SMB1001 Certification: Tiers, Cost and Where It Fits

Tilt-shift miniature of a seaside bakery with a small cyber certificate on the counter — SMB1001 gives small businesses a tiered certificate they can show customers and insurers.

SMB1001 is an Australian cyber security standard written for small and medium businesses, with five tiers from Bronze to Diamond. It gives a business a certificate it can show customers, insurers and partners without taking on a full ISO 27001 project. It is worth understanding, but it is worth being clear about what it is and what it is not before deciding where it fits.

Short answer

SMB1001 is a voluntary, tiered cyber standard published by Dynamic Standards International and certified through CyberCert. The lower three tiers are signed off by a director; the top two are independently verified. It is a sensible baseline for a small business, and in our experience it is more of a due diligence answer than a client or tender requirement. It is not an ISO standard, it does not replace ISO 27001, and it is not the same as the Essential Eight.

Where SMB1001 actually comes up

None of our clients has asked us for SMB1001 yet, and I have not seen it named as a requirement in a tender. Where it does appear is earlier in the conversation: a larger customer sends a supplier security questionnaire, an insurer asks what controls are in place, or a business owner wants to know whether their IT provider has covered the basics. SMB1001 gives a short, specific answer to those questions.

That is a different job from ISO 27001. When a contract or tender asks for certified information security, it almost always means ISO/IEC 27001, audited by a JAS-ANZ accredited certification body. Knowing which question is being asked saves a lot of wasted effort.

The five tiers

Tier	Assurance	Typical focus
Bronze	Director attestation	The basics: an IT support arrangement, firewall, antivirus, patching, passwords, backups and staff awareness.
Silver	Director attestation	MFA on email, a password manager, removing everyday admin rights, email authentication (SPF) and first written policies.
Gold	Director attestation	Endpoint detection and response, MFA on business applications, an incident response plan, an asset register, cyber insurance and an AI use policy.
Platinum	Independent verification	Phishing-resistant MFA, external vulnerability scanning and tested recovery.
Diamond	Independent verification	Penetration and social engineering testing, application control, managed detection and response, and encryption at rest.

The tiers are cumulative, so each one includes everything below it. The standard is revised annually; the 2026 edition tightened email authentication and added controls at Gold, and existing holders pick those up at renewal. Check the current edition on the CyberCert site before planning, because control lists move from year to year.

What a director attestation means

At Bronze, Silver and Gold, a director signs to say the controls are in place. That keeps the cost and time low, which is the point of the scheme, but it also means the certificate is only as good as the evidence behind the signature. A director signing a declaration is taking on accountability, so the sensible approach is to treat the attestation like an internal audit: check each control, keep the evidence, and be able to show it if a customer or insurer asks.

From Platinum up, an independent verifier checks the controls. That is closer to what most procurement teams mean when they ask for independent assurance.

SMB1001, Essential Eight and ISO 27001 compared

	SMB1001	Essential Eight	ISO 27001
What it is	Tiered certifiable cyber standard for SMBs	ASD mitigation strategies with maturity levels	International standard for an information security management system
Who checks it	Director (lower tiers) or independent verifier (top tiers)	Self-assessment or external assessor; mandatory for many government entities	JAS-ANZ accredited certification body
Scope	Technical and basic governance controls	Eight technical strategies	Risk-based management system plus 93 Annex A controls
Recognition	Growing with MSPs, insurers and some professional bodies	Australian Government baseline, now moving to ASD Essentials	International, widely asked for in tenders and contracts
Typical effort	Weeks for the lower tiers	Weeks to months depending on target level	Several months

The overlap with the Essential Eight is real but partial. Some strategies, such as application control and Microsoft Office macro settings, only appear at Diamond, so a Gold certificate should not be read as Essential Eight Maturity Level 1. ASD has also announced ASD Essentials as the successor to the Essential Eight, which is worth watching for anyone mapping controls across schemes. Our Essential Eight explainer and Essential Eight vs ISO 27001 comparison go into more detail.

When SMB1001 is a good fit

A small business with no formal cyber programme that wants a clear starting point.
A supplier that keeps getting the same basic security questions from customers and wants one answer.
A business preparing for a cyber insurance renewal and wanting its controls written down.
A business planning ISO 27001 later and wanting the technical foundations in place first.

When ISO 27001 is the better answer

A customer, contract or tender asks for certified information security.
The business handles customer data at a scale where a risk-based management system makes sense.
Work is coming from government, defence, health or financial services supply chains.
The business wants assurance that is recognised overseas.

SMB1001 controls are useful evidence inside an ISO 27001 system, particularly for Annex A technological controls, so work done for one is rarely wasted. Our ISO 27001 cost guide covers the time and cost of the bigger step.

How Streamline helps

We don’t sell SMB1001 certificates; that runs through CyberCert and its partners, usually your IT provider. Where we help is working out which assurance a business actually needs, based on who is asking and why, then building the ISO 27001 management system when that is the right answer. Read about our ISO 27001 consulting and Essential Eight services, or talk to us about where SMB1001 fits for your business.

Frequently asked questions

Is SMB1001 mandatory in Australia?

No. SMB1001 is a voluntary standard. No Australian law or government procurement rule requires it, and we have not yet seen it named as a requirement in a tender. Where it does come up is in supplier questionnaires, cyber insurance conversations and customer due diligence.

Who publishes SMB1001?

Dynamic Standards International (DSI), an Australian private standards body formerly known as Cyber Security Certification Australia. Certification is issued through its sister entity, CyberCert, usually with an IT provider or MSP helping the business through it. It is not an ISO or Standards Australia standard.

How much does SMB1001 certification cost?

The certification fee is modest at the lower tiers, starting from under $100 a year for Bronze, with the independently verified Platinum and Diamond tiers costing a few thousand dollars a year. The bigger cost is the work to put the controls in place, such as MFA, EDR, backups and policies, which depends on where the business is starting from.

Is SMB1001 the same as the Essential Eight?

No. They overlap, but SMB1001 is built as a certifiable ladder for small businesses, while the Essential Eight is a set of ASD mitigation strategies assessed against maturity levels. Some Essential Eight strategies, such as application control and macro settings, only appear at the top SMB1001 tier. ASD has also announced ASD Essentials as the successor to the Essential Eight.

Should we do SMB1001 or ISO 27001?

It depends on who is asking for the evidence. SMB1001 suits a small business that wants a quick, affordable baseline it can show customers. ISO 27001 suits a business whose customers, tenders or contracts ask for an internationally recognised, independently audited management system. Many businesses start with the technical controls and move to ISO 27001 as their customers grow.

General guidance only. This article is general information, not legal, financial, safety or compliance advice, and it does not take account of your specific circumstances. Streamline ISO Consultants are ISO management-system consultants, not lawyers or licensed advisers. Standards, laws and regulator guidance change, and details were correct only at the time of writing. Always seek professional advice before acting. See our full Disclaimer.