RemoteSMB1001 Gold
Someone asked for Gold. Here is what it takes.
Gold is the middle of the five SMB1001 tiers, and often the one clients, insurers and tender panels name. It is where security stops being a list of tools and becomes something you can show you manage. We check where you stand, close the gaps, write the paperwork with you and get you through SMB1001 Gold certification with CyberCert. We hold Gold ourselves.
Real Bytes is a Brisbane based managed IT and security provider. The checks, the paperwork and the certification are all done remotely, so a business anywhere in Australia gets the same service.
- Tier
- 3 of 5
- Controls in SMB1001:2026
- 27
- Added on top of Silver
- +10
27Gold controls- Technology management7
- Access management8
- Backup and recovery2
- Policies, plans and procedures9
- Education and training1
What Gold adds
10 new controls on top of Silver's 17.
Gold keeps everything below it and adds these. It also raises the bar on 3 controls you already have from Silver and Bronze.
1.12.0.0Endpoint Detection and Response (EDR)
Guardz managed EDR, or CrowdStrike, SentinelOne, Huntress or Microsoft Defender, monitoring workstations, laptops and servers with automatic isolation. Diamond adds 24/7 managed detection and response under SLA, which we deliver through our monitoring service.
2.6.0.0MFA on all business applications and social media
Guardz flags connected apps without MFA. We enable it app by app across every cloud business application and social account. Diamond restricts it to phishing-resistant methods.
2.7.0.1RDP only over VPN
We configure the firewall and VPN, on UniFi, Fortinet or Cato, so remote desktop is never exposed to the internet and only reachable through a managed VPN or proxy.
3.2.0.0Business or cyber insurance
You buy the cover, including ransomware recovery, incident response costs and business interruption. Guardz posture and evidence reports support the application, and we help answer the security questions.
4.4.0.0Cybersecurity policy
We draft one policy covering security requirements, staff responsibilities and acceptable use, every employee reads and signs it, and we help you review it annually.
4.5.0.0Incident response plan
Guardz managed detection and response provides live detection, containment and reporting. We write the plan with you: who to call, containment steps and communications. Diamond adds breach notification playbooks for customers, staff, media and authorities.
4.6.0.0Secure physical document destruction
An operational process: contracts, financial records and HR files shredded or destroyed through a secure service. We help you choose a method and record the evidence.
4.7.0.0Secure disposal of devices
The Guardz device inventory shows what to retire. We wipe, record and dispose of devices beyond recovery before resale or donation.
4.8.0.0Digital asset register
Guardz device, user, application and external asset inventories export to seed the register of where sensitive data lives. We add external media and offline hardware. Diamond extends it to map every asset holding personal data, audited annually.
4.11.0.0Responsible AI use policy
We write rules for which AI tools staff may use with company and client data, how risks are managed and how privacy compliance is kept.
Raised at Gold
5.1.0.0 to 5.1.1.0Cybersecurity awareness training for all employees. Continuous campaign with phishing simulations and annual review.2.4.0.1 to 2.4.1.1Password manager. Extended to all staff.2.12.0.0 to 2.12.1.0Email authentication and anti-spoofing. DKIM and enforced DMARC added.
The control people miss
Multi-factor sign-in on every app.
Silver asks for it on email. Gold asks for it on every business app and every social media account. That means the accounting system, the CRM, the bank portal, the website login and the company LinkedIn and Facebook pages, for every person who uses them.
It is the Gold control businesses most often think they have and do not. We list every app your team signs in to, match it against your staff list, and close the gaps before your director signs.
Readiness check
How close are you to Gold?
Tick each control you already have in place for everyone. Your score updates as you go.
Gold in 2027
One new control. Clearer wording. No new product.
SMB1001:2027 takes Gold from 27 to 28 controls. A current certificate runs its full 12 months, so you meet the 2027 version when you next renew.
The plan must be exercised at least once a year, not just reviewed. From Gold that is a tabletop exercise on one realistic scenario, with the date, participants and improvements recorded. We run it with your incident response staff, using real detection and response reports as the source material. Platinum and Diamond raise the depth, below.
What the 2027 text clarifies at Gold
1.1.0.0Engage a technical support specialist. The Technical Support Specialist is now a defined role: an employee, an external IT provider or an MSP, not necessarily full time.1.3.0.2Anti-virus on all organisation devices. Anti-malware is defined against endpoints (workstations, laptops, servers). It does not apply on an endpoint that already runs a qualifying EDR.1.4.0.1Automatically install tested patches on all devices. Software, operating systems and hardware must stay inside vendor support. End-of-life and end-of-support products are retired, upgraded or given a formal exception with compensating controls. Unpatchable OT assets are documented and the exception is reviewed every year.2.1.0.2Strong password hygiene. Mobile devices managed under MDM meet this control through the MDM-enforced authentication settings.1.6.0.2All servers updated and patched. For servers a provider runs under shared responsibility, keep written confirmation, a current security attestation or the provider trust-centre statement, plus a record of who is responsible for which server.2.3.0.1Individual user accounts for every employee. Kiosks, fixed-function devices and break-glass admin accounts may share credentials only through a password manager with a request-access workflow, a per-user audit log and MFA.2.4.0.2Password manager. Secure sharing is allowed for service accounts, API credentials and break-glass accounts, never for routine staff logins. Where DLP or CASB is impractical for a small business, the password manager native auditing is accepted.2.5.0.0MFA on all employee email accounts. At Platinum and above, a vendor-required fallback method on a break-glass admin account is tolerated if a stronger method is the primary factor, the fallback is limited to recovery and its use is monitored.
Plus 8 more in the full list.
How we get you there
Four stages to a Gold certificate.
Find the tier and the gaps
We doWe work out your tier from the information you hold, the access you have and how critical you are, then check every control against it. You get a gap list with the evidence each control needs.
You doTell us who your clients are and what they ask for. Forward any supplier questionnaire or tender clause.
Gather the business evidence
We doWe give you a folder structure with one subfolder per control number and a list of what goes in each.
You doAdd the business side first: policies, signed agreements, training records, the asset register and your insurance. Doing this early means our hours go on fixing, not chasing paperwork.
Fix and prove the technical controls
We doOur engineers close the gaps and capture the proof: firewall, patching, anti-malware, EDR, multi-factor sign-in, backups and email security records.
You doApprove changes that affect staff, like new sign-in prompts, and nudge anyone who lags behind.
Attest, certify, renew
We doWe walk your director through the CyberCert portal, control by control. At Platinum and Diamond we prepare you for the independent audit. Then we keep the controls running for next year.
You doYour director reviews the evidence and signs the attestation. CyberCert issues a certificate anyone can verify.
What Gold costs
Three parts to SMB1001 Gold certification. All quoted first.
Our Advantage plan is built to reach Gold, and Ultimate goes from Gold up. If you are on either, most of the technical controls are already running and the work is mostly paperwork and evidence.
See the plans- The Gold certificate
CyberCert's annual Gold subscription, priced on CyberCert's site. No audit fee at Gold. We pass it through at cost.
- Our certification work
A fixed fee for the gap check, evidence pack and walking your director through attestation. No hourly charges on top.
- Closing the gaps
Quoted from the gap check. Often EDR, multi-factor sign-in on the remaining apps, and email authentication.
Get help your way
Six ways to reach us. Pick whichever suits you.
Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.
- Call 07 3114 2808
An engineer answers Monday to Friday, 8am to 5pm AEST. After hours, weekends and public holidays, Chip, our AI agent, answers on the same number or on 07 3180 0965, logs it and escalates urgent incidents to the on-call engineer.
Call now - Email the helpdesk
Send it to helpdesk@realbytes.com.au and a ticket is logged straight away, with a reference number you can quote.
Email us - Client portal
Log and follow your tickets, see what we are working on and who has it.
Open the portal - Remote support
When an engineer asks to see your screen, start a secure session here. You start it, so nobody sees your screen until you do.
Start a session - Chat in Microsoft Teams
Clients can message Chip, our AI assistant, in Teams to log a request without leaving their desk.
How clients reach us - Service status
Check whether Microsoft 365 or another cloud service is down before you lose an hour troubleshooting.
See live status
Questions
What people ask about Gold.
What is SMB1001 Gold?
Gold is Level 3 of the five SMB1001 tiers. It moves past technical basics into managing risk: endpoint detection and response, multi-factor sign-in on every business app, a written cyber security policy, an incident response plan, an asset register, an AI use policy and cyber insurance. SMB1001:2026 has 27 controls at Gold, and SMB1001:2027 has 28.
Who needs Gold rather than Silver?
Businesses that hold personal or confidential information for clients, or have elevated access to their systems. In practice that is often law firms, accountants, brokers and suppliers to government or larger companies. It is also often the tier insurers ask about. If a client or tender names a tier, that tier wins.
Is there an audit at Gold?
No independent audit. Your director or owner signs an attestation through CyberCert that every control is in place. That signature carries real weight, so we check the evidence covers every person, device and account before anyone signs.
How long does Gold take?
It depends on where you start. If EDR, multi-factor sign-in and email authentication are already running, most of the time goes into the written policies and the incident response exercise. If they are not, the technical work comes first. The gap check gives you a realistic timeline for SMB1001 Gold certification before you commit.
What changes for Gold in 2027?
One new control: you run a practice exercise of your incident response plan each year. Several existing controls have clearer wording, such as the asset register covering physical as well as IT assets, and the AI policy needing written staff acknowledgement and a list of approved tools. There is no new product to buy.
Are you Gold certified yourselves?
Yes. Real Bytes holds SMB1001 Gold through CyberCert, so we have been through every step we take you through.
We are not in Brisbane. Does that matter?
No. The checks, the paperwork and the certification are all done remotely, so a business anywhere in Australia gets the same service.
Next step
Find out how far you are from Gold.
Run the free Gold gap check on CyberCert's platform, then talk to an engineer about what it found. Not sure Gold is right? Find your tier in three questions.
Keep reading
- SMB1001 certification All five tiers, the tier finder, and how certification works.
- Every SMB1001 requirement All 39 controls for 2026 and 44 for 2027, searchable.
- Free SMB1001 gap check How the CyberCert gap assessments work and what the score means.
- SMB1001 for law firms Privacy Act, AML/CTF and panel evidence for legal practices.
- SMB1001 in Brisbane Local certification support from engineers you can meet.
- Managed plans Which plan reaches which tier, and what each one includes.
Checked 30 October 2026 against SMB1001:2026 v1.0 and SMB1001:2027 v1.0 published by Dynamic Standards International. CyberCert issues certificates. Badges belong to their owners.