SMB1001 all levels
SMB1001:2026 has 39 requirements across five tiers, and we cover every one of them. We run an always-on security platform for every client, our engineers deliver the configuration, policy and process, and our partner stack supplies the specialist tools for everything else: Guardz for the automated layer, alongside SentinelOne, Check Point, UniFi, ThreatLocker, Keeper and Sendmarc. Below is every requirement, who delivers it and what we do. Same service in any Australian city.
The five-tier ladder
Level 1
7 of 39
requirements, 7 new at Bronze
A business with the basics in hand that has never had to show them to anyone.
Level 2
17 of 39
requirements, 10 new at Silver
A business where one stolen password or one fake invoice would hurt.
Level 3
27 of 39
requirements, 10 new at Gold
A business whose clients, tenders or insurers ask for written policies and a plan for when something goes wrong.
Level 4
32 of 39
requirements, 5 new at Platinum
A business whose buyer wants an outside party to have checked, not only the director word.
Level 5
39 of 39
requirements, 7 new at Diamond
A business that must show the highest assurance, including how it manages its own suppliers.
Every tier includes the one below it. Bronze, Silver and Gold are signed off by your director. Platinum and Diamond are checked by an external auditor before CyberCert issues the certificate. Typical time to certify: weeks at Bronze to Gold, two to three months with a separate audit fee at Platinum and Diamond.
Compare the five tiers in detailArea 1
Firewalls, anti-virus, patching, EDR, encryption and the systems that carry the work.
Area 2
Passwords, password managers, multi-factor authentication and email authentication.
Area 3
Backups, tested restores, and the insurance that funds a recovery.
Area 4
The written rules: cybersecurity policy, incident response, AI use and supplier trust.
Area 5
Awareness training and incident exercises that test the plan works.
What changed in the 2026 edition
SMB1001 is reviewed every year against the current threat landscape. The 2026 edition answered the rise in email-based attacks, made threat detection mandatory from Gold, and brought AI into scope for the first time. If you certified under the 2025 edition, these are the controls that now matter at recertification.
SPF on every sending domain from Silver, then DKIM and an enforced DMARC policy from Gold. A direct answer to email fraud, phishing and brand impersonation.
2.12.0.0 / 2.12.1.0
EDR on every workstation, laptop and server from Gold, with 24/7 managed detection and response demanded at Diamond.
1.12.0.0 / 1.12.1.0
Cyber awareness training is now a day-one control, not something a business grows into. The human firewall starts at the entry tier.
5.1.0.0
A written policy for the acceptable and secure use of AI, from Gold. Guardrails for data leakage, intellectual property loss and privacy breaches.
4.11.0.0
Gold grew from 23 to 27 controls in the 2026 edition, and business or cyber insurance is one of the additions.
3.2.0.0
Clarified guidance on modern password hygiene, and a clearer definition of what counts as a small or medium business.
2.1.0.1
Flags follow the CyberCert convention for marking major change from the previous edition. Businesses already certified under SMB1001:2025 must demonstrate the new controls at their next annual recertification.
Why now
The AML/CTF reforms brought around 100,000 businesses inside the Privacy Act: lawyers, accountants, conveyancers, real estate agents, trust and company service providers and precious metals dealers.
Australian Privacy Principle 11 asks them to take reasonable steps to protect the personal information they hold. Most hold identity documents, trust and settlement details and client funds, and few have been asked to show how they protect them. This is general information, not legal advice.
SMB1001 gives a small business a clear ladder to climb and an independent certificate to show for it. The standard is built around the managed service provider: requirement 1 is to engage a technical support specialist.
Reading for your sector? See SMB1001 for law firms.
84,700
cybercrime reports in FY24-25, one every six minutes
$56,600
average loss per incident for a small business, up 14%
$97,200
average loss per incident for a medium business, up 55%
Source: ASD/ACSC Annual Cyber Threat Report 2024-25. Privacy Act figure as reported in the Guardz and CyberCert SMB1001:2026 partner guide.
Coverage at a glance
We cover the standard in three layers. The first is Guardz, the always-on platform we run for every client. It runs 4 of the 39 requirements natively and verifies or evidences 13 more, from anti-virus, EDR and device posture to awareness training, exposure scanning, MFA checks and dark web monitoring. It watches those controls every day at every tier, so the evidence is ready when the auditor asks.
The second layer is the specialist stack. No single platform does all 39 requirements well, so we pair it with the vendors below: the network, endpoint, identity and email specialists that each do one job better than anyone else, and each one a vendor we hold status with.
The third layer is us. Our engineers wire the layers together, configure every control to the SMB1001 standard and evidence the lot, because no requirement is met by software alone.
| Vendor | The job we give it | What it covers in the standard |
|---|---|---|
| Guardz | Always-on security platform | Runs 4 of the 39 requirements natively and verifies or evidences 13 more: anti-virus, EDR, device posture, security awareness training, external exposure scanning, MFA checks and dark web credential monitoring. |
| SentinelOne | Endpoint detection and response | Stops malicious code on servers, laptops and desktops and can roll back encrypted files, feeding the endpoint evidence the standard asks for. |
| Check Point | Firewall and network edge | Holds the perimeter: firewall rules, network segmentation and VPN between your network and the internet. |
| UniFi | Network infrastructure | Gateways, switching and wireless, designed, installed and hardened by our technology solutions practice. |
| ThreatLocker | Application allowlisting | Decides what software is allowed to run, so ransomware and unapproved tools never get a foothold. |
| Keeper | Password and credential management | Vaults every credential, enforces strong passwords and MFA, and closes the password reuse gap. |
| Sendmarc | Email authentication | Proves your email is really yours with SPF, DKIM and DMARC, blocking spoofed domain attacks. |
BronzeSilverGoldPlatinumDiamondNative. The capability is native to our platform. We deploy and run it to complete the control.
Enables. Our platform verifies, drives or evidences the control. The configuration or document is ours.
Enables (partial). Our platform covers part of the control. The rest needs a specialist partner.
Our stack. Another tool, provider or process fulfils it, and our platform does not check it.
Automated by our platform4 reqs, 10%
Anti-virus, EDR, awareness training and external scanning run on Guardz, the always-on layer in our stack.
Checked by our platform12 reqs, 31%
MFA checks, patch visibility, dark web monitoring, device posture and more, reported by the same platform.
Identity and access7 reqs, 18%
Configured on 1Password, Keeper, Cisco Duo, Okta, UniFi, Fortinet and Cato.
Backup and continuity2 reqs, 5%
Built and tested on Veeam, Acronis, Axcient, Synology and Keepit.
Endpoint and application controls3 reqs, 8%
ThreatLocker application control, Microsoft 365 macro controls and our support desk.
Policy, people and process11 reqs, 28%
Drafted, implemented and evidenced by Real Bytes, our external testing partners and your team.
Tiers are cumulative: Bronze is requirements 1 to 7, Silver 1 to 17, Gold 1 to 27, Platinum 1 to 32 and Diamond all 39. Green and blue are the two layers our always-on platform, run on Guardz, delivers: what it runs natively and what it verifies or enables. The remaining slices are the controls our partner stack and our engineers deliver. Source: the Guardz and CyberCert SMB1001:2026 partner guide, mapping v1.0, updated 22 October 2026.
Who does what
Detects, contains and reports, so the incident response plan has a live engine behind it.
Identity threat detection checks Microsoft 365 and Google Workspace accounts for missing MFA and flags bypass such as token theft.
Flags leaked credentials tied to real users so we can reset them before they are used.
Finds vulnerabilities and checks SSL certificates on verified domains.
Adaptive training and phishing simulations, graded per user. Phishing, BEC and invoice-fraud campaigns are tracked per person.
OS firewall on, BitLocker or FileVault status, and vulnerable third-party apps.
Devices, users, applications and external assets, exported to CSV to seed the asset register.
Agentic reporting pulls evidence together for certification submissions and for cyber insurance applications.
Tools we run in the stack, plus documented policy and process.
Patch installation on devices and servers.
Perimeter, RDP only over VPN, MFA on VPN and RDP.
Including the offline, isolated copy at Platinum.
Required at Silver, with a stronger version at Gold.
Admin rights, individual accounts, macros, application control and encryption.
Cyber, AI use, invoice fraud, confidentiality and the incident response plan.
The annual penetration test and the incident response exercise.
Insurance, police vetting, the supplier program, document destruction and device disposal.
The Log Ingestion and Retention add-on brings firewall, endpoint and cloud logs into Guardz with 1, 2, 3 or 7 year retention. It supplies supporting evidence for requirements 2, 20, 23, 31 and 32, and audit evidence at Platinum and Diamond. It does not deliver those controls on its own.
Every gap is filled from our partner catalogue.
The partners behind the controls
When a requirement needs a different tool, we draw on the vendors we hold status with. Guardz is one of them, alongside the firewall, backup, identity and email specialists below. Full profiles are on the partners page.
Ubiquiti UniFi, Fortinet, Check Point, Cisco Meraki, HPE Aruba, Cato Networks, Cloudflare
Guardz, CrowdStrike, SentinelOne, Huntress, Microsoft Defender, Sophos, Bitdefender, ThreatDown
EasyDMARC, Sendmarc, Proofpoint, DefensX
Cisco Duo, Okta, 1Password, Keeper
Veeam, Acronis, Axcient, Commvault, Rubrik, Keepit, Redstor, Synology, ConnectWise Cloud Backup
ThreatLocker, Inforcer, Robo Shadow
CyberCert
Vendor capability descriptions on the partners page are the vendors' own claims. Guardz coverage reflects the vendor mapping of Guardz to SMB1001:2026 v1.0, published October 2026.
The full mapping
Switch tiers to watch the ladder build. Each row carries the published control code, the tier that first requires it, the raised variants higher tiers demand, who delivers it and what we do.
Level 3
The big 2026 step-up: EDR is required, and the incident response plan, asset register and AI policy arrive.
27 requirements cumulative, including everything below Gold. Platform coverage 13 of 27. Signed off by your director through CyberCert. Typical time: weeks.
That is us. Platinum raises this to a service agreement with key incident response staff reachable within 8 working hours, which we write into your agreement.
Raised at Platinum (1.1.1.0): MSP SLA with 8 working hour incident response.
Guardz checks every device firewall is on. We supply and configure the network firewall: UniFi, Fortinet, Check Point, Meraki or Cato.
Platform planAll plans, more on Ultimate or Elite
Guardz managed anti-malware, or Microsoft Defender, Bitdefender or Sophos on our management stack. Mobile devices are covered through official app stores and device management.
Platform planAll plans
Guardz lists third-party apps with known vulnerabilities. We install the patches through our remote management tooling.
Platform planUltimate or Elite
Guardz external scanning checks certificates on verified domains. We fix anything flagged with your web host or Cloudflare.
Platform planAll plans
Guardz shows vulnerable software on servers. We patch servers on a documented schedule with critical patches applied within 14 days of release.
Platform planUltimate or Elite
Guardz managed EDR, or CrowdStrike, SentinelOne, Huntress or Microsoft Defender, monitoring workstations, laptops and servers with automatic isolation. Diamond adds 24/7 managed detection and response under SLA, which we deliver through our monitoring service.
Platform planUltimate, or Command with BYO Defender or the S1 Control add-on
Raised at Diamond (1.12.1.0): EDR with 24/7 managed detection and response under SLA.
Guardz dark web monitoring flags leaked credentials tied to your users. We set the password policy in your directory and reset exposed accounts.
Platform planAll plans
We remove local admin rights through directory and endpoint configuration, for local and domain accounts, and keep a record of exceptions.
We audit your directory for shared accounts and replace them with named accounts, so activity can be traced and access revoked on departure.
We deploy and configure 1Password or Keeper for privileged users, with MFA, role-based access and audit logging. Gold extends it to all staff.
Raised at Gold (2.4.1.1): Extended to all staff.
Guardz identity threat detection verifies MFA on Microsoft 365 and Google Workspace and detects MFA bypass. We enable MFA in your directory. Platinum restricts it to phishing-resistant methods: authenticator apps or hardware keys, not SMS or email codes.
Platform planAll plans
Raised at Platinum (2.5.1.0): Phishing-resistant methods only, SMS and email codes excluded.
Guardz flags gaps and blocks spoofing inbound. We configure SPF on every sending domain. Gold steps up to DKIM and an enforced DMARC policy with EasyDMARC or Sendmarc.
Platform planAll plans
Raised at Gold (2.12.1.0): DKIM and enforced DMARC added.
Guardz flags connected apps without MFA. We enable it app by app across every cloud business application and social account. Diamond restricts it to phishing-resistant methods.
Platform planAll plans
Raised at Diamond (2.6.1.0): Phishing-resistant methods on all business apps.
We configure the firewall and VPN, on UniFi, Fortinet or Cato, so remote desktop is never exposed to the internet and only reachable through a managed VPN or proxy.
We design and test your backups on Veeam, Acronis, Axcient, Synology or Keepit, for the data that matters. Guardz does not cover backup, so this one is ours and the backup vendor. Platinum raises it to weekly or better backups, at least 6 months of retention, a restore tested at least yearly and an offline, isolated copy.
Raised at Platinum (3.1.1.1): Weekly or better backups, 6 month retention, annual tested restore, offline isolated copy.
You buy the cover, including ransomware recovery, incident response costs and business interruption. Guardz posture and evidence reports support the application, and we help answer the security questions.
A human resources and legal process binding staff, contractors and third parties before they access your data. We give you a checklist and confirm the evidence is in place.
We draft the policy with you around how your business actually pays and approves invoices, including dual verification for bank account changes.
An on-premises process run by your business, recording name, organisation and check-in and out times. We supply a simple register and the evidence format.
We draft one policy covering security requirements, staff responsibilities and acceptable use, every employee reads and signs it, and we help you review it annually.
Guardz managed detection and response provides live detection, containment and reporting. We write the plan with you: who to call, containment steps and communications. Diamond adds breach notification playbooks for customers, staff, media and authorities.
Platform planUltimate or Command
Raised at Diamond (4.5.1.0): Breach notification playbooks and data exposure guidance added.
An operational process: contracts, financial records and HR files shredded or destroyed through a secure service. We help you choose a method and record the evidence.
The Guardz device inventory shows what to retire. We wipe, record and dispose of devices beyond recovery before resale or donation.
Guardz device, user, application and external asset inventories export to seed the register of where sensitive data lives. We add external media and offline hardware. Diamond extends it to map every asset holding personal data, audited annually.
Platform planAll plans
Raised at Diamond (4.8.1.0): Personal data mapping and annual audit added.
We write rules for which AI tools staff may use with company and client data, how risks are managed and how privacy compliance is kept.
Guardz adaptive training and phishing simulations with per-user records and grades. We enrol your team and report results. Gold raises this to a continuous campaign with an annual policy review.
Platform planAll plans
Raised at Gold (5.1.1.0): Continuous campaign with phishing simulations and annual review.
Requirements marked new are the ones this tier adds. Requirements with a raised note are demanded at a higher standard from that tier. Rows flagged new control, moved control or updated control are the significant changes DSI made in the 2026 edition. Each row names who delivers it: our platform where it covers the control, and the partner vendors where it does not. Rows include every requirement up to and including Gold; switch tiers above to see the ladder build.
Mapping reflects SMB1001:2026 v1.0 and Guardz capabilities as published in October 2026. Platform coverage supports SMB1001 controls and does not guarantee a certification outcome. Certification is earned against every control in a tier and issued solely by CyberCert. The standard is published by Dynamic Standards International.
Every industry, one ladder
The requirements and the platform stay the same whether you are a five-person law practice or a 200-seat resources contractor. What changes is the tier you target and the requirements your sector leans on. This is where our four practices meet: the platform controls, our engineers, and the compliance context of your industry.
Client conveyancing funds and the AML/CTF reforms put law firms inside the Privacy Act from 1 July 2026.
Invoice fraud (23), MFA (13) and the AI use policy (22) matter most: settlement funds, privileged material and now AI-drafted documents.
Read about IT in legalPrivacy Act, My Health Records rules and RACGP and AGPAL accreditation all expect documented IT controls.
Patient record backup (6), encryption of devices (33) and access control (10 to 11) carry the weight at review time.
Read about IT in healthcare and medicalTrust account fraud, BEC and cyber insurance renewals now ask for MFA, EDR and tested backup evidence.
Business email compromise (5, 19), invoice fraud (23) and the supplier program (24) are where losses and claims cluster.
Read about IT in accounting and professional servicesHead contractors increasingly flow cyber requirements down to subcontractors in their onboarding terms.
Shared site devices, RDP exposure (31 to 32) and payment-detail fraud (23) are the practical risks on a job site.
Read about IT in construction and tradesSOCI Act obligations, state mine safety regulators and head-contractor security schedules sit above the SMB1001 baseline.
Remote site access (20, 31), OT and IT boundary risks and 24/7 incident response (39) are non-negotiable.
Read about IT in mining and resourcesSchools and training providers hold student and staff personal information, and parents and boards now ask what protects it.
Shared device hygiene (33 to 35), MFA on staff accounts (13) and vendor management (25) are the standing weak points.
Read about IT in educationAgencies and their suppliers answer to the PSPF and the Essential Eight, so evidence of implementation matters more than intent.
Patching (4, 9), privileged access (11) and logging (23) are the controls auditors pull first.
Read about IT in government and public sector suppliersPayment terminals, casual staff turnover and POS devices make the entry tiers the fastest security win per dollar.
Device encryption (33), phishing-aware casual staff (7) and default passwords (12) close the most common attack paths.
Read about IT in retail and hospitalityNFPs hold donor and client data on thin budgets, and grant guidelines increasingly name basic cyber controls.
MFA (13), backup (6) and the affordable always-on controls from the entry tiers fit the funding reality.
Read about IT in not-for-profitsFarm businesses now run cloud accounting, telemetry and remote access, and rural connectivity shapes how controls are delivered.
Remote access (31), device posture (2) and staff training (7) cover the main exposure at realistic cost.
Read about IT in agricultureCritical infrastructure obligations and high-value operational technology put these sectors above the standard entry tiers.
Network isolation (1, 20), logging and retention (23) and incident response exercised annually (39).
Read about IT in utilities and telcoAccreditation and the Privacy Act both ask providers to show how client records are protected.
Backup (6), access on shared workstations (10, 11) and staff training (7) are the recurring audit findings.
Read about IT in aged care and community servicesTier targets are our recommendation based on the regulatory and contractual pressure in each sector, not a CyberCert rule. A gap assessment places your business on the ladder regardless of industry.
How it works
We score you against all 39 requirements and place you on the ladder. You get a gap list, not a sales pitch.
The always-on controls run from one console. Our engineers handle the configuration, policies and processes that software cannot do for you.
Your director signs Bronze, Silver or Gold through CyberCert. Platinum and Diamond add independent audit. We keep the evidence current each year.
Questions
Next step
Talk to an engineer, or run the free SMB1001 gap assessment first. Already know your target? See SMB1001 Gold or the overview of all five tiers.
Remote Support