We certified our own business to SMB1001 Gold and we have taken clients through the standard since. Along the way we learned something that changed how we recommend doing it. The technology is the easy half. We can deploy it in weeks. The hard half is the business changing the way it runs, and that part does not happen because an IT provider says it should. So for most businesses we now recommend starting at Bronze or Silver, getting the certificate, and stepping up to Gold when the organisation is ready for it.
This post explains why, what the two halves look like, and how to pick your starting level.
The easy half: what your IT provider can deploy
SMB1001 has five domains. Three of them are mostly technology: Technology Management, Access Management, and Backup and Recovery. Multi-factor authentication on email and remote access. Patching on a schedule. A password manager. Email anti-spoofing records. Backups that are tested by restoring them. Endpoint detection and response. A register of the devices and accounts you own.
A competent managed IT provider can put all of that in place with little disruption to your staff. It is the work MSPs are built for, and it is what most of the industry sells when it sells SMB1001. If you are already on a managed service, a good share of it is probably in place today.
The hard half: what has to change inside the business
The other two domains are Policies, Processes and Plans, and Education and Training. These are not things we can install. They are things your business has to do, and keep doing.
- A cybersecurity policy that is owned and followed. We can draft it. Someone in your business has to read it, adopt it, and hold people to it.
- Staff who finish their training. Awareness training only counts when every person has completed it, including the ones who are always too busy.
- An incident response plan someone has rehearsed. A document in a folder is not a plan. A plan is when the owner knows who to call at 2am.
- Access that is reviewed when people join and leave. We can remove accounts the same day, but only if the business tells us the same day.
- A director who signs the attestation and means it. Bronze, Silver and Gold are self-assessed. The signature is a statement that the controls are genuinely in place, not a formality.
Here is the pattern we see. A business decides to go straight to Gold. The technology work is done inside the first couple of months. Then the project stalls. Not on anything technical. It stalls on a policy nobody has signed off, a training round that is half complete, and an incident plan that has never been walked through. The gap between "the controls exist" and "we can attest to them" sits entirely inside the business, and it stays open for as long as nobody inside is driving it.
The internal champion
Every certification that has gone smoothly for us had one person inside the business who owned it. Not the IT contact. Someone with the authority to change how people work: an owner, a general manager, an operations lead. They chase the training completions. They get the policy in front of the director. They decide what the incident plan says about who makes the call. They make offboarding a step in the HR process rather than an email to us when someone remembers.
Without that person, we have watched the technology sit finished for months while the paperwork does not move. That is not a criticism of those businesses. Running a company is the day job. But it is the single biggest predictor of whether a Gold project finishes, and it is worth being honest about before you start.
Why we now recommend starting below Gold
Your target level is still set by what your customers trust you with. If you hold personal or confidential information, Gold is where you need to end up. What has changed is our view on where to start.
Bronze has 7 controls and Silver has 17. Both are reachable with the controls a business can own right now, and the organisational change they ask for is small enough to land. The certificate is real. Customers and insurers can see it. The director has signed an attestation once, which makes the second one easier. Policy review and training become a habit instead of a project.
While the business is operating at that level, the technology for the next level goes in during the same period. Every level is a superset of the one below, so nothing is wasted. When the champion is in place and the processes are running day to day, stepping up to Gold is a short exercise rather than a long one.
Then hold at Gold. Platinum and Diamond add independent verification and testing, and they make sense when a customer, a tender or a regulator requires them. For most businesses they are not a general good-practice step, and we would rather you maintain Gold well than chase a level you do not need.
How to pick your starting level
The question is not how good your IT is. It is how ready the organisation is to own the non-technical controls. A few signals:
- Do written policies exist, and has anyone read them? If the answer is no to both, start at Bronze.
- Has a round of staff training ever been completed? Not started. Completed. If yes, Silver is realistic.
- Does someone own onboarding and offboarding? A named person who tells IT the day someone starts or finishes is a sign the business can run Gold.
- Does a customer or tender already require a level? Then that level is your target and the staged approach is about the order of work, not the destination.
- Is there a champion? If you cannot name them, start lower than you think you should.
For what each level contains and how DSI's Supplier Categorization Matrix sets your target, see SMB1001 Levels Explained.
What this looks like with Mino IT
We deploy and document the technology controls for the level you are starting at, and we put in the technology for the next level as part of the same managed service. We draft the policies, the incident plan and the training program with your champion, so they fit how your business works rather than how a template thinks it should.
Your champion drives adoption. Your director attests. We compile the evidence and manage the submission to CyberCert, then maintain the controls and the renewal each year. The split is deliberate: we own what an IT provider can own, and we are clear from the start about what has to come from inside the business. You can read more about the service on our SMB1001 certification page.
Where should you start?
That is a conversation, not a form. If you want to talk through where your business sits and which level makes sense first, book a discovery call and we will go through it with you. If you would rather get a rough picture first, the readiness check takes a few minutes and suggests a level.
