SMB1001 · Law firms
SMB1001 for law firms: why Gold, and how a small practice gets there.
The Queensland Law Society formally recommends SMB1001 and advises practices to work towards Gold. Here is what Gold asks of a firm, mapped to the things that actually go wrong in legal practice: spoofed settlement emails, a locked file server, and an incident with no plan.
Why the legal sector landed on SMB1001
A standard a ten-person practice can actually reach.
Most law firms in Australia are small. ISO 27001 asks for a management system a small practice cannot staff; the Essential Eight is a government framework with no certificate to show a client. SMB1001 sits between them: concrete controls, a director's attestation up to Gold, a certificate and badge, and a price a practice can carry.
That is why the Queensland Law Society's resource on the standard names Gold as the level to work towards, and points members to CyberCert to certify. Gold is also where the controls that matter most to a firm come in.
What we see in small practices
- Payment-redirection and conveyancing fraud through spoofed or compromised email, because DMARC is not enforced and a mailbox lacks MFA.
- Ransomware that lands on one laptop and reaches the practice management data, because there is anti-virus but no detection and response.
- An incident handled in the first hour by whoever answered the phone, because the plan was never written.
Background reading: conveyancing fraud in Australia, ransomware targeting Australian law firms, and the profession's cyber obligations.
Gold, mapped to a practice
What the Gold controls mean when the client is a matter file.
Eight of the Gold-level controls, and the law-firm problem each one is really solving. The full list is in the standard; these are the ones that change outcomes.
Enforced email authentication (SPF, DKIM, DMARC at reject or quarantine)
The single biggest lever against payment-redirection and conveyancing fraud, where a spoofed email changes settlement details. Enforced DMARC stops criminals sending as your domain; MFA on every mailbox stops them sending from it.
MFA on every account, individual logins, restricted admin
Practice management and document systems hold the whole matter history. Shared logins and an admin account everyone knows are two of the commonest findings in small firms, and both are Silver-level fixes.
Endpoint detection and response on every device
Ransomware crews target firms because a locked practice is under pressure to settle. EDR is what turns a phishing click into an alert rather than an encrypted file server. If you run Microsoft 365 Business Premium you already license it.
Backups that are tested, and a documented recovery plan
A practice can survive a breach; it cannot survive losing the matter files. Gold wants the backup written down and the restore proven, not assumed.
A documented incident response plan
Who calls the insurer, who notifies clients, what the Notifiable Data Breaches assessment looks like, who talks to the Law Society. Written before the incident, when people can think.
Cyber insurance in place
Gold in the 2026 edition expects it, and professional indemnity insurers increasingly ask the same control questions at renewal. The certificate is the shortest answer to both.
A responsible-AI-use policy and staff training
Practices are already pasting client material into AI tools. A short policy about which tools, which matters and which data, plus awareness training, is now a Gold control and a sensible professional position.
A register of digital assets
Every device, account and system that touches client data, with an owner. Dull, quick, and the thing that makes the rest of the list enforceable.
The path for a practice
Silver in weeks, Gold in a quarter, without disrupting billable time.
01
Tier and scope
Principal, practice manager and IT provider on one call: which level, which systems are in scope, who attests.
02
Gap review
Every Gold control checked against the practice: identity, email, endpoints, backups, plans and policies. Fixed fee for what is missing.
03
Uplift
Done with your IT provider, outside court days where it touches desktops. Email authentication and MFA first, because they stop the fraud.
04
Attest and badge
Evidence pack assembled, director attests through CyberCert, certificate and badge for your website, tenders and insurer.
Costs and what drives them are on the SMB1001 cost page; the full level-by-level detail is on the levels page.
Common questions
Asked and answered.
Does the Queensland Law Society require SMB1001?
It formally recommends it. The Queensland Law Society's resource on the standard advises practices to work towards Gold certification as a reasonable benchmark for cyber resilience and professional assurance, and points members to CyberCert to certify. It is guidance rather than a mandatory rule, but it is a clear signal from a major law society about which standard small practices should adopt.
Why Gold rather than Silver for a law firm?
Because of what Gold adds: endpoint detection and response, enforced email authentication, a documented incident response plan, an asset register, cyber insurance and a responsible-AI policy. Those map directly onto the ways firms actually get hurt, which are payment-redirection fraud through email, ransomware through an endpoint, and an incident handled badly because nobody had written down what to do.
Is SMB1001 Gold audited?
No. Gold is attested by a director (a principal or practice manager with authority) through the CyberCert portal. Platinum and Diamond add an independent audit; most practices do not need them unless a client or panel arrangement asks for third-party assurance.
How long does it take a small practice to reach Gold?
One to three months is typical, driven mostly by how much of the Gold tooling you already have. A practice on Microsoft 365 Business Premium with a reasonable IT provider usually needs configuration, the incident response plan and policies, and training, rather than new purchases.
Does SMB1001 cover our obligations under the Privacy Act or the conduct rules?
It is a security standard, not a compliance checklist for the law. It puts in place the controls a regulator or client would expect a practice to have, and its incident response and backup requirements line up with the Notifiable Data Breaches scheme's expectations. Your legal obligations still need their own attention; our guide to the legal profession's cyber obligations covers them.
We are outside Queensland. Is it still relevant?
Yes. The standard is national and the threats are the same in every state. Client and insurer expectations are converging on demonstrable controls regardless of which society you belong to, and Gold is a defensible answer everywhere.
Next step
Find out how far your practice is from Gold, in one call.
Twenty minutes with a principal or practice manager, then a fixed-fee gap review. Legal practices get a target level, a timeline and a number, before any commitment.
SMB1001 is a standard of Dynamic Standards International and certification is issued by CyberCert, an independent certification body; IronSights prepares you for it and does not issue certificates. Figures quoted are from public sources at the time of writing (August 2026); confirm current pricing and control lists at cybercert.ai.