Level and boundary
Confirm the current edition, the target level and which parts of the business are in scope.
SMB1001 Readiness Assessment
An SMB1001 assessment shows how close your business is to meeting a chosen level of SMB1001, the tiered cybersecurity standard for small and medium businesses published by Dynamic Standards International (DSI). Umbrella Tech confirms the right level and scope, checks your settings, procedures and records against that level, and gives you a clear list of gaps and the practical work needed to prepare for certification.
When this assessment is useful
SMB1001 readiness is worth checking before you apply for certification, when a customer or supplier panel asks for it, or when you are unsure which level to target. It also helps when earlier IT work was done without a standard in mind and nobody knows which controls would stand up to review.
Assessment scope
Technical controls
Review accounts, multi-factor authentication, devices, patching and backups against the level's requirements.
Policies and people
Check that required policies exist, match practice and that staff awareness is covered.
Evidence
Identify which requirements you can already show and which have no supporting record.
Evidence and access
Depending on scope, evidence may include Microsoft 365 and identity settings, device and patch reports, backup records, existing policies, staff training records, and short interviews with the people who manage IT. We agree read-only access and how information is handled before the assessment begins.
Microsoft 365 and identity settings
Device and patch reports
Backup records
Existing policies
Staff training records
Short interviews with the people who manage IT
Findings that lead to action
You receive a requirement-by-requirement view for your target level, marking each as met, partly met or not met, with the evidence behind it. A prioritised action list shows what to fix first and which items need only documentation.
Illustrative findingsExamples only
- ExampleMulti-factor authentication missing on a shared mailbox
- ExampleBackup policy with no recorded restore test
- ExampleStaff training that happened but was never recorded
These are examples of what an assessment can uncover, not findings about your business.
How it runs
Assessment method
01
Choose the level
Agree the edition, target level and scope based on your size, risk and who is asking.
02
Review controls and records
Check the technical settings and policies against each requirement and note the evidence available.
03
Rate and prioritise
Mark each requirement and rank the gaps by effort and importance.
04
Agree next steps
Walk through the findings and agree who will close each gap.
From assessment to remediation
You can close the gaps with your own team or provider, or ask us to deliver them through SMB1001 Implementation. Many fixes are configuration changes in Microsoft 365 and endpoint management.
Assessment outputFindings and remediation roadmap
Umbrella TechWe deliver the improvements
DesignImplementValidate
Your organisationYour internal team
Your partnerYour existing technology provider
SMB1001
SMB1001 is a tiered cybersecurity standard for small and medium businesses, published by Dynamic Standards International (DSI), with five levels of increasing rigour.
About SMB1001 services →Frequently asked questions
Can't see your question? Ask us directly →
What does an SMB1001 assessment include?
Confirming the target level and scope, reviewing technical controls, policies and records against that level, and a prioritised list of gaps. You also keep the evidence gathered, which becomes the start of your certification pack.
How long does the assessment take?
It depends on the target level, the number of users, devices and sites, and how quickly information can be provided. We confirm scope and timing in discovery.
What evidence or access is required?
Usually read-only access to Microsoft 365 and device management, copies of existing policies, and time with whoever manages your IT. We agree the list before starting.
What happens after the assessment?
You decide how to close the gaps. We can implement the changes, support your existing provider, or check progress before you apply for certification.
How much does it cost?
Cost depends on the size of the business, the target level and how much evidence already exists. We confirm scope and cost in discovery. The assessment prepares you for certification; the certification decision belongs to the certifier.
Establish your current position
Tell us who is asking for SMB1001, the size of your business and the level you have in mind. We will scope an assessment that fits.