SMB1001 explained: the small business cyber certificate
More clients, suppliers and insurers are asking small businesses to show they take cyber security seriously. SMB1001 is a certificate built for that. Here's what it is, how the levels work, what it does and doesn't prove, and how it fits with the Essential Eight and the government's plans.
Last updated
The short answer
SMB1001 is a cyber security standard for small and medium businesses, published by Dynamic Standards International and certified through CyberCert. It has five levels and is updated every year; the current edition is SMB1001:2026. At the lower levels a company director signs off that the controls are in place, and at the higher levels there is independent checking. It is a private certification. It is not a legal requirement, and it is not the government's planned CyberSmart standard.
What SMB1001 is
SMB1001 was written for small and medium businesses that find the Essential Eight or ISO 27001 too much. Each level adds controls such as antivirus, automatic updates, multi-factor sign-in, backups and staff training. A business works through the controls, certifies at the level it reaches, and renews each year as the standard is updated. CyberCert offers a free Bronze workbook to help a business get started. Three of the five levels rest on a director's signature rather than an audit, which keeps it affordable but means the certificate is only as good as the work behind it.
The five levels
Bronze
The starting level: the basics like antivirus, updates, backups and strong passwords. Signed off by a director.
Silver
Adds more controls. CyberCert says Silver covers the controls most insurers ask about. Signed off by a director.
Gold
A broader set of controls across accounts, devices, backups and people. Signed off by a director.
Platinum
Independent third-party checking that the controls are in place.
Diamond
The highest level, with the most controls and independent checking.
Who might want it
- Suppliers whose larger customers send security questionnaires.
- Businesses filling in cyber insurance proposals that want evidence for their answers.
- Small businesses that want a step-by-step plan with a certificate at the end.
- Businesses that aren't ready for a formal Essential Eight or ISO 27001 assessment.
What to be careful about
- It isn't required by law. No Australian law asks for SMB1001. Ask whoever wants evidence from you what they'll actually accept.
- It isn't the government's standard. The government's 2026 to 2028 cyber plan includes its own small business standard and certification, called CyberSmart. It hasn't said that SMB1001 will be it.
- Self-signed levels are only as good as the work. At Bronze, Silver and Gold, a director signs that the controls are in place. If nobody checked, the certificate can say more than the systems do.
- Insurance savings aren't guaranteed. Certification can make an insurance proposal easier to answer. We haven't seen an Australian insurer publish a discount for it.
How WaTo can help
- We're not an SMB1001 certifier. We help with the work behind it: turning on multi-factor sign-in, setting up backups that restore, keeping devices updated and tidying up admin access.
- Our cyber security health check shows where your business stands on those controls, from $690 ex GST.
- If a client or insurer has asked for Essential Eight evidence instead, our Essential Eight work covers that.
SMB1001 questions
Is SMB1001 required in Australia?
No. It's a private certification. Some customers, partners or insurers may ask for it or something like it, but no law requires it.
What's the difference between SMB1001 and the Essential Eight?
The Essential Eight is the Australian Signals Directorate's set of eight mitigation strategies with maturity levels, often used by government and larger organisations. ASD began moving to a new series called ASD Essentials in October 2026. SMB1001 is a private, tiered certificate built for small businesses, with a certificate you can show at each level.
Is SMB1001 the same as CyberSmart?
No. CyberSmart is the government's planned small business cyber standard and certification, announced in its Horizon 2 plan for 2026 to 2028. It's still being designed, and the government hasn't said which standard it will use.
How long does it take?
It depends on where you start. A business that already has multi-factor sign-in, backups and updates in place can reach the lower levels quickly. One that doesn't will spend most of the time putting those in.
How much does it cost?
CyberCert charges a yearly certification fee that depends on the level. Check its current prices directly. The bigger cost is usually the time to put the controls in place.
How WaTo can help with this
Guides on this topic
- What is the Essential Eight?
- Free government cyber checks for small business, and what they don't cover
- Cyber insurance IT readiness: what to have in order first
- IT health check, IT audit or penetration test: which do you need?
Sources & references
- Dynamic Standards International: SMB1001
- CyberCert
- CCP: SMB1001 in 2026, what the cyber certificate actually proves (April 2026)
- Home Affairs: 2023-2030 Australian Cyber Security Strategy, Horizon 2 Action Plan
- Australian Signals Directorate: ASD Essentials overview, frequently asked questions (October 2026)
WaTo Consulting. Last reviewed 2026-11-07. Review when SMB1001 publishes a new edition, and when the government names the CyberSmart standard.
Been asked for proof of your cyber security?
Tell us who's asking and what they want, and we'll help you put the controls in place and answer their questions.
Mon to Fri, 8:30am to 5pm
