SMB1001 Certification
for Brisbane Businesses

SMB1001 is a cybersecurity certification standard designed specifically for small and medium businesses, described by its developer Dynamic Standards International (DSI) as the world's first of its kind. It was developed by DSI and is certified in Australia by CyberCert, in response to a clear gap in the market: enterprise frameworks like ISO 27001 and SOC 2 are impractical for most SMBs, yet leaving security unstructured creates significant risk. SMB1001 provides a structured, achievable baseline that can be implemented with a managed IT provider rather than requiring an in-house security team.

SMB1001 has five levels: Bronze (7 controls covering basic security hygiene), Silver (17 controls, adding MFA on email, a password manager, email anti-spoofing, backups, and staff awareness training), Gold (27 controls, adding endpoint detection and response, an incident response plan, a cybersecurity policy, a digital asset register, and cyber insurance), Platinum (32 controls, extending MFA to VPN, remote desktop, and data stores, with vulnerability scanning and independent third-party assessment), and Diamond (39 controls, adding penetration, vulnerability, and social engineering testing). Your target level is set by what your customers trust you with: under DSI's Supplier Categorization Matrix, a business handling confidential or personal information, or holding elevated access to client systems, sits at Gold. Your starting level is a separate decision, set by what your business can own right now.

No. Gold is the right target for most businesses that hold personal or confidential information, but where you start is a separate decision. The technology controls are the part an IT provider can deploy quickly. The policies, training, incident plan and access reviews have to be owned inside the business, and that is where Gold projects stall when nobody internal is driving them. For many businesses we recommend certifying at Bronze or Silver first, with the technology for Gold going in during the same period, and stepping up to Gold once the organisation is running those processes. Every level is a superset of the one below, so nothing is wasted.

Mino IT deploys and documents the technology controls: multi-factor authentication, patching, a password manager, email anti-spoofing, tested backups, endpoint detection and response, and the asset register. We also draft the policies, the incident response plan and the training program, compile the evidence and manage the submission to CyberCert. Your business owns adoption: a policy that is followed, staff who complete training, an incident plan someone has walked through, telling us when people start and finish, and a director who signs the attestation. The single biggest predictor of a project finishing is an internal champion, usually an owner, general manager or operations lead, who has the authority to change how people work.

Bronze, Silver and Gold are self-assessed: a company director attests that the controls are in place, and CyberCert issues the certificate. Independent third-party assessment applies at the higher levels, Platinum and Diamond. What matters is that the controls are genuinely in place. We implement and document every technology control as part of your managed IT service, and we work with your champion on the rest, so your certification is backed by real security work, not a checkbox.

Five steps. First, a gap assessment: we audit your environment against the standard and agree the target level and the starting level. Second, technology controls: we deploy and document the technology for your starting level, and put in the technology for the next level during the same period. Third, policies, training and plans: we draft them with your internal champion, who drives adoption. Fourth, evidence and submission: we compile the evidence, your director attests, and we manage the application to CyberCert, who issue the certificate. Fifth, maintain and step up: we maintain the controls and the annual renewal, and take you to the next level when the processes are running. Technology work at a given level typically takes four to eight weeks, or up to three months if you are starting with little in place.

The cost has two components: the CyberCert certification fee (a fixed fee per level, payable directly to CyberCert and publicly listed on their website) and the implementation cost, which depends on how many of the controls at your level are already in place. For most businesses that engage Mino IT as their managed IT provider, the majority of the technology controls are implemented as part of the standard service, meaning the incremental cost of reaching certification is often lower than expected. We provide a clear picture of where you stand and what it will cost after the initial gap assessment.

Certification is valid for a year and requires annual recertification to confirm controls remain in place. For Mino IT clients, this is managed as part of your ongoing service: we maintain the controls, keep the documentation current, and manage the renewal with CyberCert each year. Stepping up a level does not have to wait for the renewal: once the additional controls are in place and your director can attest to them, you can apply for the next level. Most businesses hold at Gold. Platinum and Diamond add independent verification and testing, and make sense when a customer, a tender or a regulator requires them.