What evidence an SMB1001 attestation or audit relies on

SMB1001 has five cumulative tiers, Bronze to Diamond (Levels 1 to 5), published by Dynamic Standards International and certified by CyberCert, and every certificate is valid for 12 months. The tiers, the five control areas and the certification steps are set out on the SMB1001 certification page.

Four parties rely on the records, and each one confirms something different.

The technical support specialist is the person engaged under Bronze control 1.1. The same person gives the technical confirmation in the portal, so their engagement letter should name the systems they look after. A control outside that engagement still needs an owner and a record. The auditor cannot issue certificates. CyberCert issues the certificate to the registered legal entity and lists it on the public registry.

The requirements workbook lists the controls for the tier. Each control needs a record the business can produce on request, whether a director is signing from it or an auditor is sampling it. Tiers are cumulative, so a Gold pack carries every Bronze and Silver record as well as the Gold ones.

Silver targets business email compromise, credential harvesting and basic ransomware. Its records centre on identity: who can sign in, by what method, and with what privilege. CyberCert describes Silver as the cyber-insurable tier.

Gold adds the written governance layer and detection on endpoints and email, so most of its records are documents a director approves. Platinum and Diamond keep every Gold record and add test output, which an auditor reads for remediation as closely as for findings.

A record is usable when someone outside the team can read it and reach the same conclusion. Four properties carry most of that.

The common failure is a record produced once for the attestation. The multi-factor authentication report was clean on the day, then a new starter joined without it, or a service account was added with administrative rights. The director signed against a state that no longer holds.

Organise the pack by the workbook's control numbers. A pack indexed that way lets the director sign against named records and lets an auditor sample without a hunt. The Bronze workbook numbers its seven controls 1.1 to 1.4, 2.1, 3.1 and 5.1.

Use the same numbers for folder names, file names and the index sheet, and keep one line per control with its record, its date and its owner. Where one record serves two controls, file it once and point to it from both lines.

Recertification each year produces a new certificate against the tier's controls, so a control that was set up for the attestation and then drifted becomes a gap at renewal. DSI revises the standard and dates each edition, and the current edition is SMB1001:2026. Check the workbook for the edition in force when renewal opens, and map the existing pack to it before refreshing records.

CyberCert gives at least three months' notice of expiry. Set the refresh points earlier than that: re-run the multi-factor authentication and account reports when staff change, repeat the restore test inside each certificate period, and reconcile endpoint coverage to the asset register whenever devices are added.

Multi-factor authentication, patching, backups and restricted administrative privilege sit at the centre of SMB1001 and the Essential Eight, so the same exports and reports serve both. The control-by-control comparison is at Essential Eight vs SMB1001. Whether to do SMB1001 or the Essential Eight first is at SMB1001 or Essential Eight first.

A business that holds SMB1001 Gold has policies, an incident response plan and an asset register to build from. ISO 27001 then adds the management system clauses: scope, risk assessment and treatment, a statement of applicability, internal audit and management review. The comparison is at SMB1001 vs ISO 27001.

Run this before the attestation, or before booking the auditor at Platinum and Diamond:

Get support where the gap register shows technical controls the team has not configured before or a tender fixes the certificate date. Platinum and Diamond also need support through the external audit.

Black Shard holds SMB1001:2026 Gold and runs its own estate at Essential Eight Maturity Level 3. Its readiness engagement runs a scoping call, a control-by-control gap review, hands-on remediation by our engineers, the written policies and plans, an indexed evidence pack, and support through the director's attestation or the auditor's fieldwork. The attestation belongs to the director and the certificate to CyberCert.