The standard
Five tiers
Bronze to Diamond, Levels 1 to 5.
SMB1001:2026
SMB1001 certification, explained.
SMB1001 is a five-tier cyber security certification for small and medium businesses, issued by CyberCert and checked on a public registry.
Fixed scope
SMB1001 certification readiness
Fixed scope, priced before the work starts.
Gap assessment against your target tier, evidence pack, remediation plan and support through certification.
Validity
12 months
Then recertification against the current edition.
Our certificate, on the registry
SMB1001:2026 Gold, opens in a new tab
16 Jun 2026 to 17 Jun 2027
The standard
What is SMB1001?
SMB1001 is a multi-tiered cyber security certification standard for small and medium businesses, published by Dynamic Standards International (DSI). Each tier adds controls over the one below, so a business certifies at the level it can sustain and steps up as it grows.
The registry, editions and international mappings
CyberCert issues the certificates and lists every one on a public registry. A buyer, insurer or head contractor can check the tier, the legal entity and the expiry date in a minute, which is why SMB1001 now appears in Australian supply-chain questionnaires, tenders and cyber insurance proposals.
DSI revises the standard to keep pace with the threat landscape, and each edition carries its year. The current edition is SMB1001:2026. DSI maps it to the United Kingdom’s Cyber Essentials and to the CIS Controls and CMMC in the United States.
- Publisher
- Dynamic Standards International (DSI)
- Current edition
- SMB1001:2026
- Tiers
- Five: Bronze, Silver, Gold, Platinum, Diamond (Levels 1 to 5)
- Certifier
- CyberCert, with a public registry at verify.cybercert.ai
- Verification
- Director (or equivalent) attestation at Levels 1 to 3; attestation plus an external audit at Levels 4 and 5
- Validity
- 12 months, then recertification
Core areas
The five areas every tier covers.
Every tier draws its controls from five core areas, numbered 1 to 5 in the standard.
Technology management
Hardware, software and networks kept current and patched, with security configuration maintained.Access management
Only authorised people reach sensitive data and systems: password policy, multi-factor authentication and monitoring of user activity.Backup and recovery
Critical data backed up on a schedule and a recovery plan that restores systems after an incident.Policies, plans and procedures
Written cyber security policies, procedures and contingency plans, including how the business responds to an incident.Education and training
Ongoing cyber security awareness training for every employee.
Tiers
The five SMB1001 tiers and what each one adds.
Each tier carries every control of the tiers below it. Levels 4 and 5 add formal governance and independent verification.
Level 1
Bronze
Small businesses with low cyber risk exposure.
The baseline: a technical support specialist, firewall, anti-virus, automatic patching, password hygiene, a backup and recovery strategy, and awareness training for all staff. Seven controls.
Director attestation
Level 2
Silver
Businesses facing moderate risk that rely on email and business apps.
Stronger identity protection, tighter access controls, server patching and invoice fraud protection. CyberCert describes Silver as the cyber-insurable tier.
Director attestation
Level 3
Gold
The tier we holdBusinesses that want to show best-practice cyber security to customers and insurers.
Formal governance and technical maturity: cyber security policies, incident response, a responsible AI use policy, endpoint detection and response, email authentication and an appropriate insurance policy. Twenty-seven controls.
Director attestation
Level 4
Platinum
Compliance-heavy industries such as finance, healthcare and retail.
Vulnerability scanning and testing, stronger multi-factor authentication, and independent verification of the controls.
Attestation plus external audit
Level 5
Diamond
High-risk sectors such as critical infrastructure, defence and government.
Supplier trust programs, police vetting, live testing of incident response, and application control. Independently verified.
Attestation plus external audit
Bronze
SMB1001 Bronze checklist.
7
controls at Level 1 under the 2026 edition, numbered as in CyberCert’s Bronze workbook. Every higher tier starts here.
- 1.1
Engage a technical support specialist for your organisation.
Technology management
- 1.2
Install and configure a firewall.
Technology management
- 1.3
Install anti-virus software on all organisation devices.
Technology management
- 1.4
Automatically install tested and approved software updates and patches on all organisation devices.
Technology management
- 2.1
Ensure strong password hygiene is maintained.
Access management
- 3.1
Implement a backup and recovery strategy for important digital assets.
Backup and recovery
- 5.1
Conduct cyber security awareness training for all employees.
Education and training
Silver and Gold
What Silver and Gold add.
27
controls at Gold, Level 3, the tier Black Shard holds.
- Silver: hygiene to identity, aimed at business email compromise, credential harvesting and basic ransomware
- Gold: formal governance and detection, all attested by a director
- Platinum and Diamond: further controls, verified by an external audit before the certificate issues
What each tier asks for
Silver moves from hygiene to identity. Multi-factor authentication, individual accounts in place of shared logins, restricted administrative privilege, server patching, SPF on email and invoice fraud protection target business email compromise, credential harvesting and basic ransomware, the most common attacks on small businesses.
Gold adds formal governance and detection. The 2026 edition asks for endpoint detection and response, DKIM and DMARC alongside SPF, a documented incident response plan, a digital asset register, data protection, a responsible AI use policy and an appropriate cyber insurance policy, all attested by a director.
Platinum and Diamond add vulnerability scanning and testing, stronger multi-factor authentication, supplier assurance, police vetting, live incident response testing and application control, and both are verified by an external audit before the certificate issues.
Certification
How SMB1001 certification works.
DSI publishes the standard. CyberCert certifies against it and runs the registry.
Choose the tier
Set by what your customers, insurer or contracts ask for. Where nobody has named a tier, size it to the data you hold and the counterparties you serve.
Subscribe through CyberCert
The subscription opens the CyberCert portal and the requirements workbook for the tier. A business has 12 months from purchase to complete its certification.
Implement every control at the tier
Tiers are cumulative: Silver carries every Bronze control, Gold carries every Silver control, and so on up. Each control needs evidence the business can point to.
Technical confirmation
The business nominates its technical service specialist, who confirms in the portal that the technical controls within their engagement are in place.
Attestation
A director, owner or authorised senior executive attests that every control at the tier is implemented. At Levels 1 to 3 the attestation completes the requirements.
External audit at Levels 4 and 5
Platinum and Diamond add an external audit. CyberCert cannot issue a Level 4 or 5 certificate without a successful audit, and the auditor cannot issue certificates.
Issue and registry listing
CyberCert validates the attestation and issues the certificate to the registered legal entity. It appears on the public registry within one working day.
Recertify each year
Certificates are valid for 12 months. CyberCert gives at least three months’ notice of expiry, and recertification produces a new certificate.
Readiness
How Black Shard gets a business ready.
We build the controls and assemble the evidence, to the date you need the certificate by. The attestation belongs to your director and the certificate to CyberCert.
Scoping call
A free 30-minute call settles the target tier, the systems and people in scope, and the date the certificate is needed by.A recommended tier and a fixed scope
Gap review
Every control at the target tier checked against your environment as it runs day to day and recorded as met, partial or missing.A control-by-control gap register
Remediation
Gaps closed in order of risk against the certification date. Our engineers do the hands-on work where you want it: multi-factor authentication, EDR, SPF, DKIM and DMARC, backup restores, admin access.Controls implemented and tested
Policies and plans
The written layer the standard asks for, fitted to how the business actually runs: security policy, incident response plan, responsible AI use policy, asset register.Policies your team can follow
Evidence pack
Policies, records and configuration proof organised against the standard’s control numbers, ready for the director’s attestation or the auditor’s fieldwork.An indexed evidence pack
Attestation and audit support
At Bronze to Gold your director attests from a finished pack. At Platinum and Diamond our engineers answer the auditor’s technical questions and close anything raised during fieldwork.A certificate-ready submission
Against the Essential Eight
SMB1001 vs the Essential Eight.
Multi-factor authentication, patching, backups and restricted administrative privilege sit at the centre of both, so work done for one serves the other.
| Attribute | SMB1001 | Essential Eight |
|---|---|---|
| Published by | Dynamic Standards International | Australian Signals Directorate |
| What you get | A dated certificate and a public registry listing | A maturity level; no certificate exists |
| Structure | Five cumulative tiers, Bronze to Diamond | Eight mitigation strategies, each at Maturity Level 0 to 3 |
| How it is verified | Director attestation at Levels 1 to 3; external audit at Levels 4 and 5 | Self-assessment, or an assessment by a third party |
| Scope | People, process and technology: policies, training, insurance and incident response alongside technical controls | Technical hardening of systems |
| Application control and Office macros | Not required until Diamond | Required from Maturity Level 1 |
| Expiry | 12 months, then recertification | No expiry; the level holds while the controls do |
Published by
- SMB1001
- Dynamic Standards International
- Essential Eight
- Australian Signals Directorate
What you get
- SMB1001
- A dated certificate and a public registry listing
- Essential Eight
- A maturity level; no certificate exists
Structure
- SMB1001
- Five cumulative tiers, Bronze to Diamond
- Essential Eight
- Eight mitigation strategies, each at Maturity Level 0 to 3
How it is verified
- SMB1001
- Director attestation at Levels 1 to 3; external audit at Levels 4 and 5
- Essential Eight
- Self-assessment, or an assessment by a third party
Scope
- SMB1001
- People, process and technology: policies, training, insurance and incident response alongside technical controls
- Essential Eight
- Technical hardening of systems
Application control and Office macros
- SMB1001
- Not required until Diamond
- Essential Eight
- Required from Maturity Level 1
Expiry
- SMB1001
- 12 months, then recertification
- Essential Eight
- No expiry; the level holds while the controls do
Against ISO 27001
The split is different again. ISO 27001 certifies an audited management system and is the standard offshore and enterprise buyers name. SMB1001 certifies a defined control set at a stated tier and is the faster answer for Australian mid-market buyers. The Essential Eight strategies each SMB1001 tier tests decide how much hardening work carries across.
Checking a certificate
How to check an SMB1001 certificate.
Five fields decide whether a certificate means what the sender implied.
The edition
Certificates name the version of the standard attested to. Ours reads SMB1001:2026. An older edition tells you when the attestation happened.The tier and level
Bronze through Diamond, Levels 1 to 5. A certificate that names no tier is not answering the question you asked.The legal entity
Certificates carry the registered legal name and business number exactly as the business register lists them, with no trading names. Check the ABN against the entity you are contracting with.The expiry date
Certificates are valid for 12 months. An expired certificate is not valid, and it is the relying party’s job to check.The registry listing
Every certificate CyberCert issues is listed on its public registry, and the certificate carries a QR code to the listing. Open it and check the holder, the level and the dates against the PDF you were sent.
Our standing
Where Black Shard stands.
Black Shard holds SMB1001:2026 Gold, issued by CyberCert. The certificate is issued to Black Shard Pty Ltd, ABN 66 696 910 773.
The twenty-seven Gold controls run in our own environment. Frameworks we work against: ASD ISM, Privacy Act 1988 and APPs, CIS Controls v8.
Readiness work
Our readiness work covers a gap review against your target tier, the remediation that closes it, and an evidence pack built from having stood the same controls up on our own estate. The certification decision belongs to CyberCert.
Certification
SMB1001:2026 Gold
Gold tier, Level 3.
16 Jun 2026 to 17 Jun 2027
VerifySMB1001:2026 Gold, opens in a new tabOur own estate
Essential Eight
Maturity Level 3, assessed September 2026.
All eight strategies, in our own estate.
Read the report
Property
Bold Property Group
Off-market deal sourcing and the AML/CTF program run from one staff app.
Every PEP match waits for a person’s approval before the client proceeds.
Financial services
Stone Leaf Capital
Staff, investors and the board work from one portal inside the licence perimeter.
The board signs resolutions and minutes in the portal under e-signature.
Legal
GRM LAW
The firm runs intake, conflicts, trust oversight and AML/CTF from one portal.
Whole-tenant ICT, with Conditional Access across the firm from 23 October 2026.
Product screens shown with sample data.
From the newsroom
SMB1001, in the newsroom.
Updated Guides
SMB1001 or Essential Eight: which should you do first?
What buyers ask about SMB1001.
What is SMB1001?
SMB1001 is a multi-tiered cyber security certification standard for small and medium businesses, published by Dynamic Standards International. It has five tiers, Bronze, Silver, Gold, Platinum and Diamond, at Levels 1 to 5. Each tier adds controls across five areas: technology management, access management, backup and recovery, policies, plans and procedures, and education and training.
Who certifies SMB1001?
CyberCert issues SMB1001 certificates and lists every one it issues on its public registry at verify.cybercert.ai. At Levels 1 to 3 the certificate issues on a director’s (or equivalent officer’s) attestation. At Levels 4 and 5 it also needs a successful external audit.
What are the SMB1001 levels?
Level 1 Bronze, Level 2 Silver, Level 3 Gold, Level 4 Platinum and Level 5 Diamond. The tiers are cumulative: every control at a lower tier is carried into the tiers above it.
What does SMB1001 Bronze require?
Seven controls under the 2026 edition: engage a technical support specialist, install and configure a firewall, install anti-virus on all devices, automatically install tested and approved updates and patches, maintain strong password hygiene, implement a backup and recovery strategy, and run cyber security awareness training for all employees.
Does SMB1001 require DMARC?
Email authentication enters at Silver, which includes SPF. Gold adds stronger email authentication with DKIM and DMARC, alongside endpoint detection and response and a responsible AI use policy.
Does SMB1001 need an auditor?
Only at Platinum and Diamond. Bronze, Silver and Gold are attested by a director, owner or authorised senior executive through the CyberCert portal. Platinum and Diamond add an external audit, and CyberCert cannot issue those certificates until the audit succeeds.
How much does SMB1001 certification cost?
Two parts. CyberCert publishes a subscription fee for each tier, and Platinum and Diamond add an external audit fee. The larger cost is usually the work of meeting the controls, which depends on how far the business sits from its target tier. Black Shard’s certification readiness runs to a fixed scope, priced before the work starts: a gap assessment against your target tier, an evidence pack, a remediation plan and support through certification. A free 30-minute scoping call settles the quote.
How long does SMB1001 certification take?
The gap-closing work sets the timeline. A business that already runs most of the controls can attest quickly once the evidence is assembled; one starting from nothing needs a program. CyberCert gives a business 12 months from purchase to complete its certification, and a readiness program runs to the date you need the certificate by.
How long is an SMB1001 certificate valid?
Twelve months. CyberCert notifies the holder at least three months before expiry, and recertification issues a new certificate against the current edition of the standard.
Is SMB1001 the same as the Essential Eight?
No. The Essential Eight is the Australian Signals Directorate’s set of eight mitigation strategies, measured as maturity levels with no certificate. SMB1001 is a certification with a tier, an issuer and a registry entry. The controls overlap heavily, so Essential Eight work counts toward SMB1001 evidence.
Is SMB1001 recognised outside Australia?
DSI maps SMB1001 to the United Kingdom’s Cyber Essentials and to the CIS Controls and CMMC in the United States. Offshore enterprise buyers still usually name ISO 27001.
Does Black Shard hold SMB1001?
Yes. Black Shard Pty Ltd holds SMB1001:2026 Gold, issued by CyberCert. Valid 16 Jun 2026 to 17 Jun 2027.
