SMB1001 Diamond · Level 5
Diamond is the top SMB1001 tier: every requirement in the standard, independently verified, including encryption, application control, annual external testing, 24×7 monitoring and supplier assurance.
Is Diamond right for you?
What Diamond is for, what it asks of you and what you’ll need to show.
Organisations that need the highest level of assurance, such as those in sensitive supply chains or handling large volumes of personal information.
All 39 requirements, adding encryption of important data, approved software only, annual external penetration and social engineering testing, managed detection and response, supplier assurance, vetting for privileged staff and a tested incident response plan.
External penetration and social engineering test reports, managed detection and response reports, supplier assessments, encryption and application control evidence, and records of a live incident exercise.
Requirements
Everything in SMB1001 Platinum, plus the controls below.
Sensitive and personal information encrypted wherever it is stored, including devices and cloud services.
Only approved software allowed to run on workstations and laptops, enforced technically.
Untrusted Microsoft Office macros blocked on all workstations, laptops and servers.
Yearly penetration, vulnerability and social engineering testing by an external specialist.
Endpoint detection upgraded to a 24×7 monitored service that investigates alerts and leads the response.
Phishing-resistant sign-in extended to all business applications and social media accounts.
Communication templates and playbooks for clients, staff, regulators and media, including notification obligations.
The asset register extended to show where personal information sits and who can access it, reviewed each year.
A risk-based program that sets minimum cyber security expectations for suppliers and requires them to report incidents.
Police checks for staff and contractors with administrative access or after-hours access to your premises.
The incident plan tested at least once a year through a live exercise, not just a document review.
How we get you there
Run by the same team that manages your IT, with nothing handed back to you to figure out.
01
We check your controls against Diamond and every tier below it, and show exactly what’s missing.
02
As your IT provider, we close the gaps, from device settings to policies and plans.
03
We prepare the evidence in the form CyberCert expects and coordinate the independent audit.
04
We submit for certification and plan the renewal so your certificate stays current each year.
Diamond is scoped as a separate engagement. Business Protect Enhanced and Elite already include 24×7 managed detection and response, and we coordinate the external testing and independent audit, which carry separate fees.
FAQs
Anything else? Book an assessment and we’ll talk it through.
Several Diamond controls, such as application control, blocking untrusted macros, patching, multi-factor sign-in and backups, are also Essential Eight strategies. If you’re also working on Essential Eight maturity, we plan the two together. See our Essential Eight assessment.
Yes, for some controls. Annual penetration and social engineering testing must be done by an external specialist, and police checks are arranged through an accredited provider. We coordinate these as part of the engagement.
Usually two to three months or more, depending on your starting point, the external testing and the auditor’s availability. We scope it with you before work starts.
Compare the tiers
Requirement counts are cumulative: each tier includes everything below it.
Talk to us
Book an assessment and we’ll show you how close you are to SMB1001 Diamond, what to fix first and how long it will take.
