SMB1001 Certification: Cyber Security for SMEs

What Is SMB1001?

SMB1001 is a cyber security certification standard developed by Cyber Security Certification Australia (CSCAU), designed specifically for small and medium-sized businesses. Unlike enterprise-focused frameworks such as ISO 27001 or the ASD Essential Eight (which was originally built for government agencies), SMB1001 was created from the ground up to be achievable, affordable and practical for businesses that do not have dedicated IT security teams.

The standard recognises that SMEs face many of the same cyber threats as large organisations but have a fraction of the resources to address them. SMB1001 provides a structured, tiered pathway that allows businesses to progressively improve their cyber security posture without being overwhelmed.

Why Certification Matters for SMEs

According to the ASD’s Annual Cyber Threat Report 2023–2024, small businesses reported average losses of approximately $46,000 per cybercrime incident. Yet many SMEs still operate without any formal cyber security framework. Certification provides several tangible benefits:

• Supply chain trust: Larger organisations increasingly require suppliers to demonstrate a minimum cyber security standard. SMB1001 certification gives you a recognised credential to show customers and partners.
• Insurance advantages: Some cyber insurance providers offer premium discounts or more favourable terms for SMB1001-certified businesses.
• Competitive differentiation: In a tender or procurement process, certification can be the factor that sets you apart from competitors.
• Structured improvement: The tiered model gives you a clear roadmap rather than trying to figure out what to do first.
• Due diligence evidence: Certification demonstrates to regulators, courts and stakeholders that you have taken reasonable steps to protect data and systems.

The Five Certification Tiers

SMB1001 uses a progressive tier system. Each tier builds on the one below it, adding more controls as your maturity increases. You can certify at whatever level is appropriate for your business and work your way up over time.

Tier	Focus	Key Requirements
Bronze	Foundational hygiene	Antivirus/endpoint protection, automatic OS and application updates, basic backup procedures, unique passwords for all accounts
Silver	Access control & awareness	Multi-factor authentication on critical systems, staff cyber awareness training, access control policies, mobile device management basics
Gold	Governance & response	Documented cyber security policy, incident response plan, regular vulnerability scanning, data classification, vendor security assessment
Diamond	Advanced controls	Network segmentation, security information and event management (SIEM) or equivalent monitoring, penetration testing, business continuity planning
Platinum	Continuous improvement	Threat intelligence integration, security operations capability, regular red team exercises, board-level cyber risk reporting, continuous compliance monitoring

Most small businesses will start at Bronze and work towards Silver or Gold. Diamond and Platinum are typically relevant for larger SMEs, businesses handling sensitive data, or those in regulated industries.

The Certification Process

Getting certified involves several steps:

1. Self-assessment: Review the requirements for your target tier and identify gaps in your current practices.
2. Remediation: Address the gaps. For Bronze, this might be as simple as enabling automatic updates and installing endpoint protection. For higher tiers, you may need to develop policies, implement MFA, or establish an incident response plan.
3. Application: Submit your certification application through the CSCAU portal, including evidence of compliance with each control.
4. Verification: For Bronze and Silver, certification is primarily self-assessed with a declaration. Gold and above typically involve an independent audit or assessment.
5. Certification: Once verified, you receive your SMB1001 certificate and digital badge, valid for 12 months.
6. Annual renewal: Recertification is required annually, encouraging continuous maintenance of your security posture.

Cost

One of the key advantages of SMB1001 is affordability. Certification fees for Bronze and Silver tiers start from a few hundred dollars — a fraction of the cost of ISO 27001 certification, which can run into tens of thousands. The total cost will depend on your starting point and how much remediation is required, but for most SMEs the investment is modest relative to the protection and credibility it provides.

How Does SMB1001 Compare to Other Frameworks?

Australian businesses have several frameworks to choose from. Here is how SMB1001 stacks up against the most common alternatives:

Aspect	SMB1001	Essential Eight	ISO 27001
Designed for	SMEs specifically	Government; adapted for all	Enterprises of all sizes
Certification available	Yes (CSCAU)	No formal certification	Yes (accredited bodies)
Cost	Low ($hundreds)	Free (self-assessment)	High ($10K–$50K+)
Complexity	Low to moderate	Moderate	High
Tiered approach	5 tiers (Bronze–Platinum)	4 maturity levels (0–3)	Pass/fail
Australian focus	Yes	Yes	International

For a deeper comparison of these and other frameworks, see our framework comparison guide. In practice, SMB1001 and the Essential Eight are highly complementary — many of the Essential Eight controls map directly to SMB1001 requirements.

This is where a framework-independent operating model becomes valuable. The IDIA framework organises every cybersecurity control into four pillars — Identity, Data, Infrastructure and Assurance — and maps cleanly to SMB1001 alongside ISO 27001, NIST CSF, CIS Controls, Essential Eight, PCI DSS and SOC 2. Rather than locking your business into a single standard, IDIA gives you a unified view of your security posture that translates across whichever certification or framework you choose to pursue.

Getting Started With SMB1001

If you are considering SMB1001 certification, here is a practical approach:

• Start at Bronze. Do not try to jump to Gold on day one. Bronze covers the fundamentals and gives you a solid foundation to build on.
• Use the standard as a checklist. Work through each Bronze requirement systematically. Most can be implemented in days, not months.
• Document everything. Certification requires evidence. Keep records of what you have implemented, when, and how.
• Plan your progression. Once certified at Bronze, set a timeline for Silver. Each step up meaningfully improves your security posture.
• Communicate your certification. Add your certification badge to your website, proposals and email signatures. It is a competitive advantage — use it.

“SMB1001 gives small businesses something that was previously missing: an achievable, recognised cyber security certification that does not require enterprise budgets or dedicated security teams.”

Know Where You Stand

Before pursuing certification, it helps to understand your current cyber security posture. Platforms like How’s My Cyber use the IDIA framework (Identity, Data, Infrastructure, Assurance) to organise every control into a clear operating model that works alongside any standard — including SMB1001. Start with the free CYBER9 assessment to benchmark your business across nine critical domains in under 10 minutes. You will receive a clear maturity score and prioritised recommendations that can serve as your roadmap to certification readiness.