SMB1001 certification
When a client or insurer asks how you protect their information, a list of products is not enough. We assess your gaps, implement the agreed fixes and organise the evidence for certification through CyberCert. Real Bytes holds SMB1001 Gold through CyberCert and supports businesses across Australia.
What the certification means
Dynamic Standards International publishes SMB1001. The current edition is SMB1001:2026, released on 1 September 2025 and updated annually to track the threat landscape. CyberCert publishes the certification requirements against it.
DSI: SMB1001:2026SMB1001 has five levels, from Bronze to Diamond. You begin at the level that matches your context, not at Level 1. You are not required to complete all five levels, and you keep the progress of previous work when you move up.
DSI: SMB1001:2026DSI's Supplier Categorization Matrix sets the right level using three factors: the information you handle, the access you hold, and how critical your service is. A customer or insurer may also specify a minimum tier in a contract or tender.
DSI: Supplier Categorization MatrixCyberCert is the certifier. Every subscription includes a step-by-step workbook, 12 months of portal access, an attestation letter, a shareable digital certificate, a PDF certificate with a QR code, and display badges. Platinum and Diamond also require an external audit.
CyberCert: certification and pricingDSI has mapped SMB1001 to the United Kingdom Cyber Essentials, the United States CIS Controls and CMMC. Working towards SMB1001 also starts your alignment with those frameworks, so the effort is not wasted when a customer asks for something else.
DSI: SMB1001:2026The five tiers
Choose the tier that matches your risk and customer requirements, not simply the highest badge. Control counts are CyberCert's cumulative SMB1001:2026 totals. The access, information and recovery time descriptions come from DSI's Supplier Categorization Matrix.
Level 1
7 controls total
Director attested
Basic preventive controls, including firewalls and antivirus, to stop common threats before they reach your systems.
Level 2
17 controls total
Director attested
More advanced preventive measures that add layers of protection against increasingly sophisticated threats.
Level 3
27 controls total
Director attested
A holistic risk management approach where risks to people, processes and technology are identified, assessed and addressed in a coordinated way.
Level 4
32 controls total
Director attested and audited
More formal governance and risk management, with external audit requirements as well as director attestation.
Level 5
39 controls total
Director attested and audited
The highest tier, with the most demanding governance, risk management and assurance requirements, and an external audit.
How the right tier is chosen
DSI's Supplier Categorization Matrix uses three factors to decide the right level for a supplier. A customer, insurer or tender may set a minimum on top of this, but the matrix is where the tier starts.
Confidentiality
From public information up to restricted and proprietary data. Suppliers handling personal or confidential information are expected to reach Gold or higher.
DSI: Supplier Categorization MatrixIntegrity
From no digital access through standard user access to administrator and physical access. Higher privileges call for stronger controls.
DSI: Supplier Categorization MatrixAvailability
Measured by recovery time objective. A non-critical supplier may accept 30 days; an essential technology service may need to recover in under 8 hours.
DSI: Supplier Categorization Matrix
From gap assessment to evidence
We review the information you hold, the access you have and how critical your services are, then compare your controls with the agreed tier and edition. You get a clear gap list and the evidence each requirement needs.
You receive prioritised fixes, responsibilities and a timeline based on your actual gaps. We keep our implementation work separate from the CyberCert subscription and any external audit fees, so you can see exactly what you are approving.
Our engineers make the agreed technical changes, help document your policies and test that protections work. We collect the configuration records, test results and supporting documents that fill out your certification workbook.
Your director or owner reviews the evidence and signs the attestation letter. For Platinum and Diamond we also prepare you for the external audit. CyberCert issues the certificate, valid for 12 months, once its requirements are met. We review changes and renewal with you so the controls do not slip between cycles.
Real Bytes implements the controls and prepares the evidence. CyberCert is the certifier. Read CyberCert's published process and inclusions.
Framework alignment
DSI has mapped SMB1001 to leading international frameworks, so the work you do for one tier also starts your alignment with these. It is not a replacement for them, but it means the effort carries over.
United Kingdom
The UK government-backed baseline for cyber hygiene. DSI maps SMB1001 to it.
United States
The Center for Internet Security prioritised controls. DSI maps SMB1001 to them.
United States
The Cybersecurity Maturity Model Certification used in US defence supply chains. DSI maps SMB1001 to it.
Need a separate Australian framework assessment? See our Essential Eight alignment and framework comparison guide.
Questions
SMB1001 certification shows conformity with a tier of Dynamic Standards International's cyber security standard for small and medium businesses. The five tiers run from Bronze to Diamond. CyberCert certifies against SMB1001:2026, the current edition. We confirm the applicable edition before scoping your work.
DSI: SMB1001:2026Choose the tier from DSI's Supplier Categorization Matrix, which uses three factors: the information you handle, the access you hold, and how critical your service is. A customer, insurer or tender may also set a minimum tier. Confirm any contractual requirement before you pick the target.
DSI: Supplier Categorization MatrixCyberCert publishes 7 controls at Bronze, 17 at Silver, 27 at Gold, 32 at Platinum and 39 at Diamond for SMB1001:2026. These are cumulative totals, not extra controls added at each level. The 2027 early-access edition may change them, so we confirm the edition before quoting.
CyberCert: 2026 control countsBronze, Silver and Gold use a director's or owner's attestation, with no mandatory external audit. Platinum and Diamond add an external audit on top of attestation. CyberCert lists the audit fee separately from the subscription. Attestation still requires the controls to be in place; it is not simply permission to display a badge.
CyberCert: certification and pricingEvery subscription includes a step-by-step workbook, 12 months of portal access, an attestation letter, a shareable digital certificate, a PDF certificate with a QR code for online verification, and display badges. You can view a live example certificate on CyberCert's registry.
CyberCert: live example certificateA CyberCert certificate is valid for 12 months from the issue date. Renewal requires the controls to still be in place, so we treat certification as an ongoing cycle rather than a one-off project.
CyberCert: certification and pricingNo. SMB1001 does not automatically satisfy the Privacy Act, AML/CTF obligations, ISO/IEC 27001 or a customer's Essential Eight requirements. DSI has mapped SMB1001 to Cyber Essentials, CIS Controls and CMMC, so the work carries over, but you must still meet each obligation and confirm what your customer or insurer accepts.
DSI: SMB1001:2026Yes. DSI releases a new edition annually. SMB1001:2026 is current. DSI has announced early access to SMB1001:2027 from 1 September 2026 and free use of the standard from 1 January 2027. Free use of the standard does not make implementation work or external audits free.
DSI: 2027 release roadmapNext step
Talk to an engineer about your current controls and the evidence a client or insurer needs. We will confirm the target tier, applicable edition and a priced plan for closing the gaps. Need a separate framework assessment? See Essential Eight alignment.
Remote Support