SMB1001 Certification
with a CyberCert Partner

SMB1001 is an Australian cyber security standard for small and medium businesses, written by Dynamic Standards International. Certification against it is issued through CyberCert. Tiers run from Bronze upwards, each adding controls to the one before. The standard is reviewed every year, and the current edition is SMB1001:2026.

A standard. Dynamic Standards International, an independent standards body, publishes SMB1001 with set requirements for each tier, and certifiers it accredits, such as CyberCert, certify businesses against it. Frameworks such as the ASD Essentials, and the Essential Eight it is superseding, work differently: they guide what to do and measure progress, with no certificate. Because SMB1001 is a standard, your certification is something clients, insurers and tender panels can check for themselves on CyberCert’s public register.

It depends on who is asking and what data you hold. Bronze covers the basics and Silver tightens accounts and email. Gold adds monitoring, written plans and governance, and suits businesses that hold sensitive information or face detailed client, tender or insurer requirements.

It depends on your starting point. A business with multi-factor authentication, patching and backups already in place moves much faster. After the readiness assessment we give you a timeline for your target tier and start on the most urgent gaps.

For most small and medium businesses, SMB1001. It covers the whole business, its controls can be met on Microsoft 365 or Google Workspace, Windows or Mac, and it gives you a certificate to show clients and insurers. The Essential Eight, which ASD is superseding with the ASD Essentials, is worth adding when a government client or contract still asks for it. See Essential Eight vs SMB1001 for the full comparison.

ISO 27001 is an international standard for information security management for organisations of any size, built around a full management system. SMB1001 was written for small and medium businesses and uses tiers so you can start small. We refer ISO 27001 projects to trusted Australian GRC specialists.

It helps you answer the questions insurers ask. Gold includes controls they look for, such as multi-factor authentication, EDR, backups and an incident response plan, and certification backs your answers with evidence. Cover and premiums remain your insurer’s decision.

Yes. Certification is renewed annually and the standard is updated each year. For clients we manage, we keep controls running, update policies as the standard changes and prepare renewal evidence before it is due, so renewal is ready on time.

It depends on your target tier and how many gaps need closing. If you are already on our managed IT services, some of the work may already be done. We quote before any work starts, and the first assessment is free.