SMB1001 certification, at the level you need
SMB1001 is the Australian cyber security certification written for small and medium businesses. We close the gaps against the level you need, prepare the evidence and keep the controls running.
Your price in two minutes, no email needed. Or call 1300 787 429.
Not sure where you stand? Take the five minute scorecard.
★★★★★ 4.9 on Google from 60+ reviews
- 5Levels, from Bronze to Diamond
- ISO27001 certified ourselves, audited every year
- Top 50MSP in Australia, 2024 to 2026
- GoldSMB1001 certified ourselves, on the CyberCert register
Trusted by 300+ organisations, including
When someone asks you to prove it
Most businesses look at SMB1001 because someone outside the business wants evidence. These are the four situations we see most.
A client or tender asks for it
Larger clients now send supplier security questionnaires, and some tenders ask for a named certification. Without one you can lose points or miss the shortlist.
FixA certificate at the level they ask for, and evidence you can attach to your reply.
Your cyber insurance form got harder
Renewal forms ask about multi factor authentication, backups, endpoint protection and incident response. The answers have to match what is really in place.
FixControls that match your answers, and a certificate that backs them up.
ISO 27001 is more than you need
ISO 27001 is a big commitment in time, cost and paperwork, and it was not written with a 20 person business in mind.
FixSMB1001 gives you a recognised certificate sized for your business, and a path up the levels as you grow.
You have done the work but cannot show it
Many businesses already have good controls through their IT provider, but nothing independent to show a client or a board.
FixWe map what you have against the standard, close what is missing and turn it into a certificate.
Tell us who is asking about your security. A technical consultant will scope it with you and send a fixed quote. Or take the scorecard to see where you stand first.
Bronze to Diamond
Each level builds on the one below it. You start at the level that fits your business rather than working through all five, and move up when a client or insurer asks for more.
| Level | What it covers | How it is checked | Who it usually suits |
|---|---|---|---|
| Bronze | The basics: protected and updated devices, backups, a firewall and security awareness training for staff | Self attested by a director | Sole traders and small teams starting out |
| Silver | Stronger sign in: multi factor authentication, an account for each person, fewer admin rights and a password manager | Self attested by a director | Most small businesses, often at a client's request |
| Gold | Written policies, an incident response plan, endpoint detection and response, email protected from spoofing and a policy on AI use | Self attested by a director | Businesses handling client data or answering supplier questionnaires |
| Platinum | Controls that are tested: stronger multi factor authentication, vulnerability scanning, restore tests and regular access reviews | Independent audit | Businesses in regulated work or large supply chains |
| Diamond | The highest level: application control, encryption, penetration testing and managed detection and response, monitored all the time | Independent audit | Businesses whose clients expect the strongest evidence |
Swipe the table sideways to see every column.
A summary of SMB1001:2026. The standard sets the exact controls for each level, and we map every one of them against your business in the gap review.
From gap review to certificate
You know the level, the gaps and the cost before any work starts. Most of the effort sits with us, not your team.
- 01Review
Gap review
We check your setup against the level you need and show you what is in place, what is missing and what it will take to close each gap.
- 02Fix
Close the gaps
Our engineers put the missing controls in place, from multi factor authentication and email protection to backups, policies and an incident response plan.
- 03Certify
Evidence and sign off
We prepare the evidence for each control. At Bronze to Gold your director signs the declaration. At Platinum and Diamond we get you ready for the independent audit.
- 04Keep
Stay certified
The standard changes every year and certificates are renewed each year. With SecureShield we keep the controls current and the evidence ready.
Certification built into your security plan
A certificate only means something if the controls keep running after the paperwork is done. SecureShield keeps them running, and the higher plans are built to the higher SMB1001 levels.
SecureShield Core
The security base
$25 a person a month
24/7 managed detection and response on devices, identity threat detection for Microsoft 365, security awareness training and vulnerability scanning for every person. Pairs with the lower SMB1001 levels, with any gaps closed after the review.
SecureShield Control
Visibility and governance
$60 a person a month
Everything in Core plus centralised security logging, a business password manager, end user policy management and an incident response plan tested every year, with controls maintained at Essential Eight Maturity Level One. Aligned to SMB1001 Gold, with the evidence prepared for the declaration.
SecureShield Command
Strategy and vCISO
$100 a person a month
Everything in Control as a full security program, with controls maintained at Essential Eight Maturity Level Two, an ongoing virtual CISO and board ready reviews. Aligned to SMB1001 Diamond, the highest level.
SecureShield is priced per person per month excluding GST. Compare SecureShield plans.
SMB1001, Essential Eight or ISO 27001
All three come up in tenders and insurance forms. They overlap a lot, so work towards one usually helps with the others. This is how they differ.
| Compare | SMB1001Certification for SMBs | Essential EightAustralian Signals Directorate | ISO 27001International standard |
|---|---|---|---|
| Written for | Small and medium businesses | Australian organisations of every size | Organisations of every size, worldwide |
| What you get | A certificate at one of five levels | A maturity level assessment. No government certificate | A certificate for your information security management system |
| How it is checked | Director declaration at Bronze to Gold, independent audit at Platinum and Diamond | Assessment by your provider or an independent assessor | External certification audits every year |
| Effort | Weeks at the lower levels, months at the higher ones | Months to reach Maturity Level One or Two | The biggest commitment of the three |
| Who usually asks | Clients, supply chains and insurers | Insurers, government and resources clients | Enterprise and overseas clients |
Swipe the table sideways to see every column.
Not sure which one you are being asked for? Send us the request and we will tell you. See compliance management.
A top 50 MSP in Australia, three years running
Rated by our clients on Cloudtango, and audited every year on security, quality and cyber controls.
Top 50MSPs in Australia
- 2024
- 2025
- 2026
Ranked on client satisfaction and service depth.
Read our 25 client reviews on Cloudtango
ISO 27001
Information securityHow we handle your data, passwords and access, audited every year.
How we protect your data
ISO 9001
Quality managementDocumented processes, so every engineer works to the same standard.
How we work
SMB1001 Gold
Cyber security, Level 3The 27 control cyber standard we take clients through, held ourselves.
Check our certificateSMB1001 questions
What owners and IT managers ask before they start. Anything else, call 1300 787 429.
Related services and reading
What is SMB1001?
SMB1001 is an Australian cyber security standard written for small and medium businesses. It sets out five levels of controls, from Bronze to Diamond, and gives you a certificate for the level you reach, so you can show clients, insurers and staff that your security has been checked against a standard.
It is published by Dynamic Standards International and updated every year. For the background, read SMB1001 explained.
Which SMB1001 level do we need?
Start with whoever is asking. If a client, tender or insurer names a level, aim for that. If nobody has asked yet, most small businesses start at Bronze or Silver and move up once the basics are working. You do not have to work through every level in order.
A gap review tells you which level fits and what is missing for it.
How long does SMB1001 certification take?
It depends on the level and on what you already have in place. The lower levels are usually a matter of weeks. Platinum and Diamond take longer because the controls are deeper and an independent auditor has to check them. After the gap review you get a realistic timeline for your business.
How much does SMB1001 certification cost?
There are three parts: the certification fee paid to the certification body, the work to close any gaps and keeping the controls running. We quote the gap work after the review. The ongoing controls usually sit inside a SecureShield plan, which starts from $25 per person per month excluding GST.
Do you issue the SMB1001 certificate?
No. We prepare your business for certification: we put the controls in place, collect the evidence and help you through the process. The certificate is issued by an independent certification body. At Bronze, Silver and Gold a director signs a declaration through the certification body's portal. At Platinum and Diamond an independent auditor checks the evidence first.
How often do we renew SMB1001?
Certificates are renewed each year, and the standard itself is updated each year. The 2026 edition, for example, added email authentication, endpoint detection and response and an AI use policy. If your controls sit inside SecureShield, we keep them current and have the evidence ready for renewal.
Is SMB1001 better than the Essential Eight?
They do different jobs. The Essential Eight is a set of controls from the Australian Signals Directorate, measured in maturity levels, and the government does not issue a certificate for it. SMB1001 gives you a certificate at a level sized for your business. Many of the controls overlap, so work on one helps the other. See Essential Eight.
Will SMB1001 lower our cyber insurance premium?
It helps you answer the insurer's questions accurately and show evidence for each answer. Whether it changes your premium or cover is a decision for your insurer and broker, so check with them before you rely on it.
What our clients say
1,800+ reviews from the people who call our Perth service desk every day.
1,800+
25
60+
-
“Turns every IT problem into a non-issue”
Arthur turns every IT problem into a non-issue and does it with real patience and professionalism. He explains things in a way that makes the process easy and always leaves us feeling supported. We appreciate the way he handles every request.
Bronte J.Indian Ocean Hotel
-
“Patient, capable and a genuine listener”
The support was outstanding. Patient, capable and a genuine listener, which is rare in support calls. He took the time to understand the issue and work through it with care. You are fortunate to have him on your team and the level of service was impressive.
Peter MidgleyPowertech
-
“Steady, thoughtful and stress free”
Jamie put in a great deal of effort to resolve the problem and it showed in the result. His approach was steady and thoughtful and the support was appreciated. It made the whole experience smooth and stress free.
Jason CavallaroCallidus Process Solutions
-
“Resolved the issue within minutes”
The consultant knew exactly what to do and resolved the issue within minutes. He talked through each step so I understood what was happening and made the process simple. The clear communication and fast resolution made a real difference.
Kirk LentonPilbara Construction
-
“The extra guidance made it more valuable”
Brady tracked down an email I could not locate and took the time to show us how to search more effectively in the future. The extra guidance was helpful and made the experience more valuable. His support was straightforward and appreciated.
Tony YoungOptimus Real Estate
-
“Resolved quickly, with none of my work lost”
They resolved my issue quickly and efficiently, which meant I didn’t lose any of the work I had done today. The support was clear and straightforward, and the outcome made a real difference to my day. Thank you.
Warner PriestInterContinental Energy
-
“Calm, patient and always willing to help”
Dev Sandhu is outstanding in his knowledge and support. He has a calm and patient way of working through any IT issue and is always willing to help at short notice. His positive attitude makes the whole experience easier and more reassuring. Thank you to Dev and the team at Austin for the consistent support.
Peter AlexanderKoch Solutions
-
“Refreshing after two unreliable IT providers”
After dealing with two unreliable IT providers in recent years, it has been refreshing to place my trust in Greg and the team at Austin. They have been professional and highly competent, even under pressure. Their support has made a real difference. Thank you, and keep it up.
Mark HutchisonLifewood
Find out what stands
between you and the certificate.
Tell us which level you need and why. A technical consultant will scope the gaps with you and send the timeline and the cost in writing.
- A reply within two business hoursA technical consultant reads every enquiry and comes back to you.
- Proven in 90No onboarding fee, 14 days to fix anything you raise and nothing owing if you leave in the first 90 days. How it works
Or call 1300 787 429 or email sales@austintechnology.com.au