SMB1001 certification is renewed annually. Developed by Dynamic Standards International (DSI) and certified in Australia by CyberCert, the five-level standard (Bronze through Diamond) is designed so a certificate reflects an organisation's current security posture - not where it stood when it first passed. Here is exactly how the renewal cycle works, what happens if you let it lapse, and how to prepare for it without a fire drill.
TL;DR
- SMB1001 certification runs on an annual cycle: renewal means reassessing your controls against the standard and updating your evidence every 12 months.
- CyberCert's certification conditions require the certification process itself to be completed within 12 months of subscription purchase, and describe certificates as expiring and requiring recertification, with at least three months' notice in the process.
- Providers manage the renewal as part of ongoing programmes - Microsolve, for example, includes annual recertification for the duration of an engagement term.
- A lapsed certificate means recertifying before you can evidence compliance to a client, insurer or tender panel again.
- Awareness training is one of the controls assessed at every level, and it is the one that decays fastest between renewals - staff turnover outpaces any annual cycle.
How the renewal cycle works
SMB1001 is a five-level cyber security certification standard for small and medium businesses - Bronze, Silver, Gold, Platinum and Diamond - developed by Dynamic Standards International, with CyberCert operating the certification pathway as the Dynamic Standard Certifier. Australian providers describe the cadence consistently: InterIntra's SMB1001 guide states that "SMB1001 certification requires annual renewal to remain current" and frames the renewal as reassessing your controls against the standard and updating your evidence. Microsolve's SMB1001 programme page confirms the same cycle and adds the commercial detail that every renewal during an engagement term is included in the price.
The design logic is stated plainly by the provider community: annual renewal keeps the certification meaningful, because it reflects your actual security posture rather than where you were twelve months ago.
What CyberCert's conditions say
The certification side has its own clock. The downloadable CyberCert certification conditions (2024), summarised in Security Policy's SMB1001 guide, state that a purchased subscription must be completed within 12 months - so the assessment itself cannot drift indefinitely - and that certificates expire and require recertification rather than open-ended renewal, with at least three months' notice described in the conditions.
Two practical consequences:
- The assessment clock runs from purchase. An SMB1001 subscription that is never completed expires after 12 months. Buy when you are ready to be assessed, not to "hold the option".
- Diary the expiry, not just the anniversary. Because certificates expire and require recertification, the date that matters is the certificate's expiry, and the notice window starts before it. A renewal process discovered in the expiry month is a recertification scramble.
What happens if you let it lapse
Microsolve's page is blunt about the consequence: if certification is allowed to expire, you would need to recertify before you could evidence compliance to a client, insurer or tender panel again. A lapsed certificate is not a paused one - the evidence goes stale with it, and the reassessment starts over.
That matters most in the three places SMB1001 certificates actually get used: client security questionnaires, cyber insurance underwriting and tender panels. In each, the question is not "were you certified once" but "are you certified now".
What gets reassessed each year
The renewal re-tests the controls for your tier. Content varies by level, but the recurring themes are access control, patching, backups, multi-factor authentication, incident response and - the one this guide is about - security awareness training.
Training earns its place in the annual cycle because it behaves differently from the technical controls. Patching and backups can be evidenced with a screenshot of a standing configuration; awareness training is a repeated behaviour across a workforce that changes. Two things decay fastest between renewals:
- New starters. Every person hired after certification day has not been trained. By month twelve, a growing company can have a material share of staff who were never in the programme.
- Drift. Processes erode: the verification step before payment changes gets skipped, the reporting email address goes unwatched. Renewal is the forcing function that catches it.
Preparing for renewal without the fire drill
- Run training as a cadence, not an event. Monthly courses with automatic reminders keep completion continuous, so the renewal evidence is a report you generate, not a campaign you rebuild. Cyber Aware's security awareness training assigns courses on a monthly cadence with due and overdue reminders built in.
- Auto-enrol new starters on day one. If enrolment depends on someone remembering, the new-starter gap appears by definition. Directory sync or onboarding automation closes it; our guide to automated enrolment for scaling companies covers the pattern.
- Keep the register current. Per-person completion records with dates are what an assessor asks for. Human risk reporting keeps that record live and filterable by person and group.
- Rehearse the human controls quarterly. A quarterly phishing simulation proves the reporting reflex works in the month the assessor arrives, and phishing simulations auto-enrol clickers into remediation so the follow-up is already documented.
- Book the renewal at the start of the cycle. Given the notice periods in the certification conditions, the renewal assessment is scheduled months ahead by the organisations that never scramble.
Where the framework fits
SMB1001 is the small-business tier of Australia's certification landscape; organisations working with government or larger clients often run it alongside the Essential Eight. The two share ground - access control, patching, backups, MFA - and our Essential Eight maturity levels benchmark shows how that framework's levels are scored. If you are unsure which controls your current tier requires, a structured gap assessment maps your present posture against the framework and produces the evidence pack the renewal assessor starts from.
FAQ
How often must SMB1001 certification be renewed? Annually. The certification reflects your current posture, so controls are reassessed and evidence updated every 12 months.
Who renews it - my MSP or me? The certification is issued by CyberCert; your MSP or consultant can prepare evidence and manage the process, and many engagement terms include annual recertification, but the certificate is yours and so is the expiry date.
What is the difference between renewal and recertification? In provider practice they describe the same annual cycle. CyberCert's conditions describe certificates as expiring and requiring recertification - meaning the assessment is redone, not simply extended.
How much notice does renewal need? The certification conditions describe at least three months' notice in the recertification process - which is why diarying the expiry date, not the anniversary, is the safe habit.
Does awareness training count toward SMB1001? Yes - staff security awareness is among the controls assessed, and it is the one most affected by staff turnover between cycles.
One last thing
Pull up your current certificate and write its expiry date in the calendar with a 90-day reminder. The organisations that renew SMB1001 painlessly are the ones that treated the date as a project start, not a deadline.