The short answer: SMB1001 is an Australian cyber security certification designed specifically for small and medium businesses. It has five levels, from Bronze to Diamond, and each level adds more controls. If your clients, insurers or tenders are asking how you protect their data, SMB1001 is one of the most practical ways to prove it.
Until recently, small businesses had two awkward choices: the Essential Eight, which you are assessed against but cannot be certified to, or ISO 27001, which is thorough but demanding for a business of 15 people. SMB1001 fills the gap in between. It gives you a recognised certificate, built around controls that are realistic for smaller organisations.
Who created SMB1001?
SMB1001 is published by Dynamic Standards International (DSI). In Australia, certification is issued through CyberCert. The standard is called "dynamic" because DSI revises it every year to keep up with current threats. The 2026 edition was released in late 2025 and applies to certifications from 2026.
The five levels
Each level builds on the one before it, so you can start small and step up as your business grows or your clients ask for more.
| Level | Typical focus | How it is assessed |
|---|---|---|
| Bronze (Level 1) | The basics: firewall, antivirus, automatic patching, backups, password hygiene and staff awareness | Director attestation |
| Silver (Level 2) | Adds MFA on email, a password manager, non-admin accounts, email anti-spoofing and invoice fraud procedures | Director attestation |
| Gold (Level 3) | Adds endpoint detection and response, MFA on business apps, an incident response plan, cyber insurance and policies | Director attestation |
| Platinum (Level 4) | More advanced controls for businesses with higher risk or larger clients | Independent verification |
| Diamond (Level 5) | The most comprehensive level, for organisations that need the strongest assurance | Independent verification |
Certification is renewed every year, so it reflects how you operate today, not a one-off project from years ago.
What changed in SMB1001:2026?
The 2026 edition raised the bar, particularly at Gold. Businesses certifying or renewing at Gold now need to show:
- Endpoint detection and response (EDR) on every workstation, laptop and server, not just traditional antivirus.
- Full email authentication: SPF, DKIM and an enforced DMARC policy that quarantines or rejects spoofed email.
- Cyber insurance as a required control.
- A written policy on the responsible use of AI, reflecting how quickly staff have adopted AI tools. Our AI governance work covers this.
If you were certified under an earlier edition, expect to demonstrate these at your next annual renewal.
Does my business need SMB1001 certification?
SMB1001 is voluntary. Nobody will fine you for not having it. But there are good reasons it is becoming popular:
Your clients are asking
Larger companies increasingly send security questionnaires to their suppliers. A certificate answers many of those questions in one go, and shows you have taken security seriously.
Government and enterprise work
Supply chain security is now a standard part of tenders and contracts. SMB1001 gives smaller suppliers a credible, affordable way to demonstrate their controls.
Cyber insurance
Insurers ask detailed questions about MFA, backups and endpoint protection. The controls SMB1001 requires line up closely with what insurers look for, which can make renewals simpler. See our guide to cyber insurance questionnaires.
It gives you a roadmap
Even without the certificate, the levels give you a clear, prioritised list of what to fix first. Many businesses use Bronze and Silver as a practical starting plan.
SMB1001 is probably not your best choice if a major client or tender specifically requires ISO 27001. In that case, ISO 27001 is the target, although SMB1001 work will still count towards it.
SMB1001 vs the Essential Eight vs ISO 27001
These are not competing options. The Essential Eight is a set of technical controls from the Australian Signals Directorate. SMB1001 wraps similar controls in a certification designed for smaller businesses, plus policies and staff training. ISO 27001 is the international standard for a complete information security management system. We compare all three in detail in our guide, Essential Eight vs SMB1001 vs ISO 27001.
How to get started
- Pick a target level. Most small businesses start with Bronze or Silver and work towards Gold.
- Do a gap assessment. Compare your current setup against the controls for your target level.
- Close the gaps. Typical work includes MFA, EDR, email authentication, backups, staff training and a few written policies.
- Certify through CyberCert. At Bronze to Gold, a director attests that the controls are in place.
- Keep it current. Review your controls during the year so renewal is straightforward.
Because Bronze to Gold are director-attested, it matters that the controls are genuinely in place. A director is putting their name to it, and your clients and insurers will rely on it.
What we learned certifying ourselves
Insource IT holds SMB1001 Gold (Level 3), as well as ISO 27001. The biggest lesson was that the technical controls are rarely the hard part. The work is in making them consistent across every device and every person, writing policies that reflect how you actually operate, and keeping evidence as you go. That is the experience we bring when we help Perth businesses prepare for SMB1001 certification.
Frequently asked questions
Is SMB1001 mandatory?
No. It is a voluntary certification, but clients, insurers and government buyers increasingly ask for evidence like it.
How long does SMB1001 certification last?
Certification is renewed annually, and the standard itself is updated each year.
Is SMB1001 Gold independently audited?
No. Bronze, Silver and Gold are attested by a company director. Platinum and Diamond require independent verification.
Can SMB1001 help with ISO 27001 later?
Yes. Many SMB1001 controls overlap with ISO 27001, so the work you do now counts towards ISO 27001 if you need it in future.