SMB1001 vs the Essential Eight: which one applies to a small business?

They are different kinds of thing, so for most small businesses it is not a choice between them:

• The Essential Eight is a framework — 8 mitigation strategies published by the Australian Signals Directorate that an organisation measures itself against. It is designed for managed Windows networks, and mandatory to assess against only for federal government entities
• SMB1001 is a certification — a tiered standard a small business can actually be certified against, with a certificate to show customers, tenders and insurers
• The two now connect formally — SMB1001:2026 publishes control mappings to the Essential Eight, so work done toward one counts toward the other

The practical rule: if a government or enterprise contract names the Essential Eight, that is what it wants and SMB1001 is not a substitute; if a customer simply asks for proof you take security seriously, SMB1001 is the certificate built for that conversation. A small business reads the Essential Eight; it gets certified against SMB1001.