They solve different problems.
The most common mistake organisations make is treating ISO 27001 and Essential Eight as competing options. They are not. They address fundamentally different aspects of cybersecurity.
Essential Eight is a prescriptive technical control set developed by the Australian Signals Directorate (ASD). It tells you exactly what to implement: patch applications within 48 hours, enforce multi-factor authentication, restrict administrative privileges, control application execution, and five more specific strategies. It is designed to stop the most common cyberattack techniques. Think of it as what to build.
ISO 27001 is an international management system standard. It does not prescribe specific technical controls. Instead, it requires you to establish a systematic process for identifying information security risks, selecting appropriate controls, and continuously improving your security programme. It covers governance, people, processes, and technology. Think of it as how to manage what you build.
What Essential Eight actually is.
The Essential Eight is a set of eight mitigation strategies that the ASD identified as the most effective defence against targeted cyber intrusions. The strategies are: application control, patch applications, configure Microsoft Office macros, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups.
Each strategy is assessed against four maturity levels. Maturity Level 0 indicates significant gaps. Maturity Level 1 provides partial alignment. Maturity Level 2 represents strong implementation and is the baseline expected of Commonwealth entities under the PSPF. Maturity Level 3 represents comprehensive implementation designed to resist highly adaptive adversaries.
The November 2023 update to the maturity model significantly raised the bar. ML2 now requires phishing-resistant MFA and 48-hour patching for critical vulnerabilities. The result: only 22% of Commonwealth entities had achieved overall ML2 across all eight strategies as of the 2025 Commonwealth Cyber Security Posture report, down from 25% in 2023 because the standard got harder, not because security got worse.
Where Essential Eight has regulatory force: Mandatory at ML2 for non-corporate Commonwealth entities under the PSPF. Increasingly expected in government procurement, cyber insurance underwriting, and supply chain security requirements across financial services, critical infrastructure, and education.
What ISO 27001 actually is.
ISO/IEC 27001:2022 is an international standard for Information Security Management Systems (ISMS). Certification means an accredited body has audited your ISMS and confirmed it meets the standard's requirements. It does not mean your organisation is impenetrable. It means you have a documented, risk-driven management process for information security that is governed, measured, and continuously improved.
The standard has two parts. Clauses 4 to 10 are mandatory requirements covering context, leadership, planning, support, operation, performance evaluation, and improvement. Annex A contains 93 controls across four themes that you select based on your risk assessment. You do not implement all 93; you implement the ones your risk treatment plan justifies, and you document why you excluded the rest in your Statement of Applicability.
The 2022 revision reorganised Annex A from the previous 114 controls across 14 domains and introduced 11 new controls including threat intelligence, cloud security, and data masking. The transition deadline from ISO 27001:2013 was October 2025.
Where ISO 27001 has market force: Increasingly required in enterprise procurement, government tender evaluations, and supplier due diligence. APRA-regulated entities commonly use ISO 27001 as the management framework for meeting CPS 234 obligations. The Defence Industry Security Program preferences ISO 27001 for suppliers handling sensitive information.
The controls that appear in both.
Essential Eight and ISO 27001 Annex A overlap in several areas. Organisations pursuing both can satisfy requirements simultaneously rather than doing the work twice.
The overlap means that an organisation already implementing Essential Eight has a head start on several ISO 27001 Annex A controls. Conversely, an organisation with ISO 27001 certification already has governance structures that make sustaining Essential Eight maturity significantly easier.
Which to pursue first.
The right answer depends on who is asking for compliance, what your regulatory exposure is, and where your current maturity sits. Here is how to decide.
Start with Essential Eight. Commonwealth and state government procurement increasingly requires Essential Eight ML2 alignment. If government contracts are a significant revenue source, demonstrating ML2 is the faster path to winning and retaining that work.
Start with ISO 27001. Enterprise clients and their procurement teams want to see a certificate. ISO 27001 certification is the internationally recognised proof that your security is governed, and it dramatically simplifies supplier due diligence questionnaires.
You likely need both, anchored on CPS 234. CPS 234 is your actual regulatory obligation. ISO 27001 provides the management framework. Essential Eight provides the technical controls. Both support your CPS 234 compliance posture.
Essential Eight first. Australian cyber insurers increasingly assess controls that map directly to the eight strategies: MFA, patching, backups, endpoint detection. Demonstrating Essential Eight alignment can materially improve your premium and coverage terms.
ISO 27001 for credibility; Essential Eight for substance. If your board wants assurance that security is governed, ISO 27001 provides the auditable management framework they can report on. If they want evidence that specific technical risks are mitigated, Essential Eight provides the measurable maturity scores.
Start with Essential Eight. It is lower cost to implement, does not require certification body fees, and delivers immediate risk reduction. The governance structures you build along the way (policies, risk registers, evidence collection) become the foundation for ISO 27001 when you are ready.
Most organisations need both eventually.
Essential Eight without governance is a point-in-time achievement that degrades as your environment changes. ISO 27001 without prescriptive technical controls is a management system with nothing concrete under it. The frameworks are genuinely complementary, and for any organisation with serious security obligations, the question is not which one but which order.
The practical reality for most mid-market Australian organisations (50 to 500 staff) is this:
- Year one: Implement Essential Eight to ML2 and build the basic governance structures (policies, risk register, incident response plan) that will become your ISMS foundation.
- Year two: Formalise the ISMS, conduct your gap assessment against ISO 27001, and prepare for certification. Your Essential Eight evidence becomes your Annex A evidence for the relevant controls.
- Ongoing: Use the ISO 27001 management review and internal audit cycle to maintain and improve your Essential Eight maturity. The ISMS prevents your technical controls from degrading.
Organisations that try to do both simultaneously can succeed, but only if they have sufficient internal resources or external support to manage two parallel workstreams. For most mid-market organisations, sequencing is more realistic than parallelisation.
We hold ISO 27001 and deliver both.
Cliffside holds ISO 27001 certification for our own ISMS. We have been Lead Auditors since 2008. We also deliver Essential Eight assessments to Maturity Level 3. This is not theory for us. We maintain our own ISMS, we conduct our own internal audits, and we manage the surveillance cycle every year. We know where the hard parts are because we live them.
When a client asks us "which framework should we do first?", we do not give a generic answer. We start with a Lighthouse Assessment that maps your current controls against both frameworks, identifies your regulatory and commercial exposure, and recommends a sequenced plan based on what your organisation actually needs, not what is fashionable.