SMB1001 Certification in Australia: Levels, Requirements, Cost and How to Prove Your Controls Work

SMB1001 is a five-level cyber security certification built for small and medium businesses, with tiers named Bronze, Silver, Gold, Platinum and Diamond. It's published by Dynamic Standards International (DSI), an Australian not-for-profit, and certificates are issued through CyberCert. Bronze, Silver and Gold are attested by a company director; Platinum and Diamond are independently audited. For most Australian SMBs holding client data, Gold is the realistic target. The catch is that a director has to sign off that the controls actually work, so get evidence before you sign.

I get asked about SMB1001 more and more, usually by business owners who've just been sent a supplier questionnaire, a tender clause or an insurance renewal that mentions it. This guide covers what SMB1001 is, what each level asks for, how it compares to the Essential Eight and ISO 27001, what it costs to get there, and where independent testing fits. It's written for Australian SMB owners, practice managers and the MSPs who look after them.

What is SMB1001?

SMB1001 is a tiered cyber security standard designed specifically for small and medium-sized businesses, with a certificate you can show clients, insurers and procurement teams. It sits between "we have antivirus" and a full ISO 27001 management system.

A few facts worth knowing, straight from DSI's SMB1001 page:

• ▸Who runs it: Dynamic Standards International, a not-for-profit and ACNC-registered charity, maintains the standard. DSI doesn't issue certificates itself.
• ▸Who certifies: CyberCert is currently the authorised certifier (DSI calls it a Dynamic Standard Certifier). BSI Group and InfoSecAssure are listed as independent verification organisations.
• ▸Current edition: SMB1001:2026, released on 1 September 2025. DSI updates the standard annually.
• ▸Five control areas: technology management, access management, backup and recovery, policies, plans and procedures, and education and training.
• ▸Alignment: DSI says SMB1001 has been mapped to the UK's Cyber Essentials and the US CIS Controls and CMMC.

You don't have to climb all five levels. You certify at the tier that fits your size, data and customer expectations, then step up over time.

Why are Australian businesses being asked for SMB1001?

Because buyers, insurers and professional bodies want proof of basic cyber hygiene from small suppliers, and SMB1001 gives them a simple badge to ask for. It's a contractual or commercial requirement, not a legal one. No Australian law makes SMB1001 mandatory.

The pressure is real, though. ASD's Annual Cyber Threat Report 2024–25 found:

• ▸The average self-reported cost of cybercrime per report was $56,600 for small businesses (up 14%) and $97,200 for medium businesses (up 55%)
• ▸ASD received over 84,700 cybercrime reports, roughly one every six minutes
• ▸Business email compromise and email compromise were among the top self-reported cybercrime threats for businesses
• ▸ASD said the basics (MFA, strong passwords, updates, phishing awareness and backups) "can prevent the majority of the cyber incidents reported"

That last point is exactly what SMB1001's lower tiers formalise. The other driver is professional bodies. The Queensland Law Society supports SMB1001 and recommends its members work towards Gold as "a reasonable standard for robust cybersecurity and professional assurance". QLS is also clear that the standard doesn't create a safe harbour or guarantee protection.

Where you'll typically see it:

• ▸Supplier onboarding and vendor security questionnaires
• ▸Tenders and panel applications that ask for a recognised certification
• ▸Cyber and professional indemnity insurance renewals
• ▸MSP contracts, where the MSP uses SMB1001 as the roadmap for client uplift

What are the five SMB1001 levels?

The tiers are cumulative: each level includes every control from the levels below, plus new ones. Bronze covers basic hygiene, Silver hardens identity and email, Gold adds detection, response and governance, and Platinum and Diamond add independent verification.

The verification column is the bit vendor marketing tends to skip. As Cyber Perimeter's breakdown of SMB1001:2026 puts it, at Bronze, Silver and Gold "there is no external assessor". A director logs into the portal and personally attests that the controls are in place. Their name goes on the record.

Bronze (Level 1)

DSI lists the Level 1 basics as engaging a technical support specialist, installing and configuring a firewall, running antivirus on all devices, installing software updates automatically, changing passwords routinely and having a backup and recovery strategy for important data. If you're a sole trader or a very small business starting from zero, this is your first badge.

Silver (Level 2)

Silver focuses on accounts and email: no shared logins, MFA on email and key accounts, restricted administrator access and email domain protection (SPF). For a small professional firm, Silver closes many of the gaps behind email compromise and fake invoice fraud.

Gold (Level 3)

Gold is where SMB1001 starts to look like a real security program. Published summaries of the 2026 edition put Gold at 27 controls, adding things like:

• ▸Endpoint detection and response (EDR) on every device, not just antivirus
• ▸MFA across all business applications, not only email
• ▸DKIM and an enforced DMARC policy so criminals can't send email as your domain
• ▸A documented incident response plan
• ▸A register of digital assets
• ▸A formal cyber security policy, staff training and cyber insurance

Check the current edition for the authoritative list, because DSI revises the controls every year.

Platinum and Diamond (Levels 4 and 5)

These tiers add more requirements and, crucially, an independent audit before the certificate is issued. They suit businesses whose customers want third-party assurance rather than a director's signature, such as suppliers into government, defence or enterprise supply chains.

How does SMB1001 compare to the Essential Eight and ISO 27001?

SMB1001 is a certifiable SMB roadmap, the Essential Eight is a technical maturity model with no certificate, and ISO 27001 is a full management system with an audited certificate. They overlap a lot, but they answer different questions.

In practice they complement each other. Many of SMB1001's technical controls (patching, MFA, restricted admin rights, backups) are also Essential Eight strategies, so work on one helps the other. But an SMB1001 certificate doesn't tell you your Essential Eight maturity level, and an Essential Eight assessment doesn't give you a badge. Our comparison of Essential Eight vs ISO 27001 and our guide to whether the Essential Eight is mandatory cover the other two frameworks in more detail.

Which SMB1001 level should your business aim for?

Pick the lowest tier that satisfies the people asking, then plan the next step. For most Australian SMBs that hold client, financial or health information, that means Silver now and Gold within a year.

A simple way to decide:

• ▸Bronze: sole traders and micro businesses with little sensitive data, or anyone who needs a credible first step quickly
• ▸Silver: small offices where one stolen password or one fake invoice would hurt
• ▸Gold: professional services (law, accounting, financial planning), healthcare practices, and any business a client, insurer or tender asks for written policies and an incident response plan. It's also the tier QLS recommends for law practices
• ▸Platinum or Diamond: suppliers whose customers specifically require independent verification

If a customer has named a tier in a contract, that's your answer. If not, ask what they actually need before you overbuild.

What does SMB1001 certification cost?

The certificate itself is the cheap part. The real cost is putting the controls in place, writing the policies and keeping evidence that lets your director sign honestly every year.

Costs fall into four buckets:

1. The standard: DSI sells the SMB1001:2026 document from US$95 for micro businesses (1–20 employees), with higher prices for larger organisations.
2. The certification subscription: CyberCert charges a subscription per tier. Platinum and Diamond also carry a separate external audit fee. Check CyberCert's current pricing before you budget, because fees can change.
3. Implementation: EDR licences, MFA rollout, email authentication, backup tooling and MSP labour. For Gold, this is usually the biggest number by far.
4. Evidence and assurance: policies, training records, an asset register, and independent checks that the controls work.

Certificates run for 12 months, so budget for recertification and for the standard changing each year.

Where does independent testing fit with SMB1001?

Independent testing doesn't replace SMB1001 certification, but it gives your director something better than a hunch to sign against. At Bronze, Silver and Gold, the attestation is only as good as the person signing it, and the person signing it usually isn't technical.

Gaps we commonly find when testing businesses that believe they've "done the basics":

• ▸MFA enforced for most users but not for an old shared mailbox, a service account or the admin portal
• ▸Remote desktop or a VPN appliance exposed to the internet with a known vulnerability
• ▸SPF in place but DMARC left at "none", so spoofing still works
• ▸EDR installed but excluded from servers, or alerting to a mailbox nobody reads
• ▸Backups that run nightly but have never been restored, and are reachable from the same admin account an attacker would steal

None of those show up on a checklist. They show up when someone tries to break in. That's why I'd suggest pairing your SMB1001 work with one of these, depending on budget:

• ▸An automated security assessment from $80 to $2,000 AUD (plus GST) checks your internet-facing systems for the issues attackers scan for, with analyst review and a 24 to 72-hour turnaround
• ▸An Essential Eight assessment for $4,950 + GST (up to 50 seats) technically tests patching, MFA, admin privileges, backups and the other controls that overlap with SMB1001, and gives you a prioritised remediation roadmap
• ▸Human-led penetration testing from $5,000 + GST proves whether an attacker could actually get from the internet, or from one laptop, to your client data

For businesses heading to Platinum or Diamond, independent test reports are also useful evidence to have on hand when the auditor asks how you know your controls are effective. And if you want someone to run the whole program, track your risk register and keep the attestation honest year to year, that's what a vCISO retainer is for, from $2,500 a month. We're not a certifier and we don't sell the certificate; we give you independent evidence to support it.

How should MSPs approach SMB1001?

For MSPs, SMB1001 is a ready-made uplift roadmap you can sell tier by tier, but you shouldn't be the only one checking your own work. DSI explicitly positions the standard as a framework for IT providers and MSPs to take clients through certification.

The independence problem is simple: if your team implements the controls and also tells the client they're working, nobody has actually tested them. Bringing in an independent tester before the director signs protects the client and protects you if something goes wrong later. Our MSP white-label penetration testing service lets you deliver that testing under your own brand, and our white-label partner program has block and per-engagement pricing.

How do you get SMB1001 certified? A step-by-step path

A well-organised business can often reach Silver in weeks; Gold usually takes longer because of the policies, EDR and email work involved. The timeline depends on how many gaps you start with.

1. Confirm the tier you need. Check the contract, tender, insurer or professional body requirement.
2. Buy or review the current edition. Make sure you're working from SMB1001:2026, not an older summary.
3. Do a gap assessment. List each control at your target tier and mark it in place, partial or missing.
4. Fix the gaps. Prioritise MFA, admin rights, email authentication, patching and backups, because those stop the most common attacks.
5. Write the documents. Policies, incident response plan, asset register and training records.
6. Get independent evidence. Test the controls before the director signs, especially anything internet-facing.
7. Certify through CyberCert. Complete the workbook and attestation, or book the external audit for Platinum and Diamond.
8. Maintain it. Re-test after major changes, track the annual edition updates and recertify every 12 months.

Frequently asked questions

Is SMB1001 mandatory in Australia?

No. No Australian law requires SMB1001. It becomes mandatory only when a customer, tender, insurer or professional body makes it a condition of doing business with them.

Is SMB1001 the same as the Essential Eight?

No. SMB1001 is a certifiable standard from DSI covering technology, access, backups, policies and training. The Essential Eight is ASD's set of eight technical mitigation strategies measured by maturity level, with no official certificate. Many controls overlap.

Who issues SMB1001 certificates?

CyberCert is currently the authorised certifier for SMB1001. DSI maintains the standard but doesn't issue certificates directly.

Is an SMB1001 Gold certificate independently audited?

No. Bronze, Silver and Gold are self-attested by a company director. Only Platinum and Diamond require an independent audit, so describe your certificate accurately when you list it on tenders.

How long does an SMB1001 certificate last?

Certificates are valid for 12 months. You then recertify, and because DSI updates the standard annually, the requirements may have changed.

Does SMB1001 require a penetration test?

SMB1001 is a controls standard rather than a testing standard, so check the current edition for what your tier requires around vulnerability management. Either way, testing is the most reliable way to confirm the controls you're attesting to actually work, and it gives you evidence if a client or insurer asks.

Can an MSP get its own clients certified?

An MSP can implement controls and guide clients through the process, and DSI promotes SMB1001 for exactly that. For credibility, pair it with independent testing so the same team isn't marking its own homework.

Bottom line

SMB1001 gives Australian small businesses an affordable, tiered way to prove cyber hygiene to the people who ask for it. For most firms holding client data, Gold is the sensible target. But Bronze to Gold rely on a director's signature, so the certificate is only as strong as the evidence behind it.

If you're working towards SMB1001 and want to know your controls hold up before you sign, book a 1-on-1 call and I'll recommend the smallest scope that gives you real evidence, whether that's an $80 automated assessment, an Essential Eight assessment or a full pentest. Full details are on our pricing page.

Sources

• ▸DSI: SMB1001:2026 Cybersecurity Standard for SMBs
• ▸Queensland Law Society: SMB1001 Cybersecurity Standard
• ▸ASD: Annual Cyber Threat Report 2024–25
• ▸Cyber Perimeter: SMB1001:2026 explained, the five tiers
• ▸CyberCert: SMB1001 certification
• ▸Aussie Pentest: Pricing

This article is general information only, not legal, compliance or insurance advice. SMB1001 requirements change with each annual edition, so confirm the current controls with DSI or CyberCert before you attest. Aussie Pentest is not an SMB1001 certifier or auditor, and our reports support your evidence but don't guarantee acceptance by a certifier, client or insurer. Prices are current as of October 2026, and sources were checked on 27 October 2026. Only test systems you have written authority to assess.