Whitepaper
SMB1001:2026: what each of the five tiers asks of a small business
SMB1001:2026 sets five cumulative levels of cyber security for a small or medium business, Bronze to Diamond. A director attests to the first three and an external auditor checks the top two. The controls at each level in the publisher’s words, and the work a firm faces to reach the one its customers ask for.
- Standard of 1 Sep 2025, practice statement of 10 Jul 2026
- First published 21 Jul 2026, this edition 29 Oct 2026
- PDF, 7 pages, 230 KB
- BS-RPT-10, version 1.2
Executive summary
SMB1001:2026 has five levels, Bronze, Silver, Gold, Platinum and Diamond, numbered Levels 1 to 5, and each level carries every control of the levels below it. Dynamic Standards International released SMB1001:2026 on 1 September 2025.
Bronze, Level 1, asks for 7 controls: a technical support specialist, a firewall, antivirus on every device, automatic patching, strong password hygiene, a backup and recovery strategy, and cyber security awareness training for all employees.
Gold, Level 3, carries 27 controls in total, the count printed on our own SMB1001:2026 Gold certificate. A director attests at Levels 1 to 3; an external audit joins the attestation at Levels 4 and 5.
The standard is written for the business that has never been asked to show its security before. Bronze is a short list a sole trader can complete with its IT provider. Gold is where a buyer, an insurer or a government panel starts to read the certificate as evidence, because it reaches governance: policies, an incident response plan, detection on every endpoint and authenticated email. Platinum and Diamond are for the firm whose customers want an auditor’s signature.
The practical question for a small firm is which level the people who pay it will ask for, and how far its current controls sit from that level. A firm that runs its email in a hosted suite with a managed IT provider usually has part of Bronze and Silver in place without naming it. What is missing is the evidence, and the handful of controls that need a decision from the owner.
- Find out which level your customers, your insurer and your contracts name, and aim at that one.
- List the controls at that level against the systems that enforce them, and write down what proves each one.
- Treat Gold as the level that buyers read; above it, book the auditor before the work starts.
Whitepaper
The figures
The five levels of SMB1001:2026
What to do
The order below is the one we run for a firm aiming at Gold. A firm aiming at Bronze stops after the fourth step.
- Ask your largest customers, your insurer and your contracts which level they name, and set the target at the highest of them.
- Write the control list for the target level in a single sheet, one row per control, with the system that enforces it and the artefact that proves it.
- Close the installable gaps first: the firewall, antivirus on every device, automatic patching, a password manager with multi-factor authentication, and a backup with an off-site copy and a tested restore.
- Run the awareness training, keep the attendance list, and put the next session in the calendar.
- Write the policies the target level asks for in plain words your staff will read, adopt them at a board or owner meeting, and date them.
- Deploy endpoint detection and response and set up the email authentication settings before the policy that refers to them is signed.
- Assemble the evidence pack against the control numbers, then subscribe through the issuer, attest, and put the renewal date in the calendar a year out.
- For Platinum or Diamond, engage the auditor before the remediation starts, so the fieldwork is planned around your dates.
We hold SMB1001:2026 Gold, issued by CyberCert, and we run the same program for clients: a gap review against the target level, remediation sequenced to the date the certificate is needed, the policies the standard asks for, and an evidence pack built against the control numbers for the director’s attestation or the auditor’s fieldwork. A scoping call settles the level and the quote before any work starts.
Method
We read the publisher’s public page for the 2026 edition and print the five levels and their descriptions as Dynamic Standards International states them. The Bronze controls come from the Level 1 certification requirements workbook CyberCert publishes; the Gold count comes from the certificate issued to us, which carries it. The full control text of the standard is a licensed document, so the control counts at Silver, Platinum and Diamond are not printed; the description of each of those levels is the publisher’s own, and the controls each adds are as the issuer’s published tier descriptions state them.
The verification rules come from CyberCert’s certification practice statement, version 1.1 of 10 July 2026, and its site copy: who attests at which level, when an audit is required, and how long a certificate runs. Every SMB1001 certificate is valid for 12 months and names the edition of the standard it was issued against.
To use the levels in your own business, start from the end. Ask the three parties who can refuse you work what they expect: a contract clause, an insurance proposal form and a tender questionnaire each name a level or describe one without naming it. The highest of those is the target.
Then read each control at the target back from the system that enforces it. A firewall is proved by its configuration export; automatic patching by the update policy and the last patch date on each device; a backup strategy by the schedule, the location of the copy and the date of the last restore test. A control with no artefact behind it cannot be attested.
Where a control is missing, the gap is usually a decision and a few hours of work. Where the control is a process, such as awareness training or an incident response plan, the gap is a calendar entry and an attendance list.
BS-RPT-10, published 21 Jul 2026, revised 29 Oct 2026
The full whitepaper, as a PDF
PDF, 7 pages, 230 KB. Standard of 1 Sep 2025, practice statement of 10 Jul 2026.
More reports
Report
Security events by hour: what our monitoring sees
Measured 26 Oct 2026, 00:45 AEST · PDF, 6 pages, 213 KB
