At a glance
Gap review
Every control: met, partial or missing
Compliance readiness
SMB1001 certification readiness in Australia.
A gap review against your target SMB1001 tier, remediation sequenced against the certification date, and an evidence pack for the certifying assessor.
Fixed scope
SMB1001 certification readiness
Fixed scope, priced before the work starts.
Gap assessment against your target tier, evidence pack, remediation plan and support through certification.
At a glance
Evidence pack
Organised for the certifying assessor
At a glance
SMB1001:2026 Gold, opens in a new tab
Our own certificate, on the registry
Overview
SMB1001 is a tiered cybersecurity certification standard for small and medium businesses. A business certifies at the tier its risk and its customers require, and the certificate is listed on a public registry where a buyer, insurer or supply chain can verify it.
How readiness work starts
Readiness work starts with the current environment. Each control of the target tier is identified as met, partial or missing, the gaps are prioritised against the target tier and the certification date, and evidence is collected as controls land. Delivered Australia-wide.
What is SMB1001?
The standard runs five tiers, Bronze, Silver, Gold, Platinum and Diamond, at Levels 1 through 5. Each tier adds controls over the one below, so the requirement can be sized to the business. Each edition carries a year mark; the current edition is 2026.
Gold at Level 3
Gold sits at Level 3 and rests on twenty-seven controls, formally attested by a company director: multi-factor authentication, patching, restricted administrative privilege, backups and recovery, incident handling, and discipline around vendors and third parties. The certificate is listed on CyberCert's public registry, which is what gives it weight in a commercial negotiation: the counterparty can confirm it directly.
The five tiers, Bronze to Diamond
Bronze, Level 1, is the entry tier: an IT support relationship, a firewall, endpoint protection kept current, patching, backups, and staff who know the basics. Silver, Level 2, adds multi-factor authentication, individual user accounts in place of shared logins, restricted administrative privilege, SPF on email, and written processes.
Gold, Platinum and Diamond
Gold, Level 3, adds endpoint detection and response, stronger email authentication, a documented incident response process, asset governance, and consideration of cyber insurance and how the business uses AI tools, twenty-seven controls in total. Platinum and Diamond, Levels 4 and 5, cover much of the same ground and ask for it to be demonstrably operating and monitored.
How each tier is verified
Verification changes as the tiers climb. Bronze, Silver and Gold are self-attested: a company director signs off through the CyberCert portal that the tier's controls are in place, and the certificate issues on that attestation. Platinum and Diamond move to external audit: an accredited Independent Verification Organisation examines the evidence and confirms the controls are operating before CyberCert issues the certificate.
Why are Australian supply chains asking for SMB1001?
Security questionnaires travel down the supply chain. Large Australian organisations and government buyers carry obligations they cannot discharge alone, so they push assurance requirements onto every supplier that touches their data or their systems.
Why a tiered certificate fits
For a small or medium supplier, ISO 27001 is often more than a single contract justifies, and a written security policy on its own gives a procurement team nothing to verify.
SMB1001 is tiered, so the requirement can be sized to the supplier. It is certifiable, so a procurement team can rely on the listing. And the registry entry answers the questionnaire before it is sent. The 2026 Privacy Act reforms add to the same pressure on businesses holding personal information.
What a readiness engagement involves
A readiness engagement runs as a defined program with milestones set against your certification date. It starts with the environment as it runs today, records each control of the target tier as met, partial or missing, and sequences the remediation so the controls that cut the most risk land first.
- Gap review: each control of your target tier checked against the running environment, recorded as met, partial or missing
- Remediation: sequenced against the tier and certification date, with our engineers doing the hands-on work where you want it
- Evidence pack: policies, records and configuration proof, organised against the standard's structure for the certifying assessor
Access and engineering
We work under least-privilege access for the duration, asking only for the access the review requires. Findings are written with the reasoning shown. Where a gap needs engineering, our engineers can carry it as a shipped change, since the firm designs, builds and operates production software.
Our own certificate
Black Shard holds SMB1001:2026 Gold, issued by CyberCert. Valid 16 Jun 2026 to 17 Jun 2027.
The certificate is listed on CyberCert's public registry against the company's ABN, which is the check we recommend to any buyer: open the listing, confirm the holder, the level and the dates, and do not rely on the PDF.
Why it shapes the evidence pack
That matters for readiness work in one specific way. The twenty-seven Gold controls were implemented on the firm's own estate and attested by a director through the same portal a client's director will use, so the evidence pack we assemble is shaped by having stood one up. Each SMB1001 certificate carries the edition it was issued against, the tier and level, the legal entity and the active period, and CyberCert lists every certificate it issues on its public registry.
Black Shard's role, and where it stops
We build the controls: configuring MFA, standing up EDR, tightening administrative access, testing backups, writing the incident response process your team will run. We assemble the evidence: the policies, records and configuration proof organised against the standard's structure, so whoever signs off, or whoever audits, works from a finished pack.
What we do not do
We do not attest, audit or certify. At Bronze, Silver and Gold the attestation is made personally by a company director through the CyberCert portal; Black Shard does not sign it.
At Platinum and Diamond, where the standard calls in an external Independent Verification Organisation, our role is support through that process: the evidence organised and indexed before fieldwork starts, our engineers available during the audit to answer technical questions about how a control operates, and any gap the auditor raises closed as it is raised. The audit itself, the decision on each control, and the certificate belong to the auditor and to CyberCert.
The outcome to expect
Readiness to certify: the gaps against your target tier closed, the evidence assembled and organised, and every control either demonstrably met or carrying a named, sequenced fix. The certification decision belongs to the certifying process.
The controls remain after the certificate issues: multi-factor authentication that is enforced, backups that have been restored, an incident path that has been rehearsed.
What does SMB1001 readiness cost?
SMB1001 certification readiness runs to a fixed scope, priced before the work starts: a gap assessment against your target tier, an evidence pack, a remediation plan and support through certification.
What drives the price
The price follows the tier you are targeting, how far the current posture sits from it, the number of environments and tenancies in the review, and how much of the remediation our engineers carry versus your own team closing gaps against our plan. A business already partway through Essential Eight uplift is a smaller job than one starting from nothing. Milestones run toward your certification date, scoped and agreed before the work starts.
A free 30-minute scoping call settles the tier, the scope and the quote. A brief to info@blackshard.com.au starts scoping from the detail you have.
Property
Bold Property Group
Off-market deal sourcing and the AML/CTF program run from one staff app.
Every PEP match waits for a person’s approval before the client proceeds.
Financial services
Stone Leaf Capital
Staff, investors and the board work from one portal inside the licence perimeter.
The board signs resolutions and minutes in the portal under e-signature.
Legal
GRM LAW
The firm runs intake, conflicts, trust oversight and AML/CTF from one portal.
Whole-tenant ICT, with Conditional Access across the firm from 23 October 2026.
Product screens shown with sample data.
From the newsroom
SMB1001, in the newsroom.
Updated Guides
SMB1001 or Essential Eight: which should you do first?
Policy and regulation
Federal Court orders The Star to pay $260 million for AML/CTF breaches
Questions, answered.
Does Black Shard hold SMB1001 itself?
Yes, at Gold. The readiness work follows the same path we took to it.
Which SMB1001 tier should we target?
The standard runs five tiers, Bronze through Diamond, and the target is usually set by what your customers and contracts require. Where the ask is unstated, the gap review sizes the tier to the data you hold and the contracts you serve, and states where a lower tier discharges the obligation.
What tier should we start at?
The tier the current posture can sustain. Bronze and Silver are self-attested and quick for a business with the fundamentals in place, and Gold suits most SMBs running a defined program. Unless a contract names a higher tier, start at Gold or below and step up once the controls are bedded in.
Is SMB1001 the same as the Essential Eight?
No. The Essential Eight is a set of mitigation strategies from the Australian Signals Directorate that you self-assess against; SMB1001 is a certification standard with an issuing body and a public registry. The controls overlap substantially, so Essential Eight uplift you have already done counts directly toward SMB1001 readiness.
Can you guarantee we will be certified?
No. Certification is issued by the certifying body. What we deliver is readiness: gaps closed against the target tier and an evidence pack the assessor can work through.
Do you issue the certification yourselves?
No. SMB1001 certification is issued through CyberCert. We prepare you for that process.
Who audits SMB1001?
It depends on the tier. At Bronze, Silver and Gold a company director attests through the CyberCert portal, and CyberCert issues the certificate on that attestation. At Platinum and Diamond an accredited Independent Verification Organisation audits the evidence first. We are not the attestor or the auditor at any tier; our work is the readiness before each step.
How long does SMB1001 readiness take?
It depends on the distance between your current posture and the target tier, and on how many environments are in scope. Readiness runs as a defined program with milestones set against your certification date, so the timeframe is agreed at the start.
How long does SMB1001 certification take?
At the self-attested tiers the certification step is short: once the evidence is in order, a director's attestation can turn a certificate around in days. Platinum and Diamond add an external audit, scheduled on top of the readiness work. Either way, closing the gaps and assembling the evidence is usually the longer half.
Do you work across Australia?
Yes. Every practice is delivered Australia-wide, remotely as standard and on site where the scope needs it.
