SMB1001 levels · SMB1001:2026
The five SMB1001 levels, side by side.
Bronze to Diamond, what each one asks for, how it is verified and who it suits. Every level includes the controls below it, so the question is not “which controls?” but “how far up do we need to be, and by when?”
Level 1
Bronze
The basics every business needs in place
- Verification
- Director self-attestation through CyberCert
Publicly documented examples
- A technical support arrangement, in-house or outsourced
- A firewall protecting the network and devices
- Anti-malware on every device
- Automatic software updates turned on
- Backups that actually restore
- Basic password hygiene
Who it suits
Sole traders, very small businesses, or anyone starting from zero who needs a credible first badge quickly.
Level 2
Silver
Identity and email hardening
- Verification
- Director self-attestation through CyberCert
Publicly documented examples
- Individual accounts for every person, no shared logins
- Multi-factor authentication on email and key accounts
- Restricted administrator access
- SPF published for your email domain
- Written processes behind the Bronze controls
- Staff cyber security awareness training
Who it suits
Small professional firms that hold client data. A common landing point for a first certification year.
Level 3
Gold
Detection, response and governance
- Verification
- Director self-attestation through CyberCert
- Control count
- 27 controls in the 2026 edition, up from 23 in 2025.
Publicly documented examples
- Endpoint detection and response (EDR) on all devices
- DKIM signing and an enforced DMARC policy for your email domain
- A documented incident response plan
- A register of your digital assets
- Cyber insurance in place
- A written responsible-AI-use policy
- Access control and privilege management
Who it suits
Most SMBs with client, financial or health data. The tier the Queensland Law Society advises legal practices to work towards.
Level 4
Platinum
Independently verified and actively tested
- Verification
- Independent external audit
Publicly documented examples
- Everything in Gold, checked by an independent auditor rather than self-declared
- Regular vulnerability scanning of internet-facing systems
- Encryption of data at rest
- Ongoing threat monitoring
- An incident response capability that is tested, not just written
Who it suits
Businesses whose customers, regulators or tenders want third-party assurance rather than a director's signature.
Level 5
Diamond
Continuous assurance
- Verification
- Independent external audit
Publicly documented examples
- Everything in Platinum
- Continuous monitoring and real-time security analytics, SOC or SIEM style
- Continuous compliance monitoring
- Active engagement with cyber security professionals
Who it suits
SMBs competing on trust in sensitive supply chains. The rigour approaches ISO 27001 without the management-system overhead.
These are examples drawn from the published standard and public guidance, not the complete control list. SMB1001:2026 is the source of truth and changes each edition; we re-check it against your target level during the gap review.
Choosing a level
Start from who is asking, not from the control list.
The right level is the lowest one that satisfies the people who want to see your certificate, reached honestly, with a plan to step up. Four common situations:
Bronze / Silver
A customer questionnaire wants evidence of basic hygiene
Bronze or Silver gets you a badge in weeks. If the questionnaire mentions MFA or shared logins, aim for Silver.
Gold
You hold client, financial or health data
Gold. It is where detection (EDR), enforced email authentication and an incident response plan come in, and it is what professional bodies point their members at.
Platinum
A tender or regulator wants third-party assurance
Platinum. Same ground as Gold plus vulnerability scanning, encryption at rest and monitoring, verified by an independent auditor rather than your own signature.
Diamond
You compete on trust in a sensitive supply chain
Diamond, or a decision between Diamond and ISO 27001. Continuous monitoring and compliance, audited. See the ISO 27001 comparison.
Legal practice? The Queensland Law Society's guidance names Gold as the level to work towards. Our SMB1001 for law firms page maps the Gold controls to how a small firm actually runs.
Common questions
Asked and answered.
Still unsure which level? The tier-selection call is twenty minutes and free, and it ends with a target level and a realistic timeline.
How many levels does SMB1001 have?
Five: Bronze (level 1), Silver (2), Gold (3), Platinum (4) and Diamond (5). Each level contains every control from the level below plus its own additions, so a Gold-certified business has met the Bronze and Silver controls as well.
Which SMB1001 levels are self-assessed and which are audited?
Bronze, Silver and Gold are attested by a company director through the CyberCert portal. Platinum and Diamond are verified by an independent external auditor. The director's attestation is a formal declaration, and customers or insurers can ask you to evidence any control.
Which level should a small business start at?
Most businesses with reasonable IT hygiene can self-attest at Bronze or Silver within weeks, then plan for Gold. If you hold client, financial or health data, treat Gold as the target rather than the stretch goal, because that is where EDR, enforced email authentication and an incident response plan come in, and it is the tier the Queensland Law Society advises legal practices to work towards.
What is SMB1001 Gold?
Gold is the third level and the one most SMBs with sensitive data aim for. In the 2026 edition it has 27 controls (up from 23 in 2025), including endpoint detection and response on every device, DKIM signing and an enforced DMARC policy, a documented incident response plan, a register of digital assets, cyber insurance and a written responsible-AI-use policy. It is still director-attested, so no external audit is needed.
What changed between SMB1001:2025 and SMB1001:2026?
Email authentication became mandatory (SPF from Silver, DKIM and an enforced DMARC policy from Gold) and Gold grew from 23 to 27 controls with the additions above. DSI also published mappings from SMB1001 to the Essential Eight, ISO 27001, UK Cyber Essentials and US CMMC. The 2026 edition was released in September 2025 and became certifiable in January 2026.
Can we skip levels?
Yes. You certify at whichever level you can evidence. Many businesses go straight to Gold if the controls are already in place. Because each level includes the ones below it, there is no requirement to hold Bronze before attesting at Silver or Gold.
Do Platinum and Diamond need a different kind of evidence?
Yes. Because an independent auditor verifies them, you need documentation and records rather than a director's word: vulnerability scan reports, monitoring records, tested incident response exercises, encryption settings, and so on. We build that evidence pack with you as part of the uplift, which is what the audit then checks.
Next step
Get a level and a timeline you can take to your board.
We look at what is already in place, name the level you can attest at now and the one you should plan for, and quote the uplift fixed-fee.
SMB1001 is a standard of Dynamic Standards International and certification is issued by CyberCert, an independent certification body; IronSights prepares you for it and does not issue certificates. Figures quoted are from public sources at the time of writing (August 2026); confirm current pricing and control lists at cybercert.ai.