but there are exemptions to the exemption.

You're covered regardless of turnover if you provide a health service and hold health information. That's section 6D(4)(b), and it's the one most often missed. Medical, dental, physio, psychology, pharmacy.

Also covered: businesses that trade in personal information, contracted service providers on Commonwealth contracts, credit providers, reporting entities under anti-money-laundering law, and anyone related to a business already covered.

And the turnover test isn't what people think. It asks whether you've had turnover above $3 million in any financial year since 2001. Not this year. Any year. You don't get back out by shrinking.

Health Records Act 2001 (Vic). Applies to health information held by any organisation in Victoria, public or private, whether or not you're a health service provider. Eleven Health Privacy Principles. Regulated by the Health Complaints Commissioner, not the OAIC.

A Victorian GP practice is typically under both this and the Privacy Act. Two regulators, two sets of principles.

Privacy and Data Protection Act 2014 (Vic). Victorian public sector organisations and certain contracted service providers. Ten Information Privacy Principles. It doesn't cover health information.

The one that matters most for security. APP 11, under the Privacy Act: you must take reasonable steps to protect the personal information you hold from misuse, interference, loss, and unauthorised access, modification or disclosure.

The Act doesn't say what reasonable means. That's the whole problem. Reasonable depends on how sensitive the information is, how much of it you hold, what harm a breach would do, and what a competent practitioner would expect to see in a business like yours. It's a security question wearing a legal hat, and establishing the answer is exactly what a gap assessment does.

Notifiable Data Breaches. Part of the Privacy Act. If a breach is likely to result in serious harm, you have to notify the OAIC and the people affected, and you're expected to be quick about it. Most businesses discover mid-breach that nobody knows who makes that call. Working it out beforehand is most of the job.

Worth knowing. Your obligations stay with you regardless of who runs your systems. Outsourcing your IT does not outsource your accountability, and an MSP contract is not a defence. The regulator comes to you.

SOC 2, NIST, CPS 234 and the rest

If a customer has asked for something not listed here, ask. Most frameworks cover the same ground in a different order, and the honest answer is often that a smaller one satisfies the same buyer.

Which one applies to you?

If a customer has asked for something not listed here, ask. Most frameworks cover the same ground in a different order, and the honest answer is often that a smaller one satisfies the same buyer.