If ISO 27001 feels like using a sledgehammer to crack a nut, SMB1001 may be what you are looking for. It is a tiered Australian cyber security standard designed specifically for small and medium businesses — a way to demonstrate real security maturity without the cost and overhead of enterprise certification.
What SMB1001 is
SMB1001 defines a graded set of cyber security controls across multiple tiers, so a business can start at a level that matches its size and risk and step up over time. The point is proportionality: a five-person trades business and a 150-seat professional-services firm should not be held to the same bar, but both should be able to prove they take security seriously.
Why it matters now
Two pressures are pushing SMB1001 up the agenda for Australian businesses:
- Supply chains. Larger clients and government buyers increasingly require evidence of baseline security before they will engage you. A recognised certification answers that question once, for everyone.
- Cyber insurance. Insurers want proof of controls, not promises. Certification is structured evidence.
How the tiers work
Without getting lost in the detail, SMB1001 is layered so that each tier adds controls on top of the one below:
| Tier | Roughly suits | Focus |
|---|---|---|
| Lower tiers | Micro / small business | Core hygiene — MFA, backups, updates, awareness |
| Middle tiers | Growing SMB | Documented policy, access control, monitoring |
| Higher tiers | Larger / higher-risk SMB | Formalised governance and assurance |
Much of the lower-tier control set overlaps with the Essential Eight — so work you do for one feeds directly into the other.
Getting certified — the path
- Pick the right tier. Match it to your size, risk, and what your customers actually ask for.
- Run a gap assessment. Measure where you stand against that tier's controls.
- Remediate. Close the gaps — most are configuration and process, not big spend.
- Gather evidence. Document the controls and keep the proof.
- Certify, then maintain. Certification is a point in time; the controls have to stay on.
How Umbrella helps
Our Essential Eight & compliance service maps your environment to the SMB1001 tier your market expects, closes the gaps, and assembles the evidence pack — so certification becomes a managed outcome rather than a scramble.
Get in touch to find out which tier fits your business.