If you run a small business in Australia, you've probably started to notice a shift: bigger customers, insurers and government tenders increasingly want proof that you take cyber security seriously. SMB1001 — the standard behind CyberCert — is fast becoming the common language for that proof. Here's a plain-English rundown of what it is and why the 2026 update matters.
What is SMB1001?
SMB1001 is an Australian cyber security standard designed specifically for small and medium businesses. Where enterprise frameworks like ISO 27001 or Essential Eight can be heavy and expensive to implement, SMB1001 offers a tiered, achievable pathway that scales with the size and risk profile of your business.
It's built around practical controls — the things that actually stop the incidents small businesses face every day — rather than pages of policy for its own sake.
The certification tiers
SMB1001 uses five tiers — Bronze, Silver, Gold, Platinum and Diamond — so you can start where you are and work up:
- Bronze — foundational hygiene: strong passwords, multi-factor authentication, backups and basic awareness.
- Silver — adds documented processes, endpoint protection, patching discipline and incident basics. This is the tier Downs ICT holds.
- Gold & Platinum — progressively deeper controls, monitoring and governance for businesses with higher risk or compliance obligations.
- Diamond — the highest tier, with continuous monitoring, formal risk management and third-party assurance.
The point isn't a certificate on the wall — it's that each tier maps to controls that measurably reduce your chance of a costly incident.
Why the 2026 update matters
The 2026 revision sharpens the standard around the threats hitting Australian SMBs right now — credential theft, business email compromise and ransomware delivered through everyday phishing. In practice that means more emphasis on:
- Multi-factor authentication everywhere it counts, not just on email
- Managed detection and response (MDR) so threats are caught and stopped, not just logged
- Verified, tested backups you can actually restore from
- Ongoing staff awareness, because people remain the most-targeted layer
What it means for your business
Even if certification isn't yet mandatory in your industry, the controls behind SMB1001 are simply good practice — and increasingly, they're what your customers and insurers expect. Getting certified also gives you something concrete to point to when a tender or a big client asks, "How do you protect our data?"
How Downs ICT can help
We're CyberCert SMB1001 Silver certified ourselves, and we build the underlying controls — Huntress EDR/ITDR, MFA, patch management, backups and awareness training — into every managed IT plan. If you'd like to understand where your business sits today and what it would take to reach a given tier, we can walk you through it.