SMB1001 Gold Certification
for Brisbane Businesses

SMB1001 is a cybersecurity certification standard designed specifically for small and medium businesses, described by its developer Dynamic Standards International (DSI) as the world's first of its kind. It was developed by DSI and is certified in Australia by CyberCert, in response to a clear gap in the market: enterprise frameworks like ISO 27001 and SOC 2 are impractical for most SMBs, yet leaving security unstructured creates significant risk. SMB1001 provides a structured, achievable baseline that can be implemented with a managed IT provider rather than requiring an in-house security team.

SMB1001 has five tiers: Bronze (basic security hygiene), Silver (adds MFA, asset management, and incident response planning), Gold (27 controls across access, patching, backups, email security, and incident response), Platinum (advanced threat detection, penetration testing, third-party risk management), and Diamond (enterprise-aligned, for complex regulated environments). For most Brisbane businesses, Gold is the right target. It provides demonstrable assurance to clients and insurers without requiring an enterprise-scale program, and it is the tier that procurement panels and cyber insurers increasingly look for.

No. Gold is a self-assessed tier: the business certifies its own compliance against the 27 controls, and CyberCert issues the certificate. Independent third-party assessment applies at the higher tiers, Platinum and Diamond. What matters is that the controls are genuinely in place. We implement and document every control as part of your managed IT service, so your certification is backed by real security work, not a checkbox.

The process has four stages. First, a gap assessment: we audit your current environment against all 27 Gold controls and identify what is in place and what needs to be implemented. Second, remediation: we implement the missing controls as part of your managed IT service. This typically takes four to eight weeks, or up to three months if you are starting with very little in place. Third, evidence collection: we compile the documentation and evidence required by CyberCert to demonstrate each control is in place. Fourth, certification: we submit your application to CyberCert, who process the application and issue the certificate. Mino IT manages the entire process on your behalf.

The cost has two components: the CyberCert certification fee (a fixed fee payable directly to CyberCert, publicly listed on their website) and the implementation cost, which depends on how many of the 27 controls are already in place at your business. For most businesses that engage Mino IT as their managed IT provider, the majority of Gold controls are implemented as part of the standard service, meaning the incremental cost of reaching certification is often lower than expected. We provide a clear picture of where you stand and what it will cost after the initial gap assessment.

SMB1001 Gold certification is not a one-time achievement. It requires annual recertification to confirm controls remain in place. For Mino IT clients, this is managed as part of your ongoing service: we maintain the controls, keep the documentation current, and manage the renewal process with CyberCert each year. For businesses that want to go further, Platinum is the next tier, adding penetration testing, advanced threat detection, and more rigorous third-party risk management. We advise on when Platinum makes sense based on your industry, client requirements, and risk profile.