SMB1001 gap assessment
The free SMB1001 gap assessment on CyberCert's platform scores your business against all 39 published controls across the five SMB1001 tiers and returns a prioritised roadmap. Assessments for every tier, from Bronze only up to Diamond and below, run on the same platform. Nothing is installed, and you keep the result. Real Bytes is a CyberCert Gold MSSP and holds SMB1001 Gold itself.
What the assessment measures
The free check scores all 39 published controls across Bronze, Silver, Gold, Platinum and Diamond. The same platform also runs per-tier assessments, from Bronze only up, so you can score against just the tier you are aiming for.
CyberCert: 2026 control countsThe check asks 40 questions about what you already have in place, such as your firewall, patching, backups and password controls. Nothing is installed and no access to your systems is required.
CyberCert: certification and pricingThe result reflects DSI's Supplier Categorization Matrix: the information you handle, the access you hold and how critical your service is. A customer, insurer or tender may also set a minimum tier.
DSI: Supplier Categorization MatrixYou get a ranked list of what to close first, so you can sequence the work by real risk instead of guessing where to start.
CyberCert: certification and pricingThe assessment reports where your controls stand today. Certification is issued by CyberCert once the controls for your tier are in place, your director signs the attestation and the subscription is paid.
CyberCert: certification and pricingWhat gets checked at each tier
The assessment does not stop at the tier you think you are. It walks the full control set, so the same result shows what you would need for the tier a customer or insurer sets next. Control counts are CyberCert's cumulative SMB1001:2026 totals.
Level 1
7 controls checked
Director attested
Basic preventive controls, including firewalls and antivirus, to stop common threats before they reach your systems.
Level 2
17 controls checked
Director attested
More advanced preventive measures that add layers of protection against increasingly sophisticated threats.
Level 3
27 controls checked
Director attested
A holistic risk management approach where risks to people, processes and technology are identified, assessed and addressed in a coordinated way.
Read the Gold certification guide
Level 4
32 controls checked
Director attested and audited
More formal governance and risk management, with external audit requirements as well as director attestation.
Level 5
39 controls checked
Director attested and audited
The highest tier, with the most demanding governance, risk management and assurance requirements, and an external audit.
What you get back
The assessment is not a single score out of a hundred. It returns three things you can act on straight away, and you keep all of them whether or not you ever talk to us.
Each control in the set gets its own score, so you can see not just that a gap exists but how wide it is.
The result shows the tier your current controls could realistically support, and lists exactly what stands between you and the next one.
Gaps come back ranked, so the work can be sequenced by real risk and handed to whoever will do it, whether that is your own team, us or both.
Nothing is installed, no access to your systems is needed, and the check is free. Published process and inclusions: CyberCert certification and pricing.
Choose your starting level
The main button runs the full Diamond and below check: all 40 questions, every tier. If you would rather start lighter, the same platform runs a check for each tier. Every check scores the tier you pick and every tier below it, so a Gold and below result also shows what Bronze and Silver need.
7 questions, 7 controls
The seven essential controls every supplier starts with
Run the bronze only check17 questions, 17 controls
The mid-tier step up from the essentials
Run the silver and below check27 questions, 27 controls
The tier Real Bytes holds today
Run the gold and below check32 questions, 32 controls
Gold plus the external audit requirements
Run the platinum and below check40 questions, 39 controls
The whole SMB1001 standard in one check
Run the diamond and below checkNot sure which tier applies to you? The Supplier Categorization Matrix section below sets the tier by the information you handle, the access you hold and how critical your service is. A customer, insurer or tender may also set a minimum tier.
How the assessment places your tier
DSI's Supplier Categorization Matrix uses three factors to decide the right level for a supplier. The gap assessment reflects the same factors, so your result and your obligations line up. A customer, insurer or tender may set a minimum on top of this.
Confidentiality
From public information up to restricted and proprietary data. Suppliers handling personal or confidential information are expected to reach Gold or higher.
DSI: Supplier Categorization MatrixIntegrity
From no digital access through standard user access to administrator and physical access. Higher privileges call for stronger controls.
DSI: Supplier Categorization MatrixAvailability
Measured by recovery time objective. A non-critical supplier may accept 30 days; an essential technology service may need to recover in under 8 hours.
DSI: Supplier Categorization Matrix
From roadmap to certificate
Forty questions on CyberCert's platform, answering questions about what you already have in place. Nothing is installed, and you keep the result.
The output ranks the gaps by what matters first, shows the tier you could realistically evidence today, and lists exactly what stands between you and it.
Real Bytes turns the roadmap into a fixed-fee implementation plan. Our engineers make the technical changes, document policies and collect the evidence your certification workbook needs.
Your director signs the attestation letter and CyberCert issues the certificate, valid for 12 months. Platinum and Diamond add an external audit. Our SMB1001 certification page covers the full process.
The gap assessment is free. Real Bytes implements the controls and prepares the evidence, and CyberCert is the certifier. Read CyberCert's published process and inclusions.
Questions
It is a free assessment on CyberCert's platform that scores your business against the SMB1001:2026 controls, from the seven-question Bronze check up to the full 40-question Diamond and below set, and returns a prioritised roadmap of what to close first. CyberCert is the certifier for SMB1001.
CyberCert: certification and pricingThe free check is 40 questions and takes 10 to 15 minutes. Lighter tiers vary: Bronze only has 7 questions, Silver and below 17, Gold and below 27 and Platinum and below 32.
CyberCert: certification and pricingNo. The assessment shows where your controls stand today. Certification is issued by CyberCert once the controls for your tier are in place, your director signs the attestation, and the subscription is paid.
CyberCert: certification and pricingStart with the tier DSI's Supplier Categorization Matrix points to, using the information you handle, the access you hold and how critical your service is. A customer, insurer or tender may also set a minimum tier.
DSI: Supplier Categorization MatrixThe assessment itself is free and runs on CyberCert's platform. You only pay if you go further: the CyberCert subscription for certification, any external audit at Platinum or Diamond, or our implementation work to close the gaps.
CyberCert: certification and pricingBring it to us. Real Bytes is a CyberCert Gold MSSP and holds SMB1001 Gold itself, so we can price the fixes, implement them and prepare the evidence your certification workbook needs.
CyberCert: certification and pricingNo. The check is free and runs on CyberCert's platform, so you can run it without talking to us. Bring us the roadmap when you are ready to close the gaps.
CyberCert: certification and pricingThe security gaps tracker is our own quick self-check across the practical security basics. The gap assessment scores you against the published SMB1001:2026 controls and returns a roadmap you can use for certification.
Real Bytes: security gaps trackerNext step
Run the free assessment, then bring us the roadmap. We confirm the target tier, price the fixes as a fixed-fee plan and prepare the evidence for certification. Want the quick self-check first? Try the security gaps tracker. Ready to go straight to the full process? See our SMB1001 certification page.
Remote Support