Level selection
Confirm the current SMB1001 edition and which of its levels fits your size, risk and customer expectations.
SMB1001 Cybersecurity Consulting
SMB1001 is a tiered cybersecurity standard for small and medium businesses, published by Dynamic Standards International (DSI). It sets out five levels of controls, so a business can certify at a level that suits its size and risk and step up over time. Umbrella Tech helps Australian businesses choose a sensible SMB1001 level, close the gaps and prepare the evidence a certifier will ask to see.
The problem
The challenge we help you address
A customer, supplier panel or insurer wants proof of your cyber security, but ISO/IEC 27001 feels too heavy for the size of the business. Without a clear target, effort goes into tools and policies that may not answer the question being asked.
The outcome
What the engagement should deliver
A chosen SMB1001 level matched to your customers and risk, controls that meet it in your real environment, and an evidence pack ready for certification. You also leave with owners and a routine for keeping controls current after certification.
How we can help
Readiness assessment
Compare your settings, procedures and records against that level's requirements.
Implementation
Close the gaps across accounts, devices, backups, policies and staff awareness.
Evidence preparation
Organise the records a certifier will review and explain what each one shows.
What SMB1001 asks for
SMB1001 groups its requirements by level, with each level building on the one below. Lower levels focus on core cyber hygiene, such as multi-factor authentication, patching and backups. Higher levels add documented policies, stronger access management and more formal governance. Many of the technical controls overlap with the Essential Eight, so work done for one supports the other. DSI publishes the standard; certification is issued separately through DSI's certification arrangements, not by Umbrella Tech.
A programme sized to your organisation
We confirm the edition and target level before mapping requirements. A small office might start at a lower level and move up as contracts demand it, while a larger business handling sensitive client data may aim higher from the start.
Assessment and implementation options
Frequently asked questions
Can't see your question? Ask us directly →
What is SMB1001?
SMB1001 is a cybersecurity standard written for small and medium businesses, with five levels of increasing rigour. A business chooses a level, implements its controls and can then seek certification to show customers and partners where it stands.
Who needs it?
No law requires SMB1001, but customers, supply chains and insurers increasingly ask for evidence of baseline security. It suits businesses that need a recognised answer without the scale of an ISO/IEC 27001 management system, and larger organisations sometimes use it to assess their smaller suppliers.
What are the main requirements?
They depend on the level. Typical requirements cover multi-factor authentication, patching, backups, access control, policies and staff training, with higher levels adding more documentation and governance.
How long does implementation take?
It depends on the level you choose, your starting point and how quickly changes can be made. We confirm scope and timing in discovery, usually after a readiness assessment shows the size of the gap.
How does it relate to other frameworks?
SMB1001 shares many technical controls with the Essential Eight. For organisations that later need ISO/IEC 27001, the policies, records and ownership built for SMB1001 give the management system a head start.
Plan the next improvement
Tell us who is asking for SMB1001, how large the business is and what you already have in place. We will help you choose a sensible level and starting point.