SMB1001 Platinum · Level 4
Platinum is the first tier checked by an independent auditor. It adds vulnerability scanning, phishing-resistant sign-in, tighter cloud and remote access control, and tested, longer-retention backups.
Is Platinum right for you?
What Platinum is for, what it asks of you and what you’ll need to show.
Organisations whose clients, contracts or supply chain want an outside check, not just a director’s confirmation.
Regular scanning of internet-facing systems, phishing-resistant MFA on email, MFA on systems holding important data, VPN and remote desktop, cloud identity and privilege control, an incident response service level from your IT provider and enhanced, tested backups.
Vulnerability scan results, MFA configuration evidence, your IT provider’s incident response agreement, backup restore test records and a backup register, reviewed by an independent auditor.
Requirements
Everything in SMB1001 Gold, plus the controls below.
A documented agreement that key incident response people are available within a set timeframe.
Websites, VPN portals and other public-facing systems scanned regularly, with higher-risk systems scanned more often.
Email sign-in protected by an authenticator app, passkey or hardware key, not SMS or email codes.
Cloud privileges kept to the minimum needed, access keys stored securely and cloud identity linked to your main directory where possible.
Multi-factor sign-in on every system that stores critical, sensitive or operational information.
A second sign-in step on every VPN and remote desktop connection, where these are used.
Frequent backups with longer retention, aligned to your asset register, with a restore plan tested at least once a year.
How we get you there
Run by the same team that manages your IT, with nothing handed back to you to figure out.
01
We check your controls against Platinum and every tier below it, and show exactly what’s missing.
02
As your IT provider, we close the gaps, from device settings to policies and plans.
03
We prepare the evidence in the form CyberCert expects and coordinate the independent audit.
04
We submit for certification and plan the renewal so your certificate stays current each year.
Platinum is scoped as a separate engagement. Business Protect Enhanced and Elite give you a strong starting point, and we prepare your evidence and coordinate the independent audit, which carries a separate audit fee.
FAQs
Anything else? Book an assessment and we’ll talk it through.
An independent auditor reviews your evidence before CyberCert issues the certificate. We prepare the evidence pack and coordinate the audit for you.
Yes. The independent audit has its own fee, separate from our work. We confirm it in your proposal.
Usually two to three months, depending on how many gaps need closing and the auditor’s availability.
Compare the tiers
Requirement counts are cumulative: each tier includes everything below it.
Talk to us
Book an assessment and we’ll show you how close you are to SMB1001 Platinum, what to fix first and how long it will take.
