What Is SMB1001? Australia’s Small Business Cyber Security Standard Explained
SMB1001 is a tiered cyber security standard designed for small and medium businesses that want a practical way to improve and demonstrate their security maturity.
Reviewed by Connected Platforms | Updated September 2026
What this guide covers
- Five levels from Bronze to Diamond
- Designed for small and medium businesses
- Certification requirements increase by level
What SMB1001 is
SMB1001 is an Australian-developed cyber security standard published by Dynamic Standards International. It provides a staged pathway for small and medium businesses to improve cyber security controls and, where appropriate, pursue certification.
The standard is designed to be more approachable than a large enterprise management system. That does not make it a shortcut. The correct level, evidence and certification route depend on the organisation and the current version of the standard.
Five levels of cyber security maturity
SMB1001 uses five progressive levels. The exact control set and assurance requirements should always be checked against the current licensed standard.
Bronze
A foundational entry point for organisations establishing core cyber security practices.
Silver
Builds on the foundation with broader and more consistent control coverage.
Gold
Adds stronger governance, implementation and evidence expectations.
Platinum
A higher-assurance level intended for organisations with greater risk or stakeholder requirements.
Diamond
The most advanced level in the pathway, with the strongest assurance expectations.
SMB1001 and the Essential Eight are not the same
SMB1001
A broader tiered standard for small and medium businesses, with a pathway from Bronze to Diamond and certification options.
Essential Eight
Eight mitigation strategies from the Australian Cyber Security Centre, implemented against maturity levels to reduce common cyber threats.
How they can work together
Essential Eight controls can support a security improvement program, while SMB1001 provides a wider standard and certification pathway. The right choice depends on contracts, risk and assurance needs.
Who should consider SMB1001?
- Businesses that need a recognised way to show customers or partners that security is improving
- Organisations that want a staged alternative to jumping straight into an enterprise framework
- Suppliers facing more security questions in tenders, contracts or insurance reviews
- Leadership teams that need a clearer roadmap, ownership and evidence
Certification should follow a genuine business requirement. Start by understanding why customers, regulators, insurers or contracts are asking for assurance.
How to prepare
- Confirm the business reason and target level.
- Obtain the current standard and understand the applicable evidence requirements.
- Assess existing policies, technical controls, risks and ownership.
- Prioritise gaps by business risk rather than chasing a badge.
- Keep evidence as controls are implemented and tested.
- Use an authorised certification path where independent assurance is required.
Controls and certification rules can change. Use current material from the standard owner and certification body rather than relying on an old checklist.
Common questions
Is SMB1001 mandatory?
Not generally. It may become relevant because of customer, contract, supply-chain, insurance or internal governance requirements.
Does SMB1001 replace the Essential Eight?
No. They serve different purposes and can complement each other.
Which level should a business choose?
Choose it from risk, customer expectations and assurance needs. Higher is not automatically better if the level is unnecessary or unsupported.
Need a practical cyber security roadmap?
We can help you assess the controls you already have, identify gaps and choose an appropriate path without treating every business the same.
