Yes — a sole trader can get SMB1001 certified without an IT consultant, because the standard and the certification path were both built to run without one. SMB1001 was designed by Dynamic Standards International specifically for small organisations, its entry tier covers businesses of one, and certification is assessed through an authorised certifier, not through a consultant you must first hire. What you do need is the Level 1 controls in place — and a sole trader with good basic hygiene is often closer to those than a twenty-person team. Cyber Aware covers the one area of the standard that is entirely yours: the human layer.
TL;DR
- SMB1001 was built for small and medium businesses — its Micro tier starts at one employee.
- Certification is issued by an authorised certifier (CyberCert is the official one), and no consultant is required anywhere in the process.
- Level 1 asks for basics: firewall, antivirus, automatic updates, password routines, backups — and a technical support arrangement, which can be an external service.
- The standard's five areas include Education and Training; for a sole trader, that is you.
- A gap assessment tells you how close you already are before you commit.
Why this matters
Frameworks have a reputation problem among very small businesses: they read like they were written for companies with an IT department, a compliance officer and a budget. SMB1001 exists to break that pattern. Dynamic Standards International (DSI), a not-for-profit standards body, publishes SMB1001:2026 as a multi-tiered cybersecurity certification standard created globally for small and medium-sized businesses, with five levels from basic hygiene upward (DSI). Its own FAQ lists the five areas the standard covers: Technology Management, Access Management, Backup and Recovery, Policies and Processes, and Education and Training.
The stakes for a one-person business are not small. In Australia, ASD received more than 84,700 cybercrime reports in FY2024-25 — one every six minutes — with small businesses averaging $56,600 per self-reported loss (ASD Annual Cyber Threat Report 2024-25). For a sole trader, a $56,600 loss is not a line item; it is the business. A certification that clients, insurers and supply-chain questionnaires increasingly recognise is cheap protection against exactly that conversation.
Can a sole trader get SMB1001 without an IT consultant?
Yes, and it helps to separate the three things people lump together: the standard, the technical work and the certification.
| Question | Answer for a sole trader |
|---|---|
| Is the standard available to a one-person business? | Yes — the Micro licence tier covers 1–20 employees (DSI) |
| Does certification require hiring a consultant? | No — assessment runs through an authorised certifier, not a consultant |
| Does Level 1 require technical help? | A technical support arrangement, which an external service satisfies |
| What is the human-layer requirement? | Education and Training is one of the five areas — your own training counts |
What Level 1 actually asks for
DSI lists the basic requirements of Level 1 compliance: engage a technical support specialist, install and configure a firewall, install antivirus software on all devices, automatically install software updates and patches, change passwords routinely, and implement a backup and recovery strategy for important digital assets (DSI).
Notice what is not on that list: an internal IT hire, a security team, an enterprise tooling stack. "Engage a technical support specialist" is about having someone competent to call when something breaks — an on-demand service or your current IT provider satisfies it. Most of the rest is configuration you likely already have or can buy off the shelf in an afternoon.
How certification works without a consultant
The standard-setting body does not certify anyone — that separation is deliberate. DSI maintains the standard; certification is managed by authorised Dynamic Standard Certifiers, and CyberCert is currently the official certifier for SMB1001, providing the assessment platform and issuing the certificate when you meet the requirements (DSI).
So the path is: get your controls to Level 1, book an assessment through the certifier, answer what they ask, keep the evidence. A consultant can prepare you for that, and for a messier business one can be worth it — but for a sole trader with tidy systems, the gap between "here" and "Level 1" is usually a weekend, not a consultancy engagement.
Where the cost actually sits
Be careful with pricing claims in either direction. The USD $95 figure on DSI's site is the standard licence for the Individual/Micro tier (1–20 employees) — the licence to use the standard (DSI). The certification assessment is separate and priced by the certifier. What you are not paying for at this tier is the enterprise overhead: no ISMS documentation of ISO 27001's scale, no audit-prep retainer.
The human layer is smaller, not absent
With no staff, the "people risk" of a sole trader business is concentrated in one person — you. The Education and Training area of SMB1001 asks for ongoing security awareness, and for a one-person business that means your own habits: recognising invoice fraud, refusing MFA-fatigue prompts, keeping the backup routine honest.
This is also where the certification pays back personally. Short daily awareness training keeps those habits current against the threats actually circulating, and a monthly phishing simulation measures whether the reflex is real — the same human risk reporting discipline a twenty-person team runs, scaled to an audience of one.
How to get there without an IT consultant in 2026
- Run a gap assessment first. Score yourself against the controls before spending anything. Most sole traders discover they are already meeting half of Level 1 and the remainder is a shopping list, not a project.
- Close the technical basics. Firewall on, antivirus on all devices, automatic updates confirmed on, password routine in place, backups with a tested recovery.
- Line up a technical support arrangement. An existing IT provider or an on-demand service; the requirement is competence on call, not headcount.
- Write the small policy set. Level 1's Policies and Processes area is satisfied by short, real documents — a password policy, a backup routine, an incident plan of half a page.
- Put your own training on a cadence. Daily short lessons plus a monthly simulation, evidenced — because the Education and Training area is assessed like any other.
- Book the assessment. Through the authorised certifier, with your evidence ready. Then renew annually — SMB1001 updates every year, and your controls should track it.
Related questions sole traders ask
Is SMB1001 worth it for a one-person business?
It is if clients, insurers or tenders ask about your security. The certificate turns "trust me" into a third-party-verifiable answer, which is precisely what a sole trader cannot do alone.
What is the difference between SMB1001 and the Essential Eight?
The Essential Eight is an ASD mitigation framework; SMB1001 is a certifiable, tiered standard built for SMBs, aligned with recognised international practices. Small Australian businesses often start with SMB1001's lower tiers and step up.
Can I use SMB1001 as a step toward ISO 27001?
Yes — DSI positions SMB1001 as a pathway, with the lower tiers aligned to the foundations of frameworks like Cyber Essentials and the CIS Controls. If a client later demands ISO 27001, the groundwork is done.
Do I need to renew?
Yes — the standard updates annually and certification renews on that cycle, which is what keeps it meaningful to the people checking it.
FAQ
Can a sole trader get SMB1001 without an IT consultant? Yes. The standard's Micro tier starts at one employee, certification runs through an authorised certifier (CyberCert is the official one), and Level 1 needs basic controls plus a technical support arrangement — not a consultant.
What is the cheapest tier of SMB1001? The Individual/Micro licence tier for 1–20 employees, listed at USD $95 for the standard licence on DSI's site; the certification assessment itself is priced separately by the certifier.
What does SMB1001 Level 1 require? Per DSI: a technical support arrangement, a configured firewall, antivirus on all devices, automatic updates, routine password changes, and a backup and recovery strategy.
Does a sole trader need awareness training for SMB1001? Yes — Education and Training is one of the standard's five areas, and for a one-person business the audience is you. Short daily lessons plus a monthly simulation satisfy it and keep the habits real.
One last thing
The real reason sole traders fail at certification is not technical difficulty — it is stopping halfway through the control list. Book the assessment first, with a date attached, and the shopping list closes itself.