Clients, insurers, tender teams and larger supply-chain partners increasingly ask businesses to show how they manage cyber risk. Saying that security is taken seriously is rarely enough. They may want to see controls, policies, training records and evidence that the protections are actually operating.
That can leave a business caught between informal security improvements and a large certification project. SMB1001 was created to provide a clearer, staged path.
Developed by Dynamic Standards International, SMB1001 is a cyber security standard that organises practical security requirements into five levels. A business can begin at a level suited to its risk and commercial needs, then progress as those needs change.
At the time of writing, SMB1001:2026 is the published edition. The standard is reviewed regularly so its requirements can respond to changes in technology, business practices and cyber threats.
What does SMB1001 cover?
The standard groups its requirements into five areas that connect technical protection with the way a business operates:
- Technology management: keeping devices, software and systems appropriately configured, protected and maintained.
- Access management: controlling who can access information and systems, and removing access when it is no longer required.
- Backup and recovery: maintaining reliable backups and being able to recover the information the business depends on.
- Policies and processes: documenting how security is managed so responsibilities and expectations are clear.
- Education and training: helping team members recognise threats and make safer decisions in their everyday work.
This breadth is useful because security failures rarely come from one missing product. A business can have good endpoint protection and still be exposed by an old user account, an untested backup, a poorly handled staff departure or an invoice request that no one knows how to verify.
The five certification levels
SMB1001 uses five progressive levels: Bronze, Silver, Gold, Platinum and Diamond. Each builds on the requirements below it.
Bronze (Level 1) establishes foundational protections. Silver (Level 2) adds more advanced preventative measures. Gold (Level 3) moves further into structured, organisation-wide risk management. Platinum (Level 4) and Diamond (Level 5) add more advanced governance and risk-management requirements for businesses with greater exposure or assurance needs.
SMB1001, the Essential Eight and ISO/IEC 27001
These three names are often discussed together, but they serve different purposes.
The Australian Signals Directorate’s Essential Eight is a baseline of eight technical mitigation strategies. Its maturity model helps an organisation choose and work towards a target level based on risk. It is widely recognised and provides strong technical direction, but it is not itself a commercial certification scheme.
SMB1001 is broader than a list of technical controls. It combines technology, access, recovery, policies and training in a staged certification pathway. Its levels can make progress easier to plan and demonstrate.
ISO/IEC 27001 specifies requirements for an information security management system. It provides a comprehensive, organisation-wide approach to managing information risk and can be independently certified. It can suit organisations of any size, although the scope, governance and ongoing management involved may be more than an organisation needs as its first formal step.
The right framework depends on why the work is being done. A contract may name a particular standard. A customer may want independent assurance. An insurer may ask about specific controls. Some businesses may use SMB1001 as their primary pathway while also drawing on the Essential Eight, and later consider ISO/IEC 27001 as their governance needs develop.
Choosing the right SMB1001 level
There is no single level that suits every business of a particular size. The decision should reflect the consequences of an incident and the assurance expected by the people who rely on the business.
Useful questions include:
- How sensitive is the information the business stores or handles?
- Could access to the business’s systems expose a customer or supply-chain partner?
- How long could the business operate without its key systems or data?
- Are there contractual, tender, regulatory or insurance requirements to satisfy?
- What level of assurance do customers or supply-chain partners expect?
A business handling sensitive client records may need stronger assurance than an organisation with less exposure. Likewise, a supplier with access to a major customer’s systems may face requirements that are driven by that relationship rather than headcount.
A readiness review can identify which requirements are already covered, where evidence is missing and what work remains. That creates a realistic basis for choosing a level, timeframe and budget.
How can certification benefit the business?
The certificate does not generate revenue on its own. Its commercial value comes from helping the business protect the work it already has and demonstrate its security position when new opportunities are being assessed.
Qualify for more opportunities
Larger customers, government buyers and supply-chain partners increasingly include cyber-security requirements in tenders and supplier reviews. A recognised certification, supported by organised evidence, can help a business satisfy those requirements and avoid being screened out because it cannot demonstrate how security is managed.
Certification does not guarantee that a tender will be won. It can remove an obstacle, make the response more credible and give the customer a clearer basis for trusting the business with its information or systems.
Spend less time proving the same things
Without a structured standard, every security questionnaire can become a new research project. SMB1001 gives the business a consistent set of controls and evidence to draw from. That can reduce the time management and IT teams spend rebuilding the same answers for customers, partners and insurers.
Protect revenue and day-to-day operations
The work behind certification is designed to reduce the likelihood and impact of common failures. Maintained devices, controlled access, recoverable backups, useful policies and prepared staff can help prevent fraud, limit unauthorised access and restore operations sooner after an incident.
That protects more than data. It helps protect billable work, customer service, deadlines, cash flow and the trust the business has built with its customers.
Make security spending more deliberate
SMB1001 provides a defined target rather than an open-ended instruction to “improve security”. A readiness review shows what is already covered, what is missing and what evidence needs attention. Management can then prioritise spending against known gaps instead of accumulating disconnected products without a clear outcome.
Give customers and management clearer assurance
Certification gives the business a consistent way to explain its security position using documented controls and supporting evidence. It may support conversations with customers, tender teams, supply-chain partners and insurers, but it does not guarantee better insurance terms or that a future claim will be accepted. Those decisions remain with the organisation asking the questions and depend on the controls continuing to operate in practice.
How Supportdesk can help
Supportdesk can assess the current IT environment against the target level and separate what is already in place from what still needs attention. We can then build a practical improvement plan covering systems, identity and access, cyber security, Microsoft 365, backup and recovery and the supporting operational records.
Where gaps need remediation, we can implement and manage the relevant controls, help assemble evidence and work with the business through its preparation. Supportdesk’s role is to make the underlying security practical, supportable and ready for the chosen certification level.
If customers, insurers or tender requirements are starting to ask harder security questions, talk to Supportdesk about an SMB1001 readiness review.