SMB1001 certification is worth it for most Australian small businesses that answer contracts, insurers or enterprise clients asking about their security posture — and it is worth less if nobody is asking. The certification was built by Dynamic Standards International (DSI) specifically for businesses with 5 to 200 staff, and in its 2026 edition it starts at a Bronze tier that is achievable for a small team in weeks, not months. This guide gives the honest cost-versus-benefit picture for 2026.
What SMB1001 actually is
SMB1001 is a tiered cyber security certification standard maintained by DSI, with certification delivered through the CyberCert platform. Instead of one all-or-nothing audit like ISO 27001, it has five progressive tiers:
| Tier | Assurance | Who it suits |
|---|---|---|
| Bronze | Self-attested | Businesses proving a security baseline exists |
| Silver | Self-attested | Stronger identity, email and backup controls |
| Gold | Self-attested | A fuller 27-control program across people, process and technology |
| Platinum | Independent audit | Defence supply chains, critical infrastructure |
| Diamond | Independent audit | Businesses progressing toward ISO 27001 |
Bronze, Silver and Gold are self-attested: a director signs off through the CyberCert portal that the controls are in place. Platinum and Diamond require an external audit. The standard is updated annually — the current edition is SMB1001:2026 — and certification is an annual rhythm, not a one-time certificate.
One 2026 change matters for anyone reading this site: staff cyber awareness training moved into the Bronze tier. A business cannot self-attest Bronze without proving its people are trained.
The case for: when it pays for itself
Contracts and procurement. Enterprise and government clients increasingly ask suppliers to evidence their security posture. A recognised certification answers the security questionnaire in one line instead of a weekend of form-filling. For an SMB chasing its first large client, that can be the difference between making and missing the vendor list.
Cyber insurance. Insurers are scrutinising SMB security harder. Documented controls and a current certification support both the application and the claim. The Australian Government's Cybersecurity Strategy (2023-2030) explicitly calls for strengthening SMB security resilience, which pushes insurers and MSPs toward certifiable outcomes.
The threat numbers. Australian organisations reported more than 84,700 cybercrime incidents to ASD in FY2024-25 — one every six minutes — and small businesses lost an average of $56,000 per incident. Against that, the cost of implementing Bronze-level controls (MFA, backups, patching, trained staff) is modest, and most of those controls pay for themselves in avoided incidents regardless of certification.
A path, not a cliff. Because tiers build on each other, a business can start at Bronze this quarter and reach Gold within a year as it grows. That is far cheaper than jumping straight to ISO 27001.
The case against: when it is not worth it yet
Nobody is asking. If no client, insurer or regulator has raised security, the certification itself buys little. The controls are still worth doing; the paperwork can wait.
Self-attestation limits. Bronze through Gold rest on a director's signature. A sophisticated enterprise buyer may still require an externally audited standard (Platinum, Diamond or ISO 27001). Know what your market demands before paying for a tier that does not satisfy it.
The gotcha: controls without adoption. A policy nobody reads and training nobody completes will pass a self-attestation but fail a real attack. Certification rewards evidence; resilience requires behaviour. If your last phishing test fooled a third of the office, fix that before you certify anything.
What it costs to get there
Costs have three parts: the CyberCert certification fee (tier-dependent, annual), implementation effort (most of the work is documentation, MFA, backups and email security your MSP can do), and training. Training is the part most businesses underestimate — and the part the 2026 edition made mandatory at Bronze.
A practical sequence:
- Run a security gap assessment to see how far you are from Bronze and Silver controls.
- Implement the technical basics with your IT provider.
- Put staff through security awareness training and keep evidence of completion — this is a Bronze-tier requirement in 2026.
- Add phishing simulations to prove the training works, not just that it happened.
- Self-attest on CyberCert and set a recurring annual date for recertification.
How to decide
Ask three questions. First: has a client, insurer or tender asked about your security in the last 12 months? If yes, certification is close to mandatory commercial hygiene. Second: would a $56,000 loss hurt enough to change behaviour? If yes, the controls justify themselves even without the certificate. Third: can you evidence training completion today? If not, start there — it is both the cheapest control and the 2026 Bronze requirement.
If you are an MSP weighing certification for your whole client base, the platform comparison shows how training platforms differ on evidence and reporting — and human risk reporting turns training data into the evidence pack a recertification needs.
FAQ
How long does SMB1001 certification take?
Bronze can be achieved in weeks for a business that already has MFA, backups and basic policies. Silver and Gold take longer as control lists grow. Plan for an annual cycle, not a project with an end date.
Is SMB1001 recognised by government and enterprise?
It is increasingly used in Australian supply chains and by MSPs, and it maps to the government's push for SMB resilience. Recognition varies by buyer — always check what the specific contract or insurer requires.
Do I need an external audit?
Not for Bronze, Silver or Gold — those are self-attested through CyberCert. Platinum and Diamond require an independent audit.
Is training really mandatory for Bronze in 2026?
Yes. The SMB1001:2026 edition moved staff cyber awareness training into the Bronze tier, so self-attestation requires evidence that staff have been trained.
SMB1001 or ISO 27001 — which should a small business choose?
Start with SMB1001 unless a contract specifically requires ISO 27001. It is cheaper, tiered, and built for businesses of 5-200 staff; Diamond tier later provides a stepping stone if you outgrow it.
One last thing
Before you pay any certification fee, check which tier your largest client's security questionnaire actually requires. Certifying one tier above what your market demands is spend without a return; one tier below is a certificate that does not open the door.