Your biggest client just asked if you're SMB1001 certified. Here's how to say yes.
SMB1001 is Australia's cybersecurity certification built for small and mid-sized businesses. Five tiers, self-attested at the entry level, independently audited at the top. ClearEdge gets you from where you are now to a tier you can point to.
SMB1001, in plain English.
SMB1001 is a cybersecurity certification standard built specifically for small and mid-sized businesses, not a scaled-down version of an enterprise framework. It has five tiers: Bronze, Silver, Gold, Platinum and Diamond. The lower tiers are self-attested, you assess yourself against the published controls and a company director signs off. Platinum and Diamond require an independent audit by an accredited assessor. Each tier builds on the one below it.
The point of the standard is that a business with no dedicated security team can still get to a level, name it, and prove it, without needing an enterprise compliance budget to do so.
This isn't theoretical.
A logistics supplier in Auckland chasing an Australian-linked contract, a firm renewing its cyber insurance, a Pacific government tender. All three are being asked the same question now: what are you actually doing about this?
-
Cyber insurance
Insurers increasingly ask what controls you actually run before they'll write or renew a policy. A recognised tier answers that in one line instead of a self-written questionnaire.
-
Client and supply-chain pressure
Bigger clients push security requirements down the chain. When a client the size of a bank or a government department asks if you're certified, "we take it seriously" isn't an answer. A tier is.
-
Government tender requirements
Procurement panels in South Pacific increasingly list a recognised certification as a pre-qualifier, not a nice-to-have.
-
NZ Privacy Act 2020
A breach involving personal information brings mandatory notification obligations. A certification on file is evidence you took reasonable steps before anything went wrong.
Find where you sit.
| Tier | Assessment method | What it signals |
|---|---|---|
| Bronze | Self-attested | Baseline cybersecurity controls in place. |
| Silver | Self-attested | Baseline controls plus expanded coverage. |
| Gold | Self-attested (director sign-off) | A broader control set, attested by a company director. |
| Platinum | Independently audited | First tier requiring third-party audit evidence. |
| Diamond | Independently audited | Highest tier — full independent audit, with ongoing monitoring. |
Four steps, no six-month surprise.
- 1. Free external scan — the same domain and email-security check as our Make Email Safe scan, giving you a first read on where the gaps likely are.
- 2. Fixed-fee gap assessment — scoped to your business and benchmarked against the tier you're actually targeting, not a generic checklist.
- 3. Remediation — ClearEdge closes the gaps identified in your roadmap.
- 4. Certification prep — for the self-attested tiers we prepare your evidence and the director sign-off. For Platinum and Diamond we prepare you for the independent audit, run by an accredited certification body such as CyberCert. ClearEdge assesses and prepares; the certificate itself is issued independently.
Client asking for the Essential Eight instead?
SMB1001 is the practical on-ramp for SMEs. If your client or tender is asking for the ASD Essential Eight rather than a named certification, the two frameworks map onto each other.
Read how the Essential Eight worksSMB1001 questions we hear most.
The questions South Pacific businesses ask most often before they engage on SMB1001.
How much does SMB1001 certification cost?
It depends on your size and how complex your environment is — a two-person office chasing Bronze and a 40-person firm going for Gold are different jobs. The honest answer is a free, no-obligation quote once we've seen your environment.
How long does certification take?
It depends on your starting point and the tier you're targeting. The self-attested tiers can move quickly once the baseline controls are in place; Platinum and Diamond take longer because of the independent audit step. We'll give you a realistic timeline after the gap assessment, not before.
Do we need to pass every tier in order?
Generally yes. Each tier builds on the controls required at the tier below it, so you can't jump straight to Gold if Bronze-level basics aren't in place yet.
Who actually issues the certificate?
SMB1001 certificates are issued by an authorised certification body, such as CyberCert, not by ClearEdge. ClearEdge assesses your environment, closes the gaps and prepares you for certification.
Is SMB1001 recognised in New Zealand and the Pacific?
SMB1001 is an Australian standard, and its formal recognition is strongest inside Australia's ecosystem: government tenders, corporate supply chains and Australian insurers. In New Zealand and the Pacific there's no formal government or insurer mandate for it, but a growing number of businesses adopt it voluntarily because an Australian client, parent company or supply-chain contract asks for it. If a specific client or insurer is asking you for it, that's the recognition that actually matters.
Ready to find out where you sit?
Start with a free domain security check, or book a free, no-obligation scoping conversation for a fixed-fee gap assessment.