SMB1001 Bronze · Level 1
Bronze is the first SMB1001 tier: seven foundational controls that stop the most common attacks, confirmed by a director and certified for 12 months.
Is Bronze right for you?
What Bronze is for, what it asks of you and what you’ll need to show.
Small businesses that already do the basics but have never had to prove it, or that have been asked for a certificate for the first time.
Seven practical controls covering devices, updates, passwords, backup, training and having an IT professional to call.
Settings and reports from your devices and tools, staff training records and a description of how your backup is kept separate.
Requirements
The seven foundation controls of SMB1001.
Access to a qualified IT professional or managed service provider who can put the other controls in place and help when something goes wrong.
A firewall installed, switched on and set up properly, with default passwords changed.
Current anti-malware protection on every work computer, laptop and phone, with apps installed only from official stores.
Operating systems, applications and browsers updated automatically, and anything that can’t update itself patched on a regular schedule.
Unique passphrases for every account and device, default passwords changed, and passwords reset promptly after a known breach.
At least one backup of critical data kept separate from your main systems, with restores tested so you know it works.
Every staff member trained to spot threats and know what to do, with records kept.
How we get you there
Run by the same team that manages your IT, with nothing handed back to you to figure out.
01
We check your controls against Bronze and every tier below it, and show exactly what’s missing.
02
As your IT provider, we close the gaps, from device settings to policies and plans.
03
We prepare the evidence in the form CyberCert expects, ready for director sign-off.
04
We submit for certification and plan the renewal so your certificate stays current each year.
Small Business Protect includes annual director-attested SMB1001 Bronze certification for businesses with up to 20 staff.
FAQs
Anything else? Book an assessment and we’ll talk it through.
Yes. You don’t have to certify at Bronze first. If someone has asked for Silver or Gold, we can take you straight there, as long as everything in the tiers below is also in place.
No. Bronze is director-attested: a director confirms the controls are in place, backed by evidence that we prepare and submit to CyberCert.
It depends on who is asking. Bronze shows the basics are covered. Many professional services firms are asked for Silver or Gold, so check the requirement before you choose.
Compare the tiers
Requirement counts are cumulative: each tier includes everything below it.
Talk to us
Book an assessment and we’ll show you how close you are to SMB1001 Bronze, what to fix first and how long it will take.
