SMB1001 · CyberCert
CyberCert, and how SMB1001 certification actually works.
Two organisations sit behind SMB1001: Dynamic Standards International writes the standard, and CyberCert certifies businesses against it. Here is what each does, what a director is attesting to, and what changes when an auditor is involved.
Writes the standard
Dynamic Standards International
A private standards body that traded as Cyber Security Certification Australia (CSCAU) until 2023. It launched SMB1001 in September 2023 and revises it annually; the current edition is SMB1001:2026, released September 2025 and certifiable since January 2026. It also publishes mappings from SMB1001 to the Essential Eight, ISO 27001, UK Cyber Essentials and US CMMC.
The standard groups its controls into five domains: technology management, access management, backup and recovery, policies and processes, and education and training.
Issues the certificate
CyberCert
DSI's sister certification body. It runs the portal where you complete the self-assessment, where a company director attests to each control at Bronze, Silver and Gold, and where the certificate and badge are issued. Platinum and Diamond are verified by an independent external auditor instead.
Certificates run for twelve months. Professional bodies such as the Queensland Law Society point their members to CyberCert to certify, and eligible small businesses can access Bronze and Silver certification credits at no cost through the Cyber Wardens program.
The process
Five steps from “which level?” to a badge.
01
Choose a level
Bronze, Silver or Gold for director attestation; Platinum or Diamond if you want independent verification. Every level includes the controls below it.
02
Put the controls in place
This is the work. Firewall, anti-malware, backups and updates at Bronze; individual accounts, MFA, SPF and training at Silver; EDR, DKIM and enforced DMARC, an incident response plan, an asset register, cyber insurance and policies at Gold.
03
Attest in the CyberCert portal
A company director confirms, control by control, that the requirements are met. For Platinum and Diamond an independent auditor verifies your evidence instead of relying on the attestation.
04
Receive the certificate and badge
A dated certificate and a badge you can use with customers, insurers and tenders. It is valid for twelve months.
05
Renew or step up
Each year you re-attest (or re-audit) against the current edition of the standard, which is revised annually, and you can move up a level when you are ready.
What a director is signing
Self-attested is not the same as unverified.
At Bronze, Silver and Gold the certificate rests on a company director declaring that each control is in place. That keeps the cost and friction low enough for a ten-person firm. It also means the director owns the claim: if a customer, insurer or, after an incident, a regulator asks for evidence, you need to be able to show it.
So the sensible way to attest is with an evidence pack behind each control: the MFA report, the backup restore test, the DMARC record, the incident response plan with a date on it. That pack is also exactly what an auditor asks for if you later step up to Platinum, which is why we build it from day one.
Where an auditor comes in
- Platinum and Diamond: an independent external auditor verifies the controls instead of relying on the attestation.
- The auditor is separate from whoever helped you implement, which is why IronSights prepares you for the audit rather than performing it.
- The audit fee is quoted by the auditor and is separate from CyberCert's subscription. A complete, organised evidence pack is the single biggest lever on its cost.
Costs in detail on the SMB1001 cost page.
Common questions
Asked and answered.
What is CyberCert?
CyberCert is the independent certification body that issues SMB1001 certifications. It runs the portal where a business completes its self-assessment, where a company director attests that the controls are in place, and where the certificate and badge are issued. It is the sister entity of Dynamic Standards International, which writes the SMB1001 standard itself.
What is the difference between CyberCert and Dynamic Standards International?
Dynamic Standards International (DSI) authors and maintains the standard; it traded as Cyber Security Certification Australia (CSCAU) until 2023 and revises SMB1001 every year. CyberCert operates certification against that standard. In practice you read the standard from DSI and you certify, pay and renew through CyberCert.
Is SMB1001 certification just a self-assessment?
At Bronze, Silver and Gold it is a director's attestation: a formal declaration, through the CyberCert portal, that each control is in place. That is deliberately lighter than an audit so small businesses can actually get certified, but it is not casual. The director is putting their name to it and a customer or insurer can ask for evidence of any control. Platinum and Diamond add an independent external audit.
How long is an SMB1001 certificate valid?
Twelve months. You renew annually against the current edition of the standard, and you can upgrade to a higher level at any time.
Who does the Platinum and Diamond audits?
An independent external auditor, arranged through the CyberCert process rather than by the consultancy that helped you prepare. That separation is the point: the business that built your controls should not be the one verifying them.
Does IronSights issue SMB1001 certificates?
No. Certificates come from CyberCert. IronSights helps you choose the level, closes the control gaps, assembles the evidence and takes you through the attestation or audit preparation. That keeps the certification independent of the people who did the work.
Can our existing IT provider use CyberCert for us?
Yes, the portal is open to any business. What matters is that the controls are genuinely in place and that a director is comfortable attesting to them. If your IT provider runs your environment well, Bronze and Silver are often straightforward. Gold is where most businesses bring in a security specialist, because EDR, enforced email authentication and incident response planning stretch a general IT provider.
The SMB1001 guide
Next step
Ready to attest, or not sure you could evidence it yet?
The gap review tells you which controls you could attest to today, which need work, and what it costs to close them, with the evidence pack built as we go.
SMB1001 is a standard of Dynamic Standards International and certification is issued by CyberCert, an independent certification body; IronSights prepares you for it and does not issue certificates. Figures quoted are from public sources at the time of writing (August 2026); confirm current pricing and control lists at cybercert.ai.