Question 1

What is SMB1001 and who is it designed for?

Accepted Answer

SMB1001 is an Australian cyber security standard developed by Dynamic Standards International (DSI) for businesses under 200 staff that don't have a dedicated security function. It uses a five-tier certification model, Bronze, Silver, Gold, Platinum, and Diamond, designed to be achievable at each level without enterprise-scale resources. SMB1001:2025 is the current version of the standard.

Question 2

How long does it take to achieve Bronze certification?

Accepted Answer

Typically 8-12 weeks from initial gap analysis to certification-ready, depending on how many controls are already in place. Bronze is self-assessed, so you don't need to wait for an external assessor. Businesses that already have basic security hygiene, regular backups, some form of MFA, documented processes, will move through the remediation phase faster.

Question 3

What does SMB1001 certification cost?

Accepted Answer

There are two separate costs, and it helps to keep them apart. The certification fee is set by the certifying body rather than by us: SMB1001 is maintained by Dynamic Standards International, certificates are issued through the CyberCert portal, and the fee scales with the tier you certify at. The second cost is the work to actually meet the controls, and that is where nearly all the variation sits. A business already running MFA, managed patching and tested backups may need very little remediation; one starting from scratch needs more. We quote that work after the gap analysis so you get a real number rather than a range, and Bronze remains the lowest-cost entry point while still being a complete, usable certification in its own right.

Question 4

Who maintains SMB1001, and how does it relate to other standards?

Accepted Answer

SMB1001 is an Australian cyber security standard maintained by Dynamic Standards International (DSI); the current version is SMB1001:2025. Certification is administered through the CyberCert portal, where Bronze, Silver and Gold are attested by a company director and Platinum and Diamond are independently audited. It was written for businesses of roughly 5 to 200 staff, and it deliberately aligns with the ACSC Essential Eight, the UK's Cyber Essentials scheme and elements of the US CMMC. That alignment is why it works well as a practical stepping stone toward ISO 27001 rather than a dead end.

Question 5

How does SMB1001 compare to the ACSC Essential Eight?

Accepted Answer

SMB1001 was designed for businesses under 200 staff without a dedicated security function, it's intentionally more accessible than the Essential Eight for that environment. The Essential Eight is better suited to organisations in government supply chains, financial services, or larger enterprise contexts. Both frameworks cover many of the same fundamental controls; the difference is in the depth and complexity of implementation required at each level. If you're unsure which is right for your business, that's the first conversation we have.

Question 6

Which tiers are self-assessed and which require independent verification?

Accepted Answer

Bronze, Silver and Gold are self-assessed, you document your controls, complete the assessment questionnaire, and declare your certification level. Platinum and Diamond require independent third-party assessment, where an accredited assessor verifies your controls and evidence before certification is issued. Most businesses targeting their first SMB1001 certification start at Bronze and work toward Gold before considering higher tiers.

Question 7

Does SMB1001 certification need to be renewed?

Accepted Answer

Yes. SMB1001 certification requires annual renewal to remain current. This keeps your certification meaningful, it reflects your actual security posture, not where you were twelve months ago. The renewal process involves reassessing your controls against the standard and updating your evidence. We manage this as part of our ongoing cyber security programme so it doesn't sneak up on you.

Question 8

Who should implement SMB1001:2025?

Accepted Answer

SMB1001:2025 is designed for small and medium-sized businesses that may not have the same resources as larger organisations but still need to establish a robust cybersecurity framework. If your business doesn't have a dedicated security function but still handles customer data, uses cloud services, or wants to demonstrate security credentials to clients or insurers, SMB1001 is the most practical starting point available to Australian businesses.

Question 9

What types of controls does SMB1001 cover?

Accepted Answer

SMB1001:2025 covers both technical measures, such as multi-factor authentication, patch management, secure backups, and access controls, and organisational practices, including cybersecurity policies, staff awareness, incident response planning, and vendor management. The balance of technical versus organisational controls increases as you move through the tiers.

Question 10

What if our business cannot meet all the controls?

Accepted Answer

SMB1001:2025 recognises that not all controls may be relevant or feasible for every SMB. Organisations are encouraged to prioritise controls based on their specific context and capabilities, starting with the most impactful and working toward full coverage. The gap analysis we conduct in Phase 1 maps exactly where you stand and sequences remediation so you're working on the right things first, not attempting everything at once.

Question 11

What are the business benefits of SMB1001 certification?

Accepted Answer

Beyond the obvious security improvements, certification delivers competitive advantage when tendering for contracts where security credentials are assessed, positions your business well for cyber insurance renewal, and builds stakeholder and client confidence. It also creates a documented foundation that makes progression to more complex frameworks, such as the ACSC Essential Eight or ISO 27001, significantly faster.

Cyber security certification built for your size of business.

Achievable controls. A real certificate. Not just good intentions.

Five control areas. Structured, practical, certifiable.

Start at Bronze. Progress at your own pace.

Bronze

Silver

Gold

Platinum & Diamond

Four stages from gap analysis to certification day.

Gap analysis

Remediation

Certification

Annual renewal

A certificate you can actually use.

Got questions? We have answers.

Related insights

Ready to turn your security posture into something certifiable?