SMB1001 certification, explained.
SMB1001 is a five-tier cyber security certification for small and medium businesses, issued by CyberCert and checked on a public registry.
SMB1001 certification readiness from $3,950 ex GST.
Gap assessment against your target tier, evidence pack, remediation plan and support through certification.
Book a free 30-minute scoping callOur SMB1001:2026 Gold certificate on the registry
- Bronze to Diamond, Levels 1 to 5
- Five tiers
- Validity, then recertification
- 12 months
- Our certificate, on the registry
- SMB1001:2026 Gold
What is SMB1001?
SMB1001 is a multi-tiered cyber security certification standard for small and medium businesses, published by Dynamic Standards International (DSI). Each tier adds controls over the one below, so a business certifies at the level it can sustain and steps up as it grows.
The registry, editions and international mappings
CyberCert issues the certificates and lists every one on a public registry. A buyer, insurer or head contractor can check the tier, the legal entity and the expiry date in a minute, which is why SMB1001 now appears in Australian supply-chain questionnaires, tenders and cyber insurance proposals.
DSI revises the standard to keep pace with the threat landscape, and each edition carries its year. The current edition is SMB1001:2026. DSI maps it to the United Kingdom’s Cyber Essentials and to the CIS Controls and CMMC in the United States.
- Publisher
- Dynamic Standards International (DSI)
- Current edition
- SMB1001:2026
- Tiers
- Five: Bronze, Silver, Gold, Platinum, Diamond (Levels 1 to 5)
- Certifier
- CyberCert, with a public registry at verify.cybercert.ai
- Verification
- Director (or equivalent) attestation at Levels 1 to 3; attestation plus an external audit at Levels 4 and 5
- Validity
- 12 months, then recertification
The five areas every tier covers.
Every tier draws its controls from five core areas, numbered 1 to 5 in the standard.
- 1
Technology management
- 2
Access management
- 3
Backup and recovery
- 4
Policies, plans and procedures
- 5
Education and training
What each area covers
Technology management: Hardware, software and networks kept current and patched, with security configuration maintained.
Access management: Only authorised people reach sensitive data and systems: password policy, multi-factor authentication and monitoring of user activity.
Backup and recovery: Critical data backed up on a schedule and a recovery plan that restores systems after an incident.
Policies, plans and procedures: Written cyber security policies, procedures and contingency plans, including how the business responds to an incident.
Education and training: Ongoing cyber security awareness training for every employee.
The five SMB1001 tiers and what each one adds.
Each tier carries every control of the tiers below it. Levels 4 and 5 add formal governance and independent verification.
| Tier | Suits | Verification |
|---|---|---|
| BronzeLevel 1 | SuitsSmall businesses with low cyber risk exposure. | VerificationDirector attestation |
| SilverLevel 2 | SuitsBusinesses facing moderate risk that rely on email and business apps. | VerificationDirector attestation |
| GoldLevel 3 | SuitsBusinesses that want to show best-practice cyber security to customers and insurers. | VerificationDirector attestation |
| PlatinumLevel 4 | SuitsCompliance-heavy industries such as finance, healthcare and retail. | VerificationAttestation plus external audit |
| DiamondLevel 5 | SuitsHigh-risk sectors such as critical infrastructure, defence and government. | VerificationAttestation plus external audit |
What each tier adds
Bronze, Level 1: The baseline: a technical support specialist, firewall, anti-virus, automatic patching, password hygiene, a backup and recovery strategy, and awareness training for all staff. Seven controls.
Silver, Level 2: Stronger identity protection, tighter access controls, server patching and invoice fraud protection. CyberCert describes Silver as the cyber-insurable tier.
Gold, Level 3: Formal governance and technical maturity: cyber security policies, incident response, a responsible AI use policy, endpoint detection and response, email authentication and an appropriate insurance policy. Twenty-seven controls.
Platinum, Level 4: Vulnerability scanning and testing, stronger multi-factor authentication, and independent verification of the controls.
Diamond, Level 5: Supplier trust programs, police vetting, live testing of incident response, and application control. Independently verified.
SMB1001 Bronze checklist.
7
controls at Level 1 under the 2026 edition, numbered as in CyberCert’s Bronze workbook. Every higher tier starts here.
- 1.1
Engage a technical support specialist for your organisation.
Technology management
- 1.2
Install and configure a firewall.
Technology management
- 1.3
Install anti-virus software on all organisation devices.
Technology management
- 1.4
Automatically install tested and approved software updates and patches on all organisation devices.
Technology management
- 2.1
Ensure strong password hygiene is maintained.
Access management
- 3.1
Implement a backup and recovery strategy for important digital assets.
Backup and recovery
- 5.1
Conduct cyber security awareness training for all employees.
Education and training
What Silver and Gold add.
27
controls at Gold, Level 3, the tier Black Shard holds.
- Silver: hygiene to identity, aimed at business email compromise, credential harvesting and basic ransomware
- Gold: formal governance and detection, all attested by a director
- Platinum and Diamond: further controls, verified by an external audit before the certificate issues
What each tier asks for
Silver moves from hygiene to identity. Multi-factor authentication, individual accounts in place of shared logins, restricted administrative privilege, server patching, SPF on email and invoice fraud protection target business email compromise, credential harvesting and basic ransomware, the most common attacks on small businesses.
Gold adds formal governance and detection. The 2026 edition asks for endpoint detection and response, DKIM and DMARC alongside SPF, a documented incident response plan, a digital asset register, data protection, a responsible AI use policy and an appropriate cyber insurance policy, all attested by a director.
Platinum and Diamond add vulnerability scanning and testing, stronger multi-factor authentication, supplier assurance, police vetting, live incident response testing and application control, and both are verified by an external audit before the certificate issues.
How SMB1001 certification works.
DSI publishes the standard. CyberCert certifies against it and runs the registry.
- Choose the tier
- Subscribe through CyberCert
- Implement every control at the tier
- Technical confirmation
- Attestation
- External audit at Levels 4 and 5
Issue, registry listing and recertification
- Issue and registry listing
- Recertify each year
Each step in detail
1. Choose the tier: Set by what your customers, insurer or contracts ask for. Where nobody has named a tier, size it to the data you hold and the counterparties you serve.
2. Subscribe through CyberCert: The subscription opens the CyberCert portal and the requirements workbook for the tier. A business has 12 months from purchase to complete its certification.
3. Implement every control at the tier: Tiers are cumulative: Silver carries every Bronze control, Gold carries every Silver control, and so on up. Each control needs evidence the business can point to.
4. Technical confirmation: The business nominates its technical service specialist, who confirms in the portal that the technical controls within their engagement are in place.
5. Attestation: A director, owner or authorised senior executive attests that every control at the tier is implemented. At Levels 1 to 3 the attestation completes the requirements.
6. External audit at Levels 4 and 5: Platinum and Diamond add an external audit. CyberCert cannot issue a Level 4 or 5 certificate without a successful audit, and the auditor cannot issue certificates.
7. Issue and registry listing: CyberCert validates the attestation and issues the certificate to the registered legal entity. It appears on the public registry within one working day.
8. Recertify each year: Certificates are valid for 12 months. CyberCert gives at least three months’ notice of expiry, and recertification produces a new certificate.
How Black Shard gets a business ready.
We build the controls and assemble the evidence, to the date you need the certificate by. The attestation belongs to your director and the certificate to CyberCert.
- Scoping call
- Gap review
- Remediation
- Policies and plans
- Evidence pack
- Attestation and audit support
Each stage, and what it delivers
1. Scoping call: A free 30-minute call settles the target tier, the systems and people in scope, and the date the certificate is needed by. Deliverable: A recommended tier and a fixed scope.
2. Gap review: Every control at the target tier checked against your environment as it runs day to day and recorded as met, partial or missing. Deliverable: A control-by-control gap register.
3. Remediation: Gaps closed in order of risk against the certification date. Our engineers do the hands-on work where you want it: multi-factor authentication, EDR, SPF, DKIM and DMARC, backup restores, admin access. Deliverable: Controls implemented and tested.
4. Policies and plans: The written layer the standard asks for, fitted to how the business actually runs: security policy, incident response plan, responsible AI use policy, asset register. Deliverable: Policies your team can follow.
5. Evidence pack: Policies, records and configuration proof organised against the standard’s control numbers, ready for the director’s attestation or the auditor’s fieldwork. Deliverable: An indexed evidence pack.
6. Attestation and audit support: At Bronze to Gold your director attests from a finished pack. At Platinum and Diamond our engineers answer the auditor’s technical questions and close anything raised during fieldwork. Deliverable: A certificate-ready submission.
SMB1001 vs the Essential Eight.
Multi-factor authentication, patching, backups and restricted administrative privilege sit at the centre of both, so work done for one serves the other. Black Shard holds SMB1001:2026 Gold and runs its own estate at Essential Eight Maturity Level 3.
| Attribute | SMB1001 | Essential Eight |
|---|---|---|
| Published by | SMB1001Dynamic Standards International | Essential EightAustralian Signals Directorate |
| What you get | SMB1001A dated certificate and a public registry listing | Essential EightA maturity level; no certificate exists |
| Structure | SMB1001Five cumulative tiers, Bronze to Diamond | Essential EightEight mitigation strategies, each at Maturity Level 0 to 3 |
| How it is verified | SMB1001Director attestation at Levels 1 to 3; external audit at Levels 4 and 5 | Essential EightSelf-assessment, or an assessment by a third party |
Scope
SMB1001: People, process and technology: policies, training, insurance and incident response alongside technical controls. Essential Eight: Technical hardening of systems.
Application control and Office macros
SMB1001: Not required until Diamond. Essential Eight: Required from Maturity Level 1.
Expiry
SMB1001: 12 months, then recertification. Essential Eight: No expiry; the level holds while the controls do.
Against ISO 27001
The split is different again. ISO 27001 certifies an audited management system and is the standard offshore and enterprise buyers name. SMB1001 certifies a defined control set at a stated tier and is the faster answer for Australian mid-market buyers. The Essential Eight strategies each SMB1001 tier tests decide how much hardening work carries across.
How to check an SMB1001 certificate.
Five fields decide whether a certificate means what the sender implied.
- The edition
- The tier and level
- The legal entity
- The expiry date
- The registry listing
Each field in detail
The edition: Certificates name the version of the standard attested to. Ours reads SMB1001:2026. An older edition tells you when the attestation happened.
The tier and level: Bronze through Diamond, Levels 1 to 5. A certificate that says only "SMB1001 certified" without a tier is not answering the question you asked.
The legal entity: Certificates carry the registered legal name and business number exactly as the business register lists them, with no trading names. Check the ABN against the entity you are contracting with.
The expiry date: Certificates are valid for 12 months. An expired certificate is not valid, and it is the relying party’s job to check.
The registry listing: Every certificate CyberCert issues is listed on its public registry, and the certificate carries a QR code to the listing. Open it and check the holder, the level and the dates against the PDF you were sent.
Where Black Shard stands.
We hold SMB1001:2026 Gold, as Black Shard Pty Ltd, ABN 66 696 910 773, issued by CyberCert and active to 17 June 2027. The listing is public and you can check it on the registry. The twenty-seven Gold controls run in our own environment, alongside the ASD Essential Eight at Maturity Level 3, the ASD Information Security Manual, the CIS Controls and the Australian Privacy Principles.
Readiness work, and citing this page
Our readiness work covers a gap review against your target tier, the remediation that closes it, and an evidence pack built from having stood the same controls up on our own estate. The certification decision belongs to CyberCert.
Free to cite, quote and link to. If the standard moves, tell us and we will update it.
Recent work of this kind
Client confidential
ISO 27001, SOC 2 and SMB1001 audit readiness for a clinical software platform: scoping, gap analysis, control set, assessor documentation.
SMB1001 questions, answered
What is SMB1001?
SMB1001 is a multi-tiered cyber security certification standard for small and medium businesses, published by Dynamic Standards International. It has five tiers, Bronze, Silver, Gold, Platinum and Diamond, at Levels 1 to 5. Each tier adds controls across five areas: technology management, access management, backup and recovery, policies, plans and procedures, and education and training.
Who certifies SMB1001?
CyberCert issues SMB1001 certificates and lists every one it issues on its public registry at verify.cybercert.ai. At Levels 1 to 3 the certificate issues on a director’s (or equivalent officer’s) attestation. At Levels 4 and 5 it also needs a successful external audit.
What are the SMB1001 levels?
Level 1 Bronze, Level 2 Silver, Level 3 Gold, Level 4 Platinum and Level 5 Diamond. The tiers are cumulative: every control at a lower tier is carried into the tiers above it.
What does SMB1001 Bronze require?
Seven controls under the 2026 edition: engage a technical support specialist, install and configure a firewall, install anti-virus on all devices, automatically install tested and approved updates and patches, maintain strong password hygiene, implement a backup and recovery strategy, and run cyber security awareness training for all employees.
Does SMB1001 require DMARC?
Email authentication enters at Silver, which includes SPF. Gold adds stronger email authentication with DKIM and DMARC, alongside endpoint detection and response and a responsible AI use policy.
Does SMB1001 need an auditor?
Only at Platinum and Diamond. Bronze, Silver and Gold are attested by a director, owner or authorised senior executive through the CyberCert portal. Platinum and Diamond add an external audit, and CyberCert cannot issue those certificates until the audit succeeds.
How much does SMB1001 certification cost?
Two parts. CyberCert publishes a subscription fee for each tier, and Platinum and Diamond add an external audit fee. The larger cost is usually the work of meeting the controls, which depends on how far the business sits from its target tier. Black Shard’s certification readiness starts at $3,950 ex GST for a fixed scope: a gap assessment against your target tier, an evidence pack, a remediation plan and support through certification. A free 30-minute scoping call settles the quote.
How long does SMB1001 certification take?
The gap-closing work sets the timeline. A business that already runs most of the controls can attest quickly once the evidence is assembled; one starting from nothing needs a program. CyberCert gives a business 12 months from purchase to complete its certification, and a readiness program runs to the date you need the certificate by.
How long is an SMB1001 certificate valid?
Twelve months. CyberCert notifies the holder at least three months before expiry, and recertification issues a new certificate against the current edition of the standard.
Is SMB1001 the same as the Essential Eight?
No. The Essential Eight is the Australian Signals Directorate’s set of eight mitigation strategies, measured as maturity levels with no certificate. SMB1001 is a certification with a tier, an issuer and a registry entry. The controls overlap heavily, so Essential Eight work counts toward SMB1001 evidence.
Is SMB1001 recognised outside Australia?
DSI maps SMB1001 to the United Kingdom’s Cyber Essentials and to the CIS Controls and CMMC in the United States. Offshore enterprise buyers still usually name ISO 27001.
Does Black Shard hold SMB1001?
Yes. Black Shard Pty Ltd holds SMB1001:2026 Gold, Level 3, issued by CyberCert, active to 17 June 2027 and listed on CyberCert’s public registry.
Certify at the tier your buyers will accept.
Brisbane head office.
Book a free 30-minute scoping callOpen a briefinfo@blackshard.com.au