SMB1001 gives clients, insurers and tenders a certificate they recognise. As a CyberCert partner and your IT provider, we assess where you stand, close the gaps and prepare the evidence to certify you at the tier you need.
CyberCert partner
ISO 27001:2022 certified
Australian owned · Brisbane, Sydney and Melbourne
Why it matters
SMB1001 is the Australian cyber security standard built for small and medium businesses. It turns “we take security seriously” into something you can show.
Answer supplier security questionnaires with a certificate at a defined tier, instead of pages of explanation.
Meet tender and contract requirements that name SMB1001 or a specific tier.
Give your insurer clear evidence of your controls at renewal.
Certificates are valid for 12 months, so your controls are checked and renewed annually, not once.
Who does what
It helps to know who sets the rules, who issues the certificate and who does the work.
Publishes the SMB1001 standard and sets the requirements for each tier.
The certification body that reviews submissions and issues SMB1001 certificates.
A CyberCert partner and your IT provider. We assess your controls, fix the gaps, prepare the evidence and submit it, then keep you ready for renewal.
The five tiers
Every tier includes all the requirements of the tiers below it. Bronze, Silver and Gold are attested by a director. Platinum and Diamond are checked by an independent auditor.
Level 1 · Director-attested
7 of 39 requirements
Usually a few weeks
Level 2 · Director-attested
17 of 39 requirements
Usually weeks
Level 3 · Director-attested
27 of 39 requirements
Usually weeks to a few months
Level 4 · Independently verified
32 of 39 requirements
Usually two to three months, plus the independent audit
Level 5 · Independently verified
39 of 39 requirements
Usually two to three months or more, plus the independent audit
Who checks
The tier you choose decides how your certificate is checked.
A company director confirms the required controls are in place. The confirmation is backed by evidence, such as settings reports, policies and training records, that we prepare and submit to CyberCert.
An independent auditor reviews your evidence before the certificate is issued. The audit has its own fee, and we coordinate it for you.
Built into our services
Our managed services include a defined SMB1001 certification program, so certification is part of how your IT is run.
Bronze
Annual director-attested Bronze for businesses with up to 20 staff.
Silver
A Silver certification program within 60 days of formal kickoff.
Gold
A Gold certification program within 90 days of formal kickoff.
Platinum and Diamond
Scoped to your environment, with the independent audit coordinated by us.
Timelines start at formal kickoff and depend on access, licensing, approvals and the certification body.
How we get you there
A clear, documented path, run by the same team that runs your IT.
01
We measure your controls against every SMB1001 requirement and show the gaps for your target tier.
02
We recommend the tier that answers whoever is asking: a client, a tender or an insurer.
03
As your IT provider, we close the gaps and prepare the evidence in the form the certification body expects.
04
We submit your evidence, coordinate any independent audit and keep you ready for each year’s renewal.
FAQs
Anything else? Book an assessment and we’ll talk it through.
SMB1001 is an Australian cyber security certification standard designed for small and medium businesses. It has five cumulative tiers, from Bronze to Diamond, covering technology, access, backup and recovery, policies and training.
Dynamic Standards International publishes the standard. CyberCert is the certification body that issues certificates. Essential Tech is a CyberCert partner: we assess, remediate, prepare your evidence and submit it.
No. You can certify at the tier you need, provided the requirements of all the tiers below it are also in place.
At Bronze, Silver and Gold, a director confirms the controls are in place, backed by evidence. At Platinum and Diamond, an independent auditor reviews the evidence before the certificate is issued.
Start with what is being asked for by your clients, a tender or your insurer. If no tier has been named, Gold is a common target for firms that hold confidential client information. We’ll recommend a tier after the assessment.
12 months. Certification is renewed each year, and we plan the renewal with you.
It gives you clear evidence of your controls to provide at renewal. Insurers make their own decisions, so we can’t promise a lower premium.
The Essential Eight is the Australian Cyber Security Centre’s maturity model, not a certificate. SMB1001 is a certification, and its higher tiers include several Essential Eight strategies, such as multi-factor sign-in, patching, application control and backups. See our Essential Eight assessment.
Yes. Small Business Protect includes Bronze, Business Protect Essentials includes Silver and Business Protect Enhanced and Elite include Gold. Platinum and Diamond are scoped separately.
Talk to us
Book an assessment and we’ll show you where you stand against each tier, what to fix first and how long it will take.
