SMB1001 is a cyber security certification standard built specifically for small and medium businesses. Developed by Dynamic Standards International (DSI) and certified in Australia by CyberCert, it takes the controls that actually stop most attacks on smaller companies - multi-factor authentication, patching, backups, staff awareness training - and arranges them into five progressive levels, from Bronze to Diamond. Instead of a framework written for enterprises and shrunk down badly, SMB1001 gives a 20-person business a certification path it can finish, afford and show to clients, insurers and tender panels.
TL;DR
- SMB1001 is a five-level certification (Bronze, Silver, Gold, Platinum, Diamond) developed by DSI for SMBs.
- CyberCert operates the certification pathway in Australia; the certificate is renewed annually.
- Lower levels are self-assessed and attested; higher levels add third-party auditing.
- Staff security awareness training is assessed at every level - and it is the control most SMBs have no evidence for.
- Certification pays its way in three places: client security questionnaires, cyber insurance and government tenders.
Why SMB1001 exists
Australia's two best-known security frameworks are a poor fit for small business. The Essential Eight was written to protect government systems; ISO 27001 assumes an information security management system with named owners, internal audits and a document register - a part-time job in a 15-person company. Meanwhile the attacks keep coming: the Australian Signals Directorate received more than 84,700 cybercrime reports in FY2024-25, roughly one every six minutes, and the average self-reported cost for a small business hit $56,600 per incident (ASD, Annual Cyber Threat Report 2024-25).
SMB1001 fills the gap: the same core controls, expressed in plain language, with a certification an owner can actually achieve. Its adoption has been driven less by the standard itself than by who now asks about it - procurement teams, insurers and larger customers who all need evidence that a small supplier takes security seriously.
The five levels
| Level | What it signals | Typical fit |
|---|---|---|
| Bronze | Core hygiene: MFA, backups, patching, awareness training | Every business starts here |
| Silver | Stronger controls and documented processes | Businesses handling client data routinely |
| Gold | Formalised risk management and incident response | Businesses in regulated supply chains |
| Platinum | Third-party audited controls | Government suppliers and larger tenders |
| Diamond | Full governance and continuous assurance | Businesses that need enterprise-grade evidence |
The practical rule: certify the level your buyers recognise. A professional services firm whose clients ask a security questionnaire at onboarding usually starts at Bronze or Silver; a company chasing government work moves to Platinum, where the assessment is audited rather than attested.
What gets assessed
The control set varies by level, but the recurring themes are the ones that map to how SMBs actually get breached:
- Multi-factor authentication on email, remote access and admin accounts.
- Patch cadence for operating systems, applications and network devices.
- Backups - tested, off-system copies, with a restore someone has actually performed.
- Email security and phishing resilience, including simulated phishing exercises.
- Access control - who has admin rights, and when were they last reviewed.
- Incident response - a written plan and a contact list that is current.
- Staff awareness training, with completion records.
That last one is where most first-time assessments lose points. Technical controls can be evidenced with a screenshot of a standing configuration; awareness training needs a running cadence across a workforce that changes. An assessor asks two questions - who has been trained, and when - and "we did a session last year" answers neither.
How certification works
- Prepare. Run a structured gap assessment against the level's control set so you certify something you can actually evidence.
- Subscribe and assess. Purchase through a certification body such as CyberCert. The certification process must be completed within 12 months of the subscription purchase - so buy when you are ready, not to hold the option.
- Certify. Lower tiers are attested; Platinum and Diamond add independent auditing.
- Renew annually. The certificate reflects your current posture, so controls are reassessed and evidence updated every 12 months. Providers such as Microsolve include annual recertification for the duration of an engagement term.
Let it lapse and the evidence goes stale with it: you would need to recertify before you could demonstrate compliance to a client, an insurer or a tender panel again.
Where the certificate earns its keep
- Client security questionnaires. The question is never "were you certified once" but "are you certified now" - a current certificate answers it in one line.
- Cyber insurance. Underwriters increasingly ask for evidence of controls at renewal; a certification mapped to a recognised standard is the cleanest answer.
- Tenders. Government and enterprise procurement increasingly weight verified cyber maturity - our guide to SMB1001 and government tenders covers how to present it.
How SMB1001 compares
| SMB1001 | Essential Eight | ISO 27001 | |
|---|---|---|---|
| Written for | Small and medium businesses | Australian government systems | Any organisation with an ISM team |
| Levels | 5 (Bronze-Diamond) | Maturity levels 0-3 | One standard, certification body audits |
| Cost and effort | Low - sized for SMBs | Moderate - needs a maturity uplift programme | High - management system plus audits |
| Best first step for an SMB | Yes | Only if government work requires it | Rarely at small size |
They are not competitors. An SMB can certify SMB1001 now and map the same evidence into the Essential Eight later if a contract demands it - the controls overlap heavily. Our Essential Eight maturity benchmark shows how that framework's levels are scored if you need both.
The control that decays fastest
Awareness training deserves its own paragraph because it behaves differently from every other control on the list. Patching and backups are standing configurations; training is a behaviour across people, and people change. Every hire after certification day is untrained by definition, and processes drift - the verification call before a payment change gets skipped, the report button goes unwatched.
The fix is cadence, not intensity: monthly short lessons plus phishing simulations, with human risk reporting keeping the per-person completion record the assessor asks for. Cyber Aware's awareness training runs that cadence automatically and exports the evidence pack - so the renewal is a report you generate, not a campaign you rebuild.
FAQ
What is SMB1001 in one sentence? A five-level cyber security certification standard for small and medium businesses, developed by DSI and certified in Australia by CyberCert, covering the controls that stop most SMB breaches.
Who certifies SMB1001? CyberCert operates the certification pathway as the Dynamic Standard Certifier; your MSP or consultant can prepare the evidence, but the certificate is yours.
How much does SMB1001 cost? It varies by level and provider - Bronze self-assessment is the cheapest tier, and audited levels cost more. Many MSPs bundle the certification into an ongoing security programme.
Is SMB1001 recognised by government? It is increasingly accepted as evidence of cyber maturity in procurement, but check the specific tender's requirements - some mandate the Essential Eight directly.
Does SMB1001 require staff training? Yes - staff security awareness is assessed at every level, with completion records, and it is the control most affected by staff turnover between annual renewals.
How long does certification take? A prepared business with current evidence can move through Bronze in weeks; the process must be completed within 12 months of subscribing either way.
One last thing
If you are reading this because a client questionnaire asked for "evidence of your cyber security posture", start with a gap assessment against the Bronze control set - it is the same questionnaire, scored, and it tells you exactly how far away the certificate is.