What is SMB1001?
SMB1001 is a multi-tiered cyber security certification standard for small and medium businesses. It’s published by Dynamic Standards International (DSI), an Australian-founded not-for-profit formerly known as Cyber Security Certification Australia, and is now offered as an international edition.
It fills the gap many businesses fall into: you need to show customers, insurers or tender panels that you take security seriously, but a full ISO 27001 program is more than your business needs or can resource. SMB1001 gives you a recognised certificate at a level that matches your size and risk, and a clear path to the next one.
Unlike most standards, SMB1001 is a “dynamic” standard. DSI updates it every year so the controls keep pace with current threats, and it’s mapped to established frameworks including the CIS Controls and the UK’s Cyber Essentials.
“No one starts with a black belt. SMB1001 lets you earn your colours one tier at a time — and show your customers each step.”
Five tiers, from Bronze to Diamond
The tiers are cumulative. Each one includes every control from the tiers below it and adds more, so progress always builds on what you’ve already done.
- Level 1 · Bronze
- Foundational cyber hygiene. The essentials every business should have, such as technical support, a firewall, antivirus on all devices, automatic updates and a backup and recovery strategy.
- Level 2 · Silver
- Stronger access and process controls. Builds on Bronze with tighter account security, more defined processes and broader staff awareness.
- Level 3 · Gold
- A mature, well-documented baseline. A common target for businesses that handle sensitive client data or supply larger organisations.
- Level 4 · Platinum
- Independently audited. An external assessor verifies your controls before certification is issued.
- Level 5 · Diamond
- The highest tier. For higher-risk environments that need the most comprehensive, independently verified controls.
How each tier is verified. At Bronze, Silver and Gold you attest that the controls are in place, backed by supporting evidence. Platinum and Diamond require an independent audit.
Five areas of control
Every SMB1001 requirement sits in one of five plain-language areas, which makes it easier for owners and staff to understand what’s being asked and why.
- Technology management
- Firewalls, antivirus and endpoint protection, software updates and patching, secure device configuration and email security.
- Access management
- Passwords, multi-factor authentication, admin accounts and making sure people only have the access they need.
- Backup and recovery
- Backing up important data and systems, keeping copies safe, and testing that you can actually restore them.
- Policies and processes
- Documented ways of working, such as incident response, onboarding and offboarding, and supplier management.
- Education and training
- Cyber awareness for staff, including recognising scams and phishing, appropriate to your tier.
How SMB1001 certification works
DSI maintains the standard but doesn’t issue certificates itself. Certification is handled by authorised Dynamic Standard Certifiers, currently CyberCert, which runs the online assessment platform and issues certificates.
- Step 1 · Choose a tier
- Pick a target based on your risk, your data and what customers, insurers or tenders are asking for.
- Step 2 · Gap review
- Compare your current setup with the tier’s requirements and list what needs to change.
- Step 3 · Implement
- Put the missing controls in place across your devices, accounts, backups, policies and training.
- Step 4 · Evidence
- Collect screenshots, reports and documents showing each control is in place and working.
- Step 5 · Certify
- Complete the assessment through the certifier: attestation for Bronze to Gold, independent audit for Platinum and Diamond.
- Step 6 · Maintain
- Keep controls running and recertify as the standard updates each year, stepping up a tier when you’re ready.
How SMB1001 compares
SMB1001 sits between the technical baseline of ASD Essentials and the full management system of ISO 27001. Many businesses use it as their certifiable proof point while following ASD Essentials for priorities.
| SMB1001 | ASD Essentials | ISO 27001 | |
|---|---|---|---|
| Built for | Small and medium businesses | Australian organisations of all sizes | Organisations of any size, typically larger |
| Published by | Dynamic Standards International | Australian Signals Directorate | ISO and IEC |
| Structure | Five cumulative tiers, Bronze to Diamond | Principles, actions and domains in priority phases | Management-system clauses plus 93 Annex A controls |
| Certificate | Yes, through an authorised certifier | No certificate; assessed by domain | Yes, through an accredited certification body |
| Verification | Attestation at tiers 1–3; audit at tiers 4–5 | Self or third-party assessment | Two-stage external audit, then annual surveillance |
| Updates | Every year | Updated by ASD as threats change | Periodic revisions (current edition 2022) |
| Effort and cost | Low to moderate | Varies by environment | Highest |
The controls overlap heavily, so work done for SMB1001 counts towards ASD Essentials and CIS and ISO 27001 alignment too. SMB1001 is a private-market certification rather than a government-mandated standard, so check what a specific customer, insurer or tender actually requires.
How EduCom IT helps with SMB1001
The standard is written in plain language, but the controls still need to be configured, evidenced and kept running. We do that work across Microsoft 365, Microsoft Intune, Jamf and the other platforms you already use.
- Tier advice
- Recommend the right target tier based on your data, customers, insurance and tender requirements.
- Gap review
- Assess your environment against the tier’s requirements and give you a clear, prioritised list of changes.
- Implement
- Firewalls, endpoint protection, patching, MFA, admin account controls, email security and backups, set up properly.
- Policies
- Plain-English policies and processes written for how your business actually works.
- Training
- Huntress Security Awareness Training deployed to your staff: short, engaging lessons and simulated phishing, with completion reporting you can use as certification evidence.
- Evidence
- Gather and organise the evidence needed for attestation or audit, so certification goes smoothly.
- Sustain
- Ongoing management so controls stay in place between certifications and as the standard updates.
A realistic path to certification
Most businesses start at Bronze, which is usually achievable quickly with the right IT support in place, then step up to Silver or Gold as customers and insurers ask for more. If ISO 27001 is on the horizon, SMB1001 work gives you a strong head start.
- Foundations in MFA and endpoint protection.
- Connects to backup and recovery readiness.
- Aligned with ASD Essentials priorities.
- A stepping stone to CIS and ISO 27001 when you need them.
Frequently asked questions
What is SMB1001?
A multi-tiered cyber security certification standard for small and medium businesses, published by Dynamic Standards International. It has five cumulative tiers — Bronze, Silver, Gold, Platinum and Diamond — and is updated every year.
Which tier should we aim for?
Most businesses start with Bronze. If you handle sensitive client data, supply larger organisations or face specific customer or insurer requirements, Silver or Gold is usually the right target. Platinum and Diamond suit higher-risk environments that need independent verification.
Who issues the certificate?
DSI maintains the standard but doesn’t certify businesses directly. Certificates are issued by an authorised Dynamic Standard Certifier, currently CyberCert.
Is SMB1001 audited?
At Bronze, Silver and Gold you attest that the controls are in place with supporting evidence. Platinum and Diamond require an independent audit before certification is issued.
Is SMB1001 required by law?
No. It’s a private-market certification, not a legislated standard. It’s increasingly requested by customers, supply chains and insurers as evidence of good cyber security, so check what your specific contracts or tenders ask for.
How does SMB1001 relate to ASD Essentials?
They complement each other. ASD Essentials, the successor to the Essential Eight, sets priorities for Australian organisations but doesn’t offer a certificate. SMB1001 gives you a certificate you can show customers. The controls overlap, so one body of work supports both.
Should we choose SMB1001 or ISO 27001?
It depends on who’s asking. SMB1001 is faster and more affordable for smaller businesses. ISO 27001 is the global benchmark and is sometimes required by larger enterprise or government contracts. Many businesses start with SMB1001 and move to ISO 27001 later.
How long does it take?
It depends on your starting point and target tier. Bronze can often be reached in weeks if your IT basics are already in place. Higher tiers take longer, especially Platinum and Diamond with their external audit. We’ll give you a realistic timeline after a gap review.
Do you do the implementation, or just the assessment?
Both. We can run the gap review and hand it over, or implement and manage the controls across Microsoft 365, Intune, Jamf and the other platforms we support.