SMB1001 · Uplift & certification
Certified security, one tier at a time.
SMB1001 is published by Dynamic Standards International and built for businesses your size, with five tiers from Bronze to Diamond. Instead of a maturity score nobody outside IT recognises, you get something you can name when a client asks.
The tiers
Five tiers, each building on the last.
Each tier builds on the one before it, so nothing you implement is wasted. The lower tiers rest on your director's attestation. The top two need an independent body to verify them.
Bronze
The recognised baseline: basic cyber hygiene, endpoint protection, backups, access control and someone clearly owning it.
Silver
Tightens the same ground and starts asking for written process, so the controls survive staff turnover.
GoldCommon target
Where most client and insurer questions get comfortably answered: incident response, recovery testing, policies your staff have actually signed.
Platinum
Higher assurance, with advanced controls and supply chain expectations. Worth it when a large client asks for verified evidence.
Diamond
The top tier, audit-assessed. Rare for a practice, and honestly more than most firms need.
How we help
Scored, lifted, certified, and kept that way.
Standards are easy to buy and hard to finish. We close the gap between where your firm is and the tier you’re aiming at, facilitate certification through CyberCert so you’re not administering it yourself, then keep the tier honest afterwards.
01
Score where you stand
We score your firm against the tier you want, using evidence from the systems you already run rather than a questionnaire.
02
Lift what’s missing
Controls implemented and policies written with accounting and advisory clauses, adopted by your principal and signed by staff.
03
Certify with CyberCert
We facilitate the certification itself. The certificate comes from CyberCert, because that is who is accredited to issue it.
04
Keep it true afterwards
Certificates run 12 months, so your tier shows live in your Compliance Portal and stays current instead of lapsing quietly before renewal.
Common questions
What firms ask us about SMB1001.
Is SMB1001 mandatory?
No. SMB1001 is a private standard rather than legislation, so nobody can fine you for skipping it. What drives it is commercial: clients asking how you handle their data, insurers asking at renewal, and tenders asking for evidence.
Who actually issues the certificate?
CyberCert issues it, never us. We do the uplift, get the controls and evidence in place, and can facilitate the certification so you are not managing that process yourself. Bronze through Gold rest on your director's attestation; Platinum and Diamond require independent verification.
How does SMB1001 relate to the Essential Eight?
They overlap heavily, so evidence gathered for one counts toward the other. SMB1001 goes further on governance, policies and staff training, which the Essential Eight leaves out, and it gives you tiers to show progress against rather than a maturity level most clients have never heard of.
Which tier should our firm aim for?
Bronze gets you a recognised baseline quickly and is a sensible first target. Gold is where most client and insurer questions get comfortably answered. Platinum and Diamond are worth it when a large client or a tender specifically asks for independently verified controls.
