More of our clients are being asked to prove their cyber security: by insurers, by larger customers and in tender documents. SMB1001 is one of the clearest ways for a small or medium business to do that. We hold SMB1001 Gold ourselves, so here's how it works from someone who's been through it.
What is SMB1001?
SMB1001 is a cyber security standard written for small and medium businesses. It's published by Dynamic Standards International and updated each year.
It sets out a list of controls a business should have in place, grouped into five levels. Each level builds on the one before:
- Bronze
- Silver
- Gold
- Platinum
- Diamond
How certification works
At Bronze, Silver and Gold, a business assesses itself against the controls, keeps the evidence and its directors attest that the controls are in place. Certification is issued through a certification body. Ours was issued through CyberCert.
At Platinum and Diamond, an independent auditor checks the controls as well.
Certification lasts a year. Each renewal is checked against the current edition of the standard, so the requirements can shift slightly from one year to the next.
What Gold asks of you
Gold is where the controls that insurers and larger customers tend to ask about come in. Alongside the foundations from Bronze and Silver, it includes things like:
- Endpoint detection and response on your devices
- Multi-factor authentication on the business applications you use
- Secure remote access
- A written incident response plan
- A cyber security policy and an AI use policy
- A register of your digital assets
- Cyber insurance
The full list is longer. The point is that Gold describes a business that has its security properly organised, not just installed.
Self-attested doesn't mean easy
Because Gold is attested by your directors, the real work is getting the controls right and keeping the evidence to back up what you've signed. If something happens later, that attestation needs to stand up.
That's why we build an evidence pack for each control as we go, with notes and screenshots, rather than ticking boxes at the end.
How it fits with the Essential Eight
Many SMB1001 controls overlap with the Australian Government's Essential Eight. If you're working on one, you're usually making progress on the other, so we often work on both together.
If you'd like to get your business to SMB1001 Gold, have a look at how we do it or talk to us.