Security Published May 2026 · 7 min read
Every Australian organisation — regardless of size, industry, or technical sophistication — faces the same fundamental question: where do we start with cyber security? The threat landscape is complex, compliance requirements keep expanding, and frameworks like the Essential Eight or ISO 27001 can feel overwhelming when you’re a 15-person business trying to keep the lights on. That’s exactly the gap SMB1001 was designed to fill.
SMB1001, administered by CyberCert, is a multi-tiered cyber security certification built specifically for small and medium businesses. But its real power is broader than the name suggests: it provides a structured, achievable starting point for any organisation that wants to get serious about cyber security without drowning in complexity.
What Is SMB1001?
SMB1001 is an Australian-developed cyber security standard that takes a fundamentally different approach to certification. Rather than presenting a single, high bar that organisations must clear in one leap, it provides five progressive tiers — Bronze, Silver, Gold, Platinum, and Diamond — each building on the controls of the tier below.
The framework covers five key domains: Technology Management, Access Management, Backup & Recovery, Policies & Processes, and Education & Training. The latest edition, SMB1001:2026, expanded the Gold tier from 23 to 27 controls and made email authentication (SPF, DKIM, and DMARC) mandatory from Silver level upward — reflecting the reality that email remains the number one attack vector for Australian businesses.
CyberCert certifications are recognised across Australia, New Zealand, Singapore, the Americas, and the South Pacific, and the 2026 edition publishes formal control mappings to ISO 27001, the UK’s Cyber Essentials, the US Department of Defense’s CMMC framework, and Australia’s own Essential Eight.
Why SMB1001 Works as a Starting Point
1. It Meets You Where You Are
The biggest barrier to cyber security improvement isn’t a lack of good intentions — it’s the gap between where an organisation is today and where a framework says it should be. ISO 27001 is a gold standard, but for a 20-person business with no dedicated IT team, the gap between “current state” and “certified” can feel like a canyon.
SMB1001’s tiered structure solves this. Bronze certification requires foundational controls that most businesses can implement within weeks: antivirus on all devices, regular software updates, strong passwords, and basic data backups. You don’t need to hire a CISO or overhaul your entire infrastructure. You start with what matters most and build from there.
2. It’s Genuinely Affordable
Cost is a real consideration, and SMB1001 respects that. The lower tiers are self-assessed with modest annual fees, while higher tiers involve external audits — but even then, the investment is a fraction of what ISO 27001 certification costs. Because each tier delivers genuine security improvement, the investment pays for itself in reduced risk from the first month. Contact us for current pricing and we’ll help you find the right tier for your budget.
3. It Creates Momentum, Not Paralysis
One of the least discussed problems with comprehensive frameworks is that they can create analysis paralysis. When an organisation is presented with 114 controls (ISO 27001) or dozens of sub-requirements, the natural response is to defer — “We’ll get to it next quarter.” Next quarter never comes.
SMB1001’s Bronze tier is deliberately narrow. It asks for a small number of high-impact controls, and the act of achieving certification creates organisational momentum. Teams see that cyber security improvement is achievable, leadership sees a certificate they can show clients and insurers, and the next tier suddenly looks manageable rather than overwhelming.
4. It Speaks the Language of Business
Frameworks designed by security professionals tend to speak in technical jargon. SMB1001 is written for business owners and operational managers. The controls are described in plain language, the assessment process is straightforward, and the certification itself is something non-technical stakeholders can understand and communicate.
This matters more than it sounds. Cyber security programmes fail when they’re confined to the IT department. They succeed when the entire organisation understands what’s expected and why. SMB1001’s accessibility makes it a tool for cultural change, not just a compliance checkbox.
5. It Maps to Larger Frameworks
Starting with SMB1001 doesn’t mean staying there. The 2026 edition publishes formal control mappings to ISO 27001, the Essential Eight, UK Cyber Essentials, and the US CMMC framework. This means that every control you implement for SMB1001 counts toward your progress if you later pursue a more comprehensive certification.
For organisations that know they’ll eventually need ISO 27001 — perhaps because of enterprise clients or regulatory requirements — SMB1001 provides a structured on-ramp. You build the foundation now, demonstrate progress to stakeholders, and expand the programme when the business is ready.
Who Should Consider SMB1001?
The short answer is: virtually every organisation that doesn’t already hold a recognised cyber security certification. But some scenarios make it particularly compelling.
Businesses tendering for contracts. Government agencies and large enterprises increasingly require evidence of cyber security posture from their suppliers. An SMB1001 certification — even at Bronze — provides a verifiable, third-party-backed credential that sets you apart from competitors who can only offer vague assurances.
Organisations seeking better insurance terms. Cyber insurance premiums have risen sharply across Australia. Insurers are beginning to recognise SMB1001 certification as evidence of risk reduction, and some are offering preferential terms to certified businesses. A certificate costs far less than the premium reduction it can unlock.
Businesses handling sensitive client data. If your clients trust you with their financial records, health information, legal documents, or personal data, you have an obligation to protect it. SMB1001 gives you a framework to demonstrate that you take that obligation seriously — and a certificate to prove it.
Organisations with no formal security programme. If your current approach to cyber security is “we use antivirus and hope for the best,” SMB1001 Bronze is the logical first step. It formalises the basics without requiring a massive investment, and it gives your team a clear set of expectations to work toward.
The Five Tiers Explained
Bronze covers the absolute essentials: antivirus and endpoint protection, software updates, strong password practices, regular data backups, and basic physical security. Self-assessed, and achievable by most businesses in a matter of weeks.
Silver adds access control policies, email authentication (SPF, DKIM, DMARC), multi-factor authentication for critical systems, and a documented acceptable use policy. Still self-assessed, and a meaningful step up from Bronze.
Gold introduces incident response planning, vendor risk management, staff security training with defined cadence, configuration management, and regular vulnerability scanning. This tier requires an external audit, which adds rigour and credibility.
Platinum builds on Gold with advanced threat detection, penetration testing, business continuity planning, and more sophisticated access controls. This is where mid-market businesses typically land.
Diamond represents the highest tier of the framework and aligns closely with ISO 27001-level controls. It’s designed for organisations with mature security programmes that want formal recognition within the SMB1001 ecosystem.
Getting Started: A Practical Path
The path to SMB1001 certification is simpler than most people expect.
Step 1: Assess your current state. Review your existing security controls against the Bronze requirements. Most organisations find they already meet some of the criteria — they just haven’t formalised or documented them.
Step 2: Close the gaps. For Bronze, this typically means ensuring antivirus is deployed on every device, enabling automatic updates, implementing a password policy, and verifying your backup process works. These are practical, implementable tasks — not a six-month project.
Step 3: Self-assess and certify. Complete the CyberCert self-assessment for Bronze or Silver. The process is straightforward and can be done in a single sitting once your controls are in place.
Step 4: Communicate your certification. Display your CyberCert badge on your website, include it in proposals and tenders, and notify your insurer. The certificate has value — make sure your stakeholders know about it.
Step 5: Plan your next tier. Once Bronze is in place, review the Silver requirements and set a timeline. Most organisations can progress from Bronze to Silver within three to six months.
How Computers Unleashed Can Help
As a CyberCert accredited partner, we guide Melbourne businesses through every stage of SMB1001 certification. Whether you’re starting from scratch at Bronze or pushing toward Gold and beyond, we handle the gap analysis, implement the technical controls, prepare your documentation, and support you through the assessment process.
We’ve seen firsthand how SMB1001 transforms the way organisations think about cyber security — from a vague anxiety into a structured, manageable programme with visible progress. If you’re ready to take that first step, we’d be happy to talk you through it.