SMB1001 · Cost
What SMB1001 certification really costs.
The certification fee is the small number. What you actually budget for is closing the gap between how your business runs today and what your target level asks for, plus an audit if you go past Gold. Here is how to think about both.
Number one: the certification fee
What CyberCert charges, by level.
Paid annually, directly to CyberCert. Figures are from public listings at the time of writing (August 2026) and move from year to year, so treat them as the order of magnitude and confirm at cybercert.ai before you budget.
| Level | Certification fee | Verification | What to know |
|---|---|---|---|
| Bronze | From about $95 a year (listed) | None (director attestation) | Often free: eligible small businesses can claim Bronze and Silver certification credits through the Cyber Wardens program. |
| Silver | Low hundreds a year (listed) | None (director attestation) | Covered by the same Cyber Wardens credits where you are eligible. |
| Gold | Low hundreds a year (listed) | None (director attestation) | The fee is not the cost. The 27 controls are, if you do not already run EDR, enforced DMARC and an incident response plan. |
| Platinum | Higher annual subscription | Independent external audit, quoted by the auditor | Budget the audit in the thousands for a 20 to 50 person business, plus the evidence pack the auditor will want. |
| Diamond | Highest annual subscription | Independent external audit, quoted by the auditor | Continuous monitoring and compliance means ongoing tooling or a managed service, not a one-off project. |
Number two: the uplift
Six things that decide the real number.
Two businesses of the same size can have wildly different uplift costs. These are the variables, roughly in the order they show up as you climb the levels.
Tooling you do not already have
EDR on every device (Gold), backup that is tested and restorable (Bronze), and email authentication (SPF at Silver, DKIM and enforced DMARC at Gold). If you are on Microsoft 365 Business Premium you already license Defender for Business, Intune and Conditional Access, so Gold is frequently a configuration-and-documentation job rather than a purchase.
People and time
Individual accounts, MFA on everything, restricted admin access and staff awareness training are cheap in licences and expensive in coordination. Someone has to chase the last three people who have not enrolled.
Paper that has to be true
Written backup and recovery processes, an incident response plan, an asset register, a responsible-AI-use policy. Templates are free. Policies that describe what your business actually does, and that a director is comfortable attesting to, take a few working sessions.
Cyber insurance (Gold)
The 2026 edition expects cyber insurance at Gold. If you do not hold a policy, that is a real premium to budget, and your broker will want to see the other controls in place before quoting well.
The audit (Platinum and Diamond)
An independent auditor verifies your evidence. Their fee is separate from CyberCert's subscription and scales with your size and complexity. The more complete your evidence pack, the shorter and cheaper the audit.
Keeping it current
Certificates run twelve months and the standard is revised every year, so renewal means re-checking controls against the new edition. Budget a small annual effort, or fold it into a managed service so it is someone's job.
How we price it
A fixed fee, quoted after we have looked.
We do not quote SMB1001 from a price list, because the honest number depends on your starting point. The gap review compares what you run today against your target level, control by control, and produces two things: the list of what is missing and a fixed fee to close it.
CyberCert's fee stays CyberCert's, paid by you, directly. If you are a Fortify client, most Gold controls are already part of the service and renewal each year is an attestation rather than a project.
Three ways to keep the number down
- Use what you already license. Microsoft 365 Business Premium covers most of the Gold tooling; the work is configuration, not purchasing.
- Pick the level the people asking actually need. Platinum's audit is worth paying for when a tender or regulator wants it, not as a vanity upgrade.
- Claim the credits. If you are eligible for Cyber Wardens Bronze or Silver credits, the certificate itself costs nothing in year one.
Common questions
Asked and answered.
Want the number for your business rather than the order of magnitude? That is what the gap review is for.
How much does SMB1001 certification cost in Australia?
Two numbers. CyberCert's certification fee is modest at the self-attested levels: at the time of writing Bronze is listed from about $95 a year and Silver and Gold in the low hundreds, with Platinum and Diamond on higher subscriptions plus an independent audit quoted separately. The larger number is the uplift to close your control gaps before you attest, which depends entirely on where you start. That is why we quote it fixed-fee after a gap review rather than guess.
Is SMB1001 certification free?
The Bronze and Silver certification fee can be, for eligible small businesses, through Cyber Wardens program credits. The controls still have to be in place, so "free" refers to the certificate, not the work. Gold and above are paid.
What does a Platinum or Diamond audit cost?
It is quoted by the independent auditor and depends on your size, systems and how complete your evidence is. For a typical 20 to 50 person business, budget in the thousands rather than hundreds. The best way to keep it down is to arrive with an organised evidence pack, which is a deliverable of our uplift work.
Is it cheaper to do SMB1001 ourselves?
Bronze and Silver, often yes, if you have an IT provider who can evidence the controls and a director willing to attest. Gold is where businesses usually want help, because EDR, enforced DMARC, incident response planning and the policies touch every system and every person. Our fixed-fee gap review tells you what you can do in-house and what is worth handing over.
Does IronSights charge for the CyberCert fee?
No. You pay CyberCert directly for the certification itself. Our fee covers the tier decision, the gap review, the uplift and the evidence, and we quote it fixed so the number you are given is the number you pay.
What is the ongoing cost after certification?
The annual CyberCert renewal at your level, plus the effort to re-check your controls against the new edition each year. For Fortify clients the control upkeep is part of the managed service, so renewal is an attestation rather than a project.
Next step
Get your number before you commit to anything.
A twenty-minute tier-selection call, then a fixed-fee gap review against your target level. You get the missing-controls list and the price in one document.
SMB1001 is a standard of Dynamic Standards International and certification is issued by CyberCert, an independent certification body; IronSights prepares you for it and does not issue certificates. Figures quoted are from public sources at the time of writing (August 2026); confirm current pricing and control lists at cybercert.ai.