SMB1001 certification can be reached in a matter of weeks at the entry tiers: published comparisons put Bronze and Silver at roughly two to four weeks each for a business with its basics already in order, Gold at four to eight weeks or more, and the externally audited Platinum and Diamond tiers at three to six months. What actually sets your timeline is not the standard - it is how much of the control evidence already exists in your business before you start.
That last point is the one most "how long does it take" answers miss. SMB1001 is not a course you complete or a box you tick once; it is a set of controls a certifying body checks your business against. If your Microsoft 365 tenant already has multi-factor authentication enforced and your patches are current, most of the Bronze effort is documenting what you already do. If nothing is documented, the same tier takes considerably longer - not because the standard is harder, but because you are building the evidence at the same time.
TL;DR
- SMB1001 has five tiers - Bronze, Silver, Gold, Platinum and Diamond - and you certify at the tier that matches your size and risk, so the timeline is per tier, not one fixed number.
- Published comparisons put Bronze at roughly 2-4 weeks (some Australian providers say 20-30 days for a business with an existing Microsoft 365 environment) and Silver at a similar span.
- Gold runs roughly 4-8 weeks of preparation; the externally audited tiers, Platinum and Diamond, take roughly 3-6 months including the audit itself.
- Certification is valid for 12 months, so this is an annual rhythm, not a one-off project.
- Your starting posture - what is already configured, documented and evidenced - matters more than the tier number.
What SMB1001 is, in one paragraph
SMB1001 is a multi-tiered cyber security certification standard built specifically for small and medium businesses. It was developed by Dynamic Standards International (DSI) and is certified through certification bodies including CyberCert, an Australian-based conformity assessment body. Rather than one all-or-nothing audit, it uses five progressive tiers, so a business can certify at a level that matches its size, risk and budget, then climb over time.
The tiers differ in two ways: how many controls apply, and who checks them. The lower tiers are self-assessed - you attest that the controls are in place. The upper tiers involve independent verification of your claims. One published tier comparison counts the controls as 7 at Bronze, 17 at Silver, 27 at Gold, 32 at Platinum and 39 at Diamond, which is why each step up takes longer than the last.
Published timelines by tier
Timelines vary by source because they depend on starting posture, but the published estimates cluster into a recognisable pattern:
- Bronze. One published tier comparison puts Bronze at 2-4 weeks. Australian providers working with the standard report that a typical small business with an existing Microsoft 365 environment reaches Bronze in roughly 20-30 days, because the work is mostly configuring and evidencing controls that many businesses assume are already in place but have never verified.
- Silver. A similar span once Bronze is done - comparisons put it at 2-4 weeks, with some organisations adding four to eight weeks depending on how much policy work the extra controls require. Silver introduces controls such as MFA on email and password management for privileged users.
- Gold. Published estimates range from 4-8 weeks to one-to-three months or more. Gold adds controls like an all-staff password manager, email anti-spoofing (SPF, DKIM and DMARC), a formal cyber security policy and an incident response plan - the first tier where written governance really enters the picture.
- Platinum and Diamond. These are the independently audited tiers, and estimates run to roughly 2-3 months and 3-6 months respectively, with timing partly driven by auditor availability and how many findings are raised.
What actually determines your timeline
Three variables explain nearly all of the spread between those ranges:
- Your starting posture. If MFA is enforced, patches are current and basic policies exist, the work is evidence-gathering. If none of it exists, you are implementing controls first and documenting them second - which can multiply the effort.
- Self-assessment versus independent audit. The self-assessed tiers move as fast as you can compile evidence. The audited tiers add a third party's schedule to your critical path, and audit findings extend the timeline until they are closed.
- Who is running the project. Businesses attempting certification alone routinely spend weeks working out what evidence is even required before presenting anything to a certifier. An MSP or consultant who knows the standard collapses that discovery phase - though to be clear, the certifying body remains a separate organisation; your IT provider helps you prepare, but does not certify you.
A realistic sequence for a small business
For most Australian SMBs, the practical path looks like this:
- Week 0: gap assessment. Before committing to a tier, find out how far away you actually are. A structured gap assessment against the target tier's controls turns "we think we're close" into a scored list of what is missing.
- Weeks 1-4: Bronze. Configure and evidence the entry-tier controls, submit the self-assessment, receive the certificate.
- Following months: Silver, then Gold. Each tier builds on the previous one, and the controls compound - Gold's email anti-spoofing and password manager requirements assume Silver's MFA is already in place.
- Annually: re-certify. Certificates are valid for 12 months, so the second year costs less than the first - the controls are live and the evidence routine already exists.
Where the human layer fits
Nearly every control set above is technical: MFA, patching, email security, password management. But the majority of successful attacks on small businesses still arrive through people - a convincing email, a rushed click, a well-timed request. Certifying your controls does not certify your people, and auditors know the difference between a policy document and a workforce that follows it.
That is where the training cadence matters: if staff do not know how to report a suspicious email, the incident response plan you documented for Gold is a PDF, not a process. Pairing certification work with a structured security awareness training programme means the human side of the standard is evidenced by behaviour, not paperwork - and phishing simulations give you the before-and-after numbers to show it.
Common mistakes that stretch the timeline
- Starting without a gap assessment. Businesses that skip this discover mid-project that a core control is missing entirely, which restarts the clock on the affected tier.
- Targeting too high a tier first. Jumping straight to Gold because a tender asked for it usually means implementing Silver's controls anyway - just without the intermediate certificate to show for the effort.
- Treating evidence as an afterthought. The self-assessed tiers are passed on evidence, not on good practice. A control that works but is undocumented fails.
- Ignoring the audit window. For Platinum and Diamond, certifier availability is part of your timeline. Book the audit before you finish remediation, not after.
- Letting the certificate lapse. The 12-month validity catches businesses off guard; set the re-certification date the day the first certificate arrives.
FAQ
Is Bronze really achievable in a month? For a small business with a reasonably maintained Microsoft 365 environment, published guidance says yes - roughly 20-30 days is a common estimate, because most of the work is verification and evidence rather than new implementation.
Which tiers require an external audit? Platinum and Diamond. Bronze, Silver and Gold are self-assessed - you attest to the controls, and the certification body issues the certificate on that basis.
How long is the certificate valid? 12 months. Re-certification is an annual rhythm, and it gets faster each year as the evidence becomes routine.
Does SMB1001 replace the Essential Eight? No. SMB1001 is designed for small and medium businesses and is tier-based; the Essential Eight is an Australian government mitigation framework. Some businesses align to both - they answer different questions for different audiences.
Can I certify without an IT provider? You can, and the self-assessed tiers make that viable. But a provider who knows the standard typically shortens the timeline by eliminating the guesswork about what evidence is required - while the certification itself remains with the certifying body.