SMB1001 Gold · Level 3
Gold adds detection and response on every device, multi-factor sign-in across your business apps, and the policies, incident plan and insurance that clients and tenders ask about.
Is Gold right for you?
What Gold is for, what it asks of you and what you’ll need to show.
Firms that hold confidential client information, or whose clients, tenders or insurers ask for written policies, an incident response plan and device-level threat detection.
Endpoint detection and response on every device, MFA on all business applications, stronger email authentication, formal policies, an incident response plan, a digital asset register and cyber insurance.
Approved policies and an incident plan with owners and dates, device protection and sign-in reports, insurance details and a current asset register.
Requirements
Everything in SMB1001 Silver, plus the controls below.
Every workstation, laptop and server monitored for suspicious behaviour, with the ability to isolate a device when needed.
A business password manager for everyone who manages more than one set of credentials.
Multi-factor sign-in extended from email to every cloud business application and business social media account.
If remote desktop is used, it is only reachable through a secure VPN or gateway.
DKIM and DMARC added to SPF, so receiving servers can reject email that impersonates your domain.
A policy that covers cyber incidents, response and recovery costs.
A formal policy covering security requirements, staff responsibilities and acceptable use, acknowledged by every employee.
A documented plan with contacts, steps, communication, containment and recovery.
Sensitive paper destroyed securely, and devices and storage wiped before disposal, resale or donation.
A maintained record of where your sensitive and critical information is stored.
Rules for which AI tools can be used, what information can go into them and how the risks are managed.
Continuous training including phishing simulations, with policies reviewed each year.
How we get you there
Run by the same team that manages your IT, with nothing handed back to you to figure out.
01
We check your controls against Gold and every tier below it, and show exactly what’s missing.
02
As your IT provider, we close the gaps, from device settings to policies and plans.
03
We prepare the evidence in the form CyberCert expects, ready for director sign-off.
04
We submit for certification and plan the renewal so your certificate stays current each year.
Business Protect Enhanced and Elite include an SMB1001 Gold certification program, completed within 90 days of formal kickoff, with 24×7 managed detection and response.
FAQs
Anything else? Book an assessment and we’ll talk it through.
Often, yes. If no one has named a tier, Gold is a common target for firms that hold confidential client information, because it adds policies, an incident plan and device-level detection. We confirm it against what your clients and insurers are asking for.
No. Gold is the highest director-attested tier. A director confirms the controls, backed by evidence we prepare and submit to CyberCert.
We can’t promise that. Insurers make their own decisions, but a Gold certificate gives you clear evidence of your controls to provide at renewal.
Compare the tiers
Requirement counts are cumulative: each tier includes everything below it.
Talk to us
Book an assessment and we’ll show you how close you are to SMB1001 Gold, what to fix first and how long it will take.
