info@insourceit.com.au 08 6214 0456
Insource IT

SMB1001 Certification Support for Perth Businesses

From your first gap assessment to a CyberCert certificate, and every renewal after. We hold SMB1001 Gold ourselves, so we know exactly what each control asks of you.

Book a free gap call → Compare the levels
Since 2015
ISO 27001 certified
ISO 27001
5.033 Google reviews
6am to 6pm
The basics

What is SMB1001?

SMB1001 is a multi-tiered cyber security certification standard designed specifically for small and medium businesses. It is published by Dynamic Standards International (DSI), and in Australia certificates are issued by CyberCert.

Instead of a single pass or fail test, SMB1001 has five progressive levels. You start at the level that fits your business today and step up as your security matures, or as customers, insurers and tenders start asking for more.

The current edition is SMB1001:2025. DSI reviews the standard regularly so its controls keep pace with real threats, and certification is renewed every year.

New to the standard? Read our full guide: What is SMB1001 and does my business need it?

Why businesses get certified

  • Customers and head contractors asking for proof of cyber security in the supply chain
  • Cyber insurance questionnaires that ask about specific controls
  • Tenders that score security credentials
  • A clear, affordable roadmap instead of a vague to-do list
  • A stepping stone towards ISO 27001
Five tiers

The SMB1001 certification levels

Each level includes everything below it and adds further controls. The right level depends on what your customers trust you with, not just the size of your business.

Level 1

Bronze

The essential foundations. A sensible first step for very small teams.

Director attestation

Level 2

Silver

Adds stronger access, backup and policy controls for growing businesses.

Director attestation

Level 3 · Most popular

Gold

A strong, well-rounded posture. The level most customers and supply chains ask for, and the level we hold.

Director attestation

Level 4

Platinum

For businesses handling sensitive client data or working in regulated supply chains.

Independent audit

Level 5

Diamond

The highest tier, adding security testing and further governance rigour.

Independent audit

What it covers

The five areas SMB1001 assesses

Technology management

Patching, antivirus, firewalls and keeping devices and software supported.

Access management

Multi-factor authentication, admin rights and who can reach what.

Backup and recovery

Reliable, tested backups so you recover quickly from ransomware or failure.

Policies, plans and procedures

Documented policies and an incident response plan your team can follow.

Education and training

Security awareness training so staff recognise phishing and scams.

How we help

Our SMB1001 certification process

A clear, six-step path. We do the technical heavy lifting so your team can keep running the business.

  1. Gap assessment

    We review your environment against the SMB1001 controls and show you what is in place and what is missing.

  2. Choose your target level

    We recommend the right level for your customers, contracts and risk, with a fixed scope before work starts.

  3. Remediation

    Our engineers implement the missing controls: MFA, patching, backups, device hardening and more.

  4. Policies and evidence

    We prepare the policies, plans and evidence each control needs, so your director can attest with confidence.

  5. Certification

    We guide you through the CyberCert application, or the independent audit for Platinum and Diamond.

  6. Stay certified

    We maintain your controls and documentation and look after the annual renewal, so certification never lapses.

Compare frameworks

SMB1001 vs Essential Eight vs ISO 27001

These frameworks work together rather than compete. In short:

SMB1001

A recognised certificate for SMBs at a practical cost, from Bronze to Diamond.

Essential Eight

The Australian Government’s core technical controls, assessed against maturity levels. No certificate. Essential Eight services

ISO 27001

The externally audited international standard, often required in government and defence supply chains. ISO 27001 readiness

Read the full comparison →Working on defence contracts? See our DISP compliance service.
Insource IT team members in a meeting with a client
Why work with us

We have been through it ourselves

Insource IT holds SMB1001 Gold (Level 3) certification with CyberCert and is ISO 27001 certified. We have implemented these controls in our own business and maintain them every day.

Most SMBs do not have a full-time security team. As your managed service provider, supporting businesses across Perth and Melbourne, we become that team: implementing the controls, keeping the evidence current and looking after renewals.

CyberCert SMB1001 Gold Level 3 certifiedISO 27001 certified
Book a free gap call →
Get started

Find out where you stand against SMB1001

Book a free, no-obligation call. We will talk through your business, your customers and which SMB1001 level makes sense.

Book a free gap call → 08 6214 0456
Our services

We can also help with

Insource IT service desk engineer on a headset

IT Support

Reliable managed services and IT support in Perth at a fixed cost.

Learn more →
Cyber security specialist monitoring systems

Cyber Security

A multi-layered and proactive approach builds your defences online.

Learn more →
Illustration of an AI chip connected to a network

AI Services

Adopt AI safely with governance, Copilot readiness and managed AI.

Learn more →
Our partners
Microsoft 365 Dell HP Lenovo Ubiquiti Yealink Kaseya ThreatLocker
Testimonials

What our clients say

5.0
33 Google reviews
The entire Insource IT team are so helpful, approachable, non-judgemental, and most importantly, knowledgeable. They will go out of their way to help you, no matter the issue.
M Sheen · Google review
Insource IT have your business’s best interest at heart. They’ll go the extra mile to explain where your IT budgets should be spent to keep you up to date with your industry’s security, compliance and IT standards.
C Diekman · Google review
Wonderful team! They are always pleasant and easy to reach, and masters at what they do. Highly recommend to anyone needing help in IT.
F Bustillo · Google review
Latest insights

Tips and news from our team

All insights →
Operational technology and server equipment
5 Aug 2026 · Security

Operational Technology (OT) security: how to map, back up, and protect the systems that keep your business running

 Worker in hi-vis at a mine site with haul trucks
13 Jul 2026 · Mining

Cyber security for mining companies: what a 48-hour outage really costs a remote site

 Site engineer in hi-vis checking a tablet on a construction site
2 Feb 2026 · Remote sites

How smart IT keeps remote sites running smoothly
FAQs

SMB1001 questions we often hear

SMB1001 is a cyber security certification standard built for small and medium businesses. It has five progressive levels, from Bronze to Diamond, and is published by Dynamic Standards International. In Australia, certificates are issued by CyberCert.

Both, depending on the level. Bronze, Silver and Gold are attested by a company director, with the certificate issued by CyberCert. Platinum and Diamond require an independent third-party audit.

It depends on who you work with and what data you hold. Many supply chains and customers ask for Gold. If you hold sensitive client data or work in regulated industries, Platinum or Diamond may be expected. Our gap assessment recommends the right level for you.

It depends on how many controls you already have in place and the level you are aiming for. After the gap assessment we give you a clear plan and timeline before any work begins.

There are two parts: the certification fee paid to CyberCert, and the work needed to close any gaps. We scope the implementation after the gap assessment so you know the full cost up front.

Certification is renewed annually to confirm your controls are still in place. Our clients have this managed as part of their ongoing service.

SMB1001 aligns with many Essential Eight strategies, so working through it also lifts your Essential Eight maturity. It can also be a practical stepping stone towards ISO 27001 certification.

Many insurance questionnaires ask about the same controls SMB1001 covers, such as MFA, backups and patching. Having them in place, with evidence, makes those questionnaires much easier to answer.

Insource IT engineer on a headset working at a laptop