SMB1001 Certification

SMB1001 (often searched as SMB 1001) is an Australian-developed cyber security standard for businesses too small for ISO 27001 who still want a certificate to show for their security work. The Essential Eight offers no certification. The SMB1001 standard does: five tiers, and a certificate to hand to an insurer or attach to a tender. The current edition is SMB1001:2026. This page covers what SMB1001 is, the five tiers, what changed in 2026, how certification works, and how Elscomm prepares a business for it.

SMB1001 in numbers

• 5 certification tiers, Bronze to Diamond
• 27 controls at Gold in the 2026 edition
• 1 year certificate validity before renewal
• 3 tiers signed off by a company director

At a glance

• SMB1001 is an Australian-developed cyber security standard for small and medium businesses.
• It has five tiers: Bronze, Silver, Gold, Platinum and Diamond.
• A company director signs off Bronze to Gold. Platinum and Diamond need independent verification.
• CyberCert issues the certificates, and each one lasts a year.
• It is voluntary. No law requires it. The current edition is SMB1001:2026.

What is SMB1001?

SMB1001 is a cyber security standard built for small and medium businesses. It sets out a defined list of controls, grouped into five tiers. A business certifies at the level matching its size and risk, then moves up.

What does SMB1001 mean in plain terms?

The SMB1001 cyber security framework comes with a certificate at the end. It sits between two options unsuited to most businesses of 15 to 70 staff. ISO 27001 is an international management system standard with a full external audit. The Essential Eight is government guidance with no certification at all. The SMB1001 cybersecurity standard fills the gap between them.

Who created SMB1001? DSI and CyberCert

Dynamic Standards International publishes SMB1001, which is why you will see it written as DSI SMB1001. DSI traded as Cyber Security Certification Australia (CSCAU) until 2023, and older material still uses that name. CyberCert issues the certificates, so CyberCert SMB1001 and the SMB1001 CyberCert portal refer to the same certification process. No IT provider issues SMB1001 certificates.

The SMB1001 framework: five tiers of certification

The SMB1001 tiers run from Bronze to Diamond. Each of the five SMB1001 levels of protection builds on the one below, so SMB1001 controls add up as you climb. SMB1001 requirements at Gold include everything in Bronze and Silver.

The lists below give indicative examples of what each tier covers. Dynamic Standards International publishes the authoritative control set, and it changes with each edition.

SMB1001 Bronze (Level 1)

The foundation. SMB1001 Bronze requirements cover the basic protections every business needs.

• Endpoint protection (antivirus) on business devices
• A firewall protecting the network
• Regular software and operating system updates
• Regular backups
• Safer password practices
• Cyber awareness training for all staff

Evidence to have on file: device protection status, update records, backup confirmations, training records and who owns each control.

SMB1001 Silver (Level 2)

SMB1001 Silver certification adds identity, email and patching controls on top of Bronze.

• Multi-factor authentication on email and key systems
• A password manager
• Individual user accounts instead of shared logins
• Separate, restricted admin accounts
• Server patching
• Email sender authentication (SPF)
• Basic written security processes, including checks before anyone changes payment details

Evidence to have on file: MFA coverage reports, password manager records, server patch records, SPF settings and the payment-change procedure.

SMB1001 Gold (Level 3)

SMB1001 Level 3 is the Gold tier. SMB1001 Gold requirements run to 27 controls in the 2026 edition, up from 23. The SMB1001 Gold controls add detection, full email authentication, insurance and governance.

• Endpoint detection and response (EDR)
• DKIM and an enforced DMARC policy
• Cyber insurance
• A written cyber security policy
• A formal incident response plan
• A digital asset register of systems and data
• Staff cyber security awareness training
• Regular access reviews
• Secure destruction of documents and data
• A policy on responsible AI use

Evidence to have on file: EDR coverage reports, DMARC settings, your insurance policy, approved policies, the incident response plan, the asset register, training records and access review records.

A director still signs off CyberCert SMB1001 Gold certification. Nobody audits it, and this affects what the certificate proves. Many businesses aim for SMB1001 Gold certification because Gold is the highest tier without an external audit.

SMB1001 Platinum (Level 4)

The first independently verified tier. An external organisation checks the controls before CyberCert issues a certificate.

• Formal validation of controls
• Tested backup and recovery
• Stronger MFA on remote access such as VPN and remote desktop
• Tracked vulnerability remediation
• Reviewed and tested incident response procedures
• Supplier and third-party risk records

Evidence to have on file: control review reports, restore test results, remote access settings, a remediation register, incident response exercise notes and supplier security reviews.

SMB1001 Diamond (Level 5)

The highest assurance tier. It is also independently verified and suits businesses with mature security programmes or demanding customers.

• Ongoing monitoring of controls
• Recurring control reviews
• Tested incident response capability
• Management review of unresolved security risks

Evidence to have on file: monitoring summaries, control review packs, incident response test outcomes and management review records.

Which SMB1001 tier fits your situation

What changed in SMB1001:2026

DSI released SMB1001:2026 in September 2025, and it became certifiable on 1 January 2026. It is the current edition. The changes target email-based attacks and threat detection:

• Email authentication: SPF from Silver, and DKIM with an enforced DMARC policy from Gold, to stop criminals sending fake emails from your domain.
• Endpoint detection and response: now required at Gold.
• Cyber insurance: now required at Gold.
• Governance: a digital asset register and incident response planning at Gold.
• Responsible AI use policy: a written policy on how staff use AI tools, required at Gold.
• Staff awareness: cyber awareness training from the entry tier, with formal training at Gold.
• Server patching: now required from Silver.

If you certified under an earlier edition, the SMB1001 2026 changes still apply to you. You need to meet the new and changed controls at your next recertification against the current edition.

How SMB1001 cyber certification works

What is SMB1001 certification in practice? SMB1001 certification requirements depend on the tier. For Bronze, Silver and Gold, you put the controls in place and a company director attests through the CyberCert portal. The certificate issues on that attestation. For Platinum and Diamond, an independent organisation verifies the controls first.

Self-attested tiers: what a director signs

The first three tiers of SMB1001 cyber security certification rest on a director's signature. People often shorten this to SMB1001 cyber cert. So the real question is whether the controls are in place before somebody signs. Once you are SMB1001 certified, the director is on record saying they are. Have evidence for each control before signing.

Independently verified tiers

Platinum and Diamond add an external check, which some larger customers and regulated buyers want to see.

How long SMB1001 certification lasts

An SMB1001 certificate is valid for one year. Renewal is assessed against the current edition of the standard. If the controls have changed since you last certified, you need to meet the new ones to renew.

SMB1001 certification support: how Elscomm prepares you

Elscomm does not apply SMB1001 to every client by default. We provide SMB1001 certification support for businesses who want it. An SMB1001 assessment with Elscomm works out where you stand against your target tier and what has to change. It is not an SMB1001 audit, and Elscomm is not an SMB1001 auditor. Certification runs through CyberCert. An SMB1001 MSP does the work before the certificate:

• Choose the tier matching what your insurer or customers ask for.
• Assess the gaps between your current setup and the tier's controls.
• Close the gaps, from multi-factor authentication and backups to email authentication and endpoint detection.
• Gather the evidence so the director signs with confidence.

Talk to us about SMB1001.

SMB1001 vs Essential 8

People search it both ways, SMB1001 vs Essential 8 and Essential Eight vs SMB1001. It is the most common comparison question on the topic.

• Certification: SMB1001 has five certifiable tiers. The Essential Eight has no certification, only assessment against a maturity model.
• Who it is for: SMB1001 is written for small and medium businesses. The Essential Eight is government guidance written for all organisations.
• Future: DSI updates SMB1001 with new editions. In June 2026, ASD opened consultation on replacing the Essential Eight with a new Essentials series. ASD expects to start deprecating the Essential Eight around mid 2027 and retire it around mid 2028. These are targets, not fixed dates.

SMB1001 vs Essential Eight vs ISO 27001

The controls overlap heavily. Multi-factor authentication, patching, backups and restricted admin access appear in both, so most of the work counts toward both.

SMB1001 vs ISO 27001

This is one of the most common questions about SMB1001. If someone has asked you about SMB1001 ISO equivalence, the short answer is they certify different things. ISO 27001 certifies an information security management system through a full external audit. It suits larger organisations with dedicated security staff. SMB1001 certifies a defined set of practical controls, with self-attestation up to Gold.

If a contract names ISO 27001, nothing else substitutes for it. If a customer or insurer wants evidence you take security seriously, SMB1001 usually gets you there faster.

Is SMB1001 compliance mandatory, and who asks for it?

No. No Australian law requires a business to hold SMB1001, so SMB1001 compliance is voluntary. It is a private market certification, not a government standard. Demand for SMB1001 in Australia comes from the market. Enterprise customers running supplier checks and some tender conditions now name SMB1001 cyber security requirements. Cyber insurers ask about many of the same controls at renewal.

Which SMB1001 tier does your business need?

Start from who is asking. If nobody is asking yet, Bronze puts the basics on record. If an insurer or customer is asking, find out which tier they name and aim for it. If a buyer wants independent proof instead of a director's signature, only Platinum or Diamond give it. For most businesses of 15 to 70 staff, the realistic path is Bronze or Silver first, then Gold once detection and response, email authentication and cyber insurance are in place.

SMB1001 questions answered

What is SMB1001?

SMB1001 is an Australian-developed cyber security standard for small and medium businesses. Dynamic Standards International publishes it, and CyberCert issues the certificates. It has five tiers, Bronze to Diamond, so a business certifies at a level suiting its size and risk and moves up over time.

Is SMB1001 certification audited?

Not at every tier. A company director attests Bronze, Silver and Gold through the CyberCert portal. Platinum and Diamond require independent verification.

How long does SMB1001 certification last?

One year. You renew each year against the current edition of the standard.

What changed in SMB1001:2026?

The 2026 edition made email authentication a requirement from Silver and moved server patching down to Silver. At Gold it added endpoint detection and response, cyber insurance, a digital asset register and an AI use policy. It also brought cyber awareness training into the entry tier. Gold now has 27 controls, up from 23.

Is SMB1001 mandatory in Australia?

No. It is a private market certification, not a government standard, and no law requires it. Enterprise customers and some tenders ask for it.

What is the difference between SMB1001 and the Essential Eight?

SMB1001 offers certification and is written for small and medium businesses. The Essential Eight has no certification, and ASD plans to replace it with its Essentials series. The controls overlap heavily, so work on one counts toward the other.

Is SMB1001 the same as ISO 27001?

No. ISO 27001 certifies a full information security management system through an external audit. SMB1001 certifies a defined set of practical controls, with director attestation up to Gold.

Which SMB1001 tier should we aim for?

Start with whoever is asking. If an insurer or customer names a tier, aim for it. Otherwise most businesses of 15 to 70 staff start at Bronze or Silver and move to Gold once the extra controls are in place.

How does SMB1001 relate to cyber insurance?

Many of the controls insurers ask about at renewal, such as multi-factor authentication, tested backups and endpoint protection, are SMB1001 controls. A certificate is a convenient way to show them. Cyber insurance is itself a Gold requirement under SMB1001:2026. Check with your insurer or broker whether they recognise the certificate.

Can we get SMB1001 certified without an IT provider?

Yes. SMB1001 is written for small and medium businesses, and a director attests through the CyberCert portal. From Silver upwards most controls are technical, such as MFA, email authentication and endpoint detection, so many businesses get help putting them in place.

Who can assess or verify SMB1001?

At Bronze, Silver and Gold, a company director attests the controls are in place. At Platinum and Diamond, an independent organisation verifies the controls before a certificate issues. CyberCert issues all certificates. IT providers prepare you but do not issue certificates.

How long does SMB1001 certification take?

It depends on your starting point. The certificate issues once the controls are in place and attested, so the time goes into closing gaps. A business already running MFA, patching and backups reaches the lower tiers quickly. Gold takes longer because of detection and response, email authentication, cyber insurance and written policies.

Can Elscomm help us get SMB1001 certified?

Yes, on request. Elscomm does not apply SMB1001 to every client by default. We help you choose a tier, close the gaps and gather the evidence before you certify through CyberCert.

Sources: Dynamic Standards International and CyberCert. Last reviewed September 2026.