SMB1001 certification runs on five levels - Bronze, Silver, Gold, Platinum and Diamond - and each tier adds requirements on top of the one before it. The benchmark most Australian small and mid-sized businesses size against is Gold: director-attested, roughly 27 cumulative requirements under the 2026 edition, and the level supply chains most often ask for.
TL;DR
- SMB1001 has five levels: Bronze, Silver, Gold, Platinum and Diamond, certified through CyberCert against the annually revised SMB1001:2026 edition.
- Bronze through Gold are director-attested; Platinum and Diamond require an independent audit by an Independent Verification Organisation (IVO).
- Cumulative requirements climb from about 7 at Bronze to the full 39 at Diamond - each tier includes everything in the tier below it.
- Gold is the practical benchmark for Australian SMBs: EDR on every device, enforced DMARC and mandatory cyber insurance all arrive at this tier.
Why this matters
Choosing an SMB1001 level is a scoping decision: certify too low and buyers will not accept the certificate, aim too high and you pay for audit depth you do not need. A cyber security gap assessment against the standard's five areas shows which tier you can realistically evidence today, before you commit to a level.
SMB1001 certification levels at a glance
| Level | Tier | Verification | Cumulative requirements | What it adds |
|---|---|---|---|---|
| 1 | Bronze | Director attestation | ~7 | Foundational security hygiene for the smallest teams |
| 2 | Silver | Director attestation | ~17 | Stronger access and email controls; SPF becomes mandatory in the 2026 edition |
| 3 | Gold | Director attestation | ~27 | EDR on every device, DKIM plus enforced DMARC, cyber insurance, formal incident response plan |
| 4 | Platinum | Independent audit (IVO) | ~32 | Third-party verified controls for higher-assurance buyers |
| 5 | Diamond | Independent audit (IVO) | 39 | The full standard - 39 requirements across all five areas |
Cumulative counts come from independently tracked SMB1001 requirement totals (CyberGrape, accessed October 2026): each tier includes the one before it, so the running totals are 7, 17, 27, 32 and 39. CyberGrape counts 52 control codes because enhanced variants of a requirement are tracked separately - the underlying standard has 39 requirements.
Bronze: the entry tier
Bronze is Level 1 and the smallest commitment: roughly seven requirements covering foundational hygiene across the standard's five areas - technology management, access management, backup and recovery, policies and processes, and education and training. Director attestation means a company director self-certifies the controls are in place; no external audit sits behind the claim.
Best for: micro-businesses and sole traders who need a recognised certificate quickly. For a one-person business, the Micro tier starts at a single employee.
Silver: where email controls harden
Silver is Level 2 at roughly seventeen cumulative requirements. The 2026 edition makes SPF email authentication mandatory from Silver upwards, which matters because email is the entry point for most attacks on small teams.
Best for: small businesses whose clients ask for evidence beyond basics but who are not yet handling high-sensitivity data at scale.
Gold: the practical benchmark
Gold is Level 3 at roughly twenty-seven cumulative requirements, and it is where the framework gets serious. Under the 2026 edition, Gold adds endpoint detection and response on every device, DKIM email signing with DMARC enforced at quarantine or reject, mandatory cyber insurance, a formal incident response plan, a digital asset register and ongoing staff security awareness training. Australian providers implementing the standard commonly recommend Gold as the baseline for businesses handling client data.
Best for: Australian SMBs in supply chains and tender processes where buyers want genuine maturity evidenced, not just a policy binder.
The training control deserves attention: Gold requires ongoing awareness training, and it is the control that takes months to evidence properly. A monthly training cadence with human risk reporting produces the completion records and phishing results that show the control operating over time - the difference between a checkbox and an audit trail.
Platinum and Diamond: independently verified
Platinum (Level 4, roughly 32 requirements) and Diamond (Level 5, the full 39) both require an independent audit by an Independent Verification Organisation. Director attestation is replaced by third-party checking, which is what makes these tiers meaningful to enterprise buyers and higher-assurance government work.
Best for: businesses whose contracts name independent verification, or who are working toward ISO 27001 and want the audit discipline in place first.
Every tier is valid for 12 months, and certification renews annually against the current edition of the standard - SMB1001 is revised every year, so a 2025-edition certificate is not a 2026 one.
How to choose your level
- Ask what your buyers require. Match the tier to the tender or contract language - some supply chains already mandate a minimum level before contracting.
- Run a gap assessment first. Map your current controls to the five areas; the distance to each tier tells you the real cost of certifying at that level.
- Close the training gap early. Education and training evidence accrues over months, so start the cadence before attestation or audit.
- Budget for annual renewal. Certification lapses at 12 months; renewal is a review against the new edition, not a fresh start.
Red flags in a level choice
Whichever tier a business targets, three signals usually mean the choice needs a second look:
- The level was picked before the gap assessment. If the gap assessment has not been run, the level is a guess; the distance between current controls and each tier is the only reliable input.
- Controls are promised for after certification. Attestation means the controls are in place on the day the director signs. Controls that are "nearly finished" cannot be attested, and audit-based tiers verify the same way.
- The buyer's requirement is unknown. Certifying Diamond when supply chains ask for Gold spends audit budget on depth nobody requested; certifying Silver to save cost when buyers already mandate a minimum level means re-certifying within months.
Fixing any of these before certification is cheap. Fixing them after a failed tender response or a lapsed renewal is not.
FAQ
What are the five SMB1001 certification levels? Bronze, Silver, Gold, Platinum and Diamond. Bronze through Gold are director-attested; Platinum and Diamond require an independent audit through an Independent Verification Organisation.
Which SMB1001 level should a small business get? Gold is the benchmark most Australian small businesses target: about 27 cumulative requirements under the 2026 edition, including EDR, enforced DMARC and cyber insurance, and it is the level supply chains most often ask for.
How many requirements does SMB1001 have in total? The standard carries 39 requirements across the five tiers, with cumulative totals of roughly 7, 17, 27, 32 and 39 - each level includes the level below it.
Does SMB1001 certification expire? Yes. Every tier is valid for 12 months and renews against the current, annually revised edition of the standard.
Sources
- DSI SMB1001 FAQ (dsi.org/faqs, accessed 2026-10-24) - five levels, five areas, tier structure
- CyberCert certification levels (cybercert.ai/en-us/certify, accessed 2026-10-24) - Bronze to Diamond tiers, verification modes
- CyberGrape SMB1001 tracking (cybergrape.io/smb1001, accessed 2026-10-24) - cumulative requirement counts, 12-month validity
- Epic IT SMB1001:2026 guide (epicit.com.au, accessed 2026-10-24) - 2026-edition Gold additions and edition release timing