Prove your business takes cyber security seriously.

It's an Australian cyber security standard made for small and medium businesses. Rather than one pass-or-fail, it grades your security across five levels (Bronze, Silver, Gold, Platinum, Diamond) and five practical areas: technology, access, backup & recovery, policies, and training. It's published by Dynamic Standards International (DSI), certified through CyberCert, and updated every year (the current edition is SMB1001:2026).

There are five, and each one includes everything in the level below it: Bronze (Level 1), Silver (Level 2), Gold (Level 3), Platinum (Level 4) and Diamond (Level 5). Bronze, Silver and Gold are certified on a signed director's attestation. Platinum and Diamond add an independent external audit. For most small and medium businesses, Silver or Gold is the right target.

Bronze is Level 1, the entry point. It covers the basic protections every business should already have, and it's a fair first step if you're starting from nothing. We don't deliver Bronze on its own, because Silver includes everything in Bronze and adds consistent everyday protection, like multi-factor authentication on email and a password manager. If you're going to do the work, Silver is usually the better first target.

No. SMB1001 is voluntary and industry-recognised; it isn't legislated or formally mandated by government. But clients, insurers and tenders increasingly want to see that you follow a recognised framework, and SMB1001 is a practical, affordable way for a smaller business to show exactly that.

Silver is consistent everyday protection: multi-factor authentication on email, a password manager, individual user accounts, secured email and core policies. Gold builds on that with proactive defence: active threat detection (EDR) on all devices, MFA across all key apps and remote access, enforced email security (DKIM & DMARC), a written cyber security policy, a formal incident response plan, a digital asset register, staff training and a responsible-AI-use policy.

Bronze is bare-minimum basics, and the top tiers (Platinum and Diamond) add independent audits aimed at larger or regulated organisations. For most small and medium businesses, Silver or Gold is the right balance of real protection and cost, so those are the two levels we focus on and deliver properly.

You don't need an auditor for Bronze, Silver or Gold. They're certified on a signed director's attestation that the required controls are in place. Independent third-party audits apply at the higher Platinum and Diamond levels. What actually protects your business is genuinely having those controls in place and keeping them current, which is exactly what we put in place and manage for you all year.

SMB1001 is complementary to the ACSC Essential Eight. It wraps similar technical controls in policies, oversight, training and incident response, and lets you build up tier by tier. It's also a practical stepping stone toward ISO 27001. It isn't equivalent to, or a replacement for, either. Think of it as the right-sized starting point for a growing business.

An SMB1001 certification is valid for 12 months and is renewed each year against the current edition of the standard. We keep your controls in place throughout the year, so staying certified is just business as usual rather than a yearly scramble.

There are two costs. The first is the annual certification fee paid to CyberCert, which depends on the level. CyberCert publishes its current fees. The second is the work of getting the required protections in place and keeping them there, and that depends on where you're starting from. A business with good basics already has less to do. That's why we start with a free Security Scorecard: you see the gaps and the plan before you commit to anything.