If ISO 27001 feels like using a sledgehammer to crack a nut, SMB1001 may be what you are looking for. It is a tiered cyber security standard, published by Dynamic Standards International (DSI), designed specifically for small and medium businesses, a way to demonstrate real security maturity without the cost and overhead of enterprise certification.
What SMB1001 is
SMB1001 defines a graded set of cyber security controls across multiple tiers, so a business can start at a level that matches its size and risk and step up over time. The point is proportionality: a five-person trades business and a 150-seat professional-services firm should not be held to the same bar, but both should be able to prove they take security seriously.
Why it matters now
Two pressures are pushing SMB1001 up the agenda for Australian businesses:
- Supply chains. Larger clients and government buyers increasingly require evidence of baseline security before they will engage you. A recognised certification can answer many of those questions with one piece of evidence.
- Cyber insurance. Insurers want proof of controls, not promises. Certification is structured evidence.
How the tiers work
Without getting lost in the detail, SMB1001 is layered so that each tier adds controls on top of the one below:
| Tier | Roughly suits | Focus |
|---|---|---|
| Lower tiers | Micro / small business | Core hygiene, MFA, backups, updates, awareness |
| Middle tiers | Growing SMB | Documented policy, access control, monitoring |
| Higher tiers | Larger / higher-risk SMB | Formalised governance and assurance |
Much of the lower-tier control set overlaps with the Essential Eight, so work you do for one feeds directly into the other.
Getting certified: the path
- Pick the right tier. Match it to your size, risk, and what your customers actually ask for.
- Run a gap assessment. Measure where you stand against that tier's controls.
- Remediate. Close the gaps, many are configuration and process changes.
- Gather evidence. Document the controls and keep the proof.
- Certify, then maintain. Certification is a point in time; the controls have to stay on.
How Umbrella Tech helps
An SMB1001 readiness assessment maps your environment to the tier your market expects. Implementation then closes the gaps and assembles the evidence pack. Certification decisions remain with the certifying body.
Find out which tier fits your organisation.