SMB1001 Certification for Australian Businesses

Levels 1 to 3 - Bronze, Silver and Gold - are self-assessed with director attestation, so there is no external auditor fee to reach Gold. Platinum and Diamond require independent verification, and those audit costs sit outside the extension price.

This is one of the main reasons SMB1001 Gold is achievable for a small business where ISO-style certification often is not.

SecureStart runs over 36 months by default, reaching Bronze at around month 6, Silver at month 24 and Gold at month 36. Shorter timeframes are available down to 12 months.

Compressing the schedule does not increase the total cost or reduce the scope - the same engagement is delivered over fewer months, so the monthly figure is higher and the total is unchanged.

The engagement price covers gap assessment, control implementation guidance, evidence preparation, director attestation support, the SMB1001 certification fees themselves and annual recertification for the full term.

There are no separate certification charges to reach Gold. Prices exclude GST.

For the Platinum and Diamond extensions, independent audit fees are additional and quoted separately.

SMB1001 certification is renewed annually, and every renewal during your engagement term is included in the price - so your certification does not lapse part-way through the program.

If certification is allowed to expire after the engagement ends, you would need to recertify before you could evidence compliance to a client, insurer or tender panel again.

Often yes, and that is deliberate. Bronze and Silver are real, issued certifications rather than progress markers, so you have something verifiable to put in front of a client or broker from around month 6 instead of waiting three years.

Whether a given level is sufficient depends on what the specific contract or policy asks for, which is worth checking before you commit to a level.

No.

ISO 27001 certifies a full information security management system against an international standard and involves external audit, ongoing management system overhead and significantly greater cost.

SMB1001 is an Australian standard built specifically for small and medium businesses, with cumulative levels so you can certify your controls proportionately.

If a contract explicitly requires ISO 27001, SMB1001 will not satisfy it - but for most Australian SMBs, Gold demonstrates credible security maturity at a fraction of the cost and in some cases, Gold controls can be used as evidence for ISO27001 requirements.

They overlap substantially.

Many SMB1001 controls map to Essential Eight mitigation strategies, so work done for one contributes to the other.

The difference is that SMB1001 results in a certification you can show a third party, while the Essential Eight is a maturity model rather than a certifiable standard.

We assess both together where a client has obligations under each.

Most businesses do not!

Gold is the appropriate target for the large majority of Australian SMBs, and it is the level Microsolve holds.

Platinum and Diamond suit organisations in regulated sectors or supply chains with elevated contractual requirements.

They are also not immediately available - you must hold Gold and maintain it through a full recertification cycle first, so the earliest realistic start is month 24 (assuming a 12 month Gold engagement).

Pricing is banded by seat count, and the band is set at the start of the engagement.

If you sit between published bands or are unsure how to count contractors and shared logins, our SMB1001 assessment will confirm the band and give you a fixed figure before you commit.

Yes we are!

 Microsolve holds SMB1001:2026 Gold (Level 3), issued by CyberCert and independently verifiable.  We're also on the journey to be certified to Diamond.

We have been through the same assessment, evidence gathering and attestation process we guide clients through, which is not true of every provider offering SMB1001 advisory services.