Win and keep contracts
Large businesses and government increasingly ask suppliers to prove their cyber security. A certificate answers the question quickly and makes tender responses easier.
Giant Secure · Cyber risk and safety
Cyber security your customers can see. Get SMB1001 certified.
SMB1001 is a cyber security standard written for small and medium businesses. It gives you a clear, step-by-step path from the basics to advanced protection, and a certificate that proves it to customers, insurers and partners.
The explainer
What is SMB1001?
SMB1001 is published by Dynamic Standards International (DSI), a not-for-profit standards body that began in Australia. The current edition, SMB1001:2026, was released on 1 September 2025, and the standard is updated every year to keep pace with new threats.
Think of it like the coloured belts in martial arts. There are five levels, from Bronze to Diamond. You start where your business is today and go as far as your customers, insurers and risks require. You don't need to reach the top level.
It's far simpler and more affordable than enterprise standards such as ISO/IEC 27001, and it aligns with frameworks like the UK's Cyber Essentials and the US CIS Controls, so it's also a good stepping stone if you need more later.
Five areas, covered at every level
- Technology management – keeping devices, software and networks updated and secure
- Access management – the right people, with strong passwords and multi-factor authentication
- Backup and recovery – being able to get your data and systems back after an incident
- Policies, plans and procedures – knowing what to do, and writing it down
- Education and training – helping your team spot scams and avoid mistakes
Certification is issued by CyberCert, DSI's authorised certifier. Levels 1–3 are confirmed by a company director; Levels 4–5 are independently verified. Certificates are renewed each year.
Who and why
Why Australian businesses are getting certified
SMB1001 suits any business from sole traders to around 200 staff, and it matters most if you hold customer information, supply larger organisations, or move money by bank transfer.
Be ready for your insurer
Cyber insurers treat basic controls as a condition of cover. At renewal they ask about multi-factor authentication, tested backups, endpoint protection, out-of-support computers and which security framework you follow. Gaps can mean higher premiums, exclusions or a declined policy. Insurers don't require SMB1001 by name, but it gives you documented evidence for the questions they do ask.
Stop the common attacks
Small businesses are regular targets for ransomware, email takeovers and fake invoices. Getting the basics right blocks many of the attacks that cause the most damage.
Show customers you care
Your certificate and level badge tell customers and partners their information is in safe hands, and it's something your competitors may not have yet.
The five levels
From Bronze to Diamond
Each level includes everything in the levels below it, plus more.
Level 1 – Bronze
Seven essentials: technical support, firewall, antivirus, automatic patching, password hygiene, backup and recovery, and staff cyber awareness training.
Suits: every business. This is the foundation.
Director attests
Level 2 – Silver
Adds individual user accounts, no admin rights for everyday use, a password manager, multi-factor authentication on email, email domain protection and checks against invoice fraud.
Suits: most small businesses.
Director attests
Level 3 – Gold
Adds advanced endpoint protection, multi-factor authentication across business apps, full email authentication, a written security policy, an incident response plan, an asset register and ongoing staff training.
Suits: businesses holding customer data or answering supplier questionnaires.
Director attests
Level 4 – Platinum
Adds vulnerability scanning, encryption of sensitive data, supplier due diligence, regular access reviews and tested recovery from backup.
Suits: enterprise or international supply chains and sensitive data.
Independently verified
Level 5 – Diamond
Adds penetration testing, rehearsed incident response, application control and continuous monitoring of controls.
Suits: regulated data and the most demanding clients.
Independently verifiedA plain-English summary based on publicly available information about SMB1001:2026. The standard published by DSI is the authoritative list of requirements.
Questionnaire
Which level should your business aim for?
Answer eight quick questions to get a recommended target level and where to start. Your answers stay in your browser and aren't sent anywhere.
Your recommended target
Level 1 – Bronze
Why this level
Where to start
This recommendation is general guidance based on your answers, not a formal assessment. Requirements from your customers, insurers or tenders take priority, and the current SMB1001 standard is the authoritative source.
How to get started
Seven steps to your certificate
Let Giant Secure do it for you, or do it yourself with our packs. Either way, here's the path.
Find your target level
Use the questionnaire above, check what your customers or insurers ask for, or talk to us.
Get the standard
Buy the current SMB1001 edition from dsi.org (from US$95 for 1–20 staff) so you have the exact requirements. We can help you choose the right licence.
Do a gap assessment
Compare what you have today against your target level. We can do it for you, and our example reports show what you'll get.
Close the gaps
Put the missing protections in place. DIY with our Bronze, Silver or Gold pack, or we'll do it with you.
Collect your evidence
Screenshots, settings and policies that show each control is in place, so your certification stands up if anyone asks.
Certify
When you're ready, we'll walk you through submitting your certification with CyberCert, the official certifier. A director confirms Levels 1–3; Levels 4–5 are independently verified. A certification fee applies.
Display it and renew
Share your certificate with customers and on your website, then renew every year as the standard is updated.
Done for you
Giant Secure does the work with you
We assess where you are, fix the gaps, write the policies, collect the evidence and get your director ready to attest. Fixed price, no surprises.
One-off project
Bronze readiness project
$2,500ex GST
- Cyber health check and a written report on your gaps
- We close the gaps across all seven Bronze controls
- Five security policies written for your business
- Staff cyber awareness session
- Evidence collected and organised for every control
- Support through director attestation and certification
Ongoing
Giant Secure ongoing
$25per user per month, ex GST
- Keep every control running, month after month
- Monthly checks of updates, antivirus and backups
- Regular backup restore tests
- Staff awareness refreshers
- Evidence kept current and annual renewal support
- A clear path to Silver and Gold when you're ready
CyberCert's certification fee is passed on at cost, and Microsoft 365 or other software licences are billed separately. Aiming for Silver or Gold? Call us for a fixed quote.
What you receive
Seven documents take you from where you are today to certified.
- Start
Cyber health check report
Where you stand today against the seven Bronze controls, the risk of each gap and the order we'll fix them in.
- Start
Action checklist
The items we need you to act on, in plain English, with tick boxes and sign-off.
- During
Progress report
Your readiness score, plus the status and next step for each control.
- During
Security policy pack
Information Security, Acceptable Use, Password, Backup and Recovery, and an Incident Response Plan, written for your business.
- Finish
Evidence pack
An index of the evidence for each control and when it was collected, ready if a customer or insurer asks.
- Finish
Giant Secure readiness certificate
Our confirmation that you're ready for the director to attest. It's not an SMB1001 certificate.
- Finish
Your official SMB1001 Bronze certificate
Issued by CyberCert after your director attests. We guide you through it; CyberCert's fee is extra.
Do it yourself
Example reports and DIY packs
See exactly what a readiness assessment looks like for your level, then get the step-by-step pack to get certification-ready yourself. Every purchase is an instant download.
Peek inside an example report
Each example report is a complete readiness assessment for a fictional business at that level: executive summary, readiness by level, a scorecard across the five SMB1001 areas, prioritised findings and a step-by-step action plan.
Level 1
Bronze
Bronze DIY Information Pack
- The seven Bronze controls, step by step
- Windows, Mac and router how-tos
- Checklist, registers, backup plan and staff training record
- Bronze assessment workbook (Excel)
- Includes the Bronze example report
$99inc GST
Buy the Bronze packLevel 2
Silver
Silver DIY Information Pack
- 12 steps: accounts, admin rights, password manager, MFA, SPF and more
- Microsoft 365 and Google Workspace how-tos
- Bank detail change procedure, MFA plan and visitor register
- Silver assessment workbook (Excel)
- Five editable Word policy templates
- Includes the Silver example report
$149inc GST
Buy the Silver packLevel 3
Gold
Gold DIY Information Pack
- 14 steps: EDR, DKIM and DMARC, insurance, training and more
- Security policy, incident response plan and AI use policy templates
- Gold assessment workbook (Excel)
- Five editable Word policy templates
- Asset and training registers
- Includes the Gold example report
$199inc GST
Buy the Gold packPlease note: our reports and packs prepare your business for certification; they don't certify it. Certificates are issued by CyberCert, DSI's authorised certifier, for an annual fee that applies at every level and isn't included in our prices.
Platinum and Diamond: talk to us
Levels 4 and 5 are independently verified, with vulnerability scanning, encryption, supplier checks and penetration testing. We'll plan the work with you and prepare you for the external assessment.
SMB1001 is a standard published by Dynamic Standards International (DSI). Certification is issued by CyberCert, DSI's authorised certifier. Giant Secure is the cyber security service of Giant Concepts Pty Ltd, an independent IT and telecommunications consultancy not affiliated with or endorsed by DSI or CyberCert. The level badges on this page are Giant Secure illustrations. Example reports are prepared for fictional businesses. Information on this page is general in nature; always check the current edition of the standard.
Prefer a hand?
Talk to Giant Secure
We'll help you pick the right level, run your gap assessment, fix what's missing and prepare your certification, so you can get on with running your business.