TL;DR: SMB1001 has five maturity levels: Bronze, Silver, Gold, Platinum, and Diamond. Bronze, Silver, and Gold can be self-attested, so a small Australian business can reach them without an independent verifier. Platinum and Diamond also require independent third-party verification. Most businesses start at Bronze to satisfy a contract or insurance requirement, then climb as their cyber controls mature.
As a DSI Licensed Commercial Holder of the SMB1001 standard, CYBERWHITE works with all five tiers daily. This guide explains what each level covers, how they build on each other, and how to choose where to start.
What is the SMB1001 framework?
SMB1001 is a global cyber security standard published by Dynamic Standards International (DSI), developed in Australia and designed specifically for small and medium businesses. The SMB1001 framework organises security controls across five domains: Technology Management, Access Management, Backup and Recovery, Policies and Processes, and Education and Training.
The standard is updated annually by a DSI steering committee, so the current edition is SMB1001:2026. A certificate is valid for one year, after which the business can choose to re-certify at whichever tier suits it then. Most businesses that rely on the credential treat it as a yearly rhythm, not a one-off exercise.
SMB1001 earns recognition from Australian government contractors, procurement teams, and cyber insurers because it is practical, graduated, and independently verified at the top two tiers. For a full overview of what the framework covers, start at our SMB1001 page.
How the five SMB1001 maturity levels are structured
The five SMB1001 maturity levels are cumulative. Each tier builds on every control from the level below it. You cannot certify at Gold without first satisfying all Silver requirements, and Silver requires all Bronze controls first.
The most important structural distinction is how conformance is attested:
| Level | Assessment type | Typical timeline |
|---|---|---|
| Bronze | Self-attested | Around 30 days |
| Silver | Self-attested | 30-60 days after Bronze |
| Gold | Self-attested | Three to six months |
| Platinum | Independent third-party verification | Six to twelve months |
| Diamond | Independent third-party verification | Twelve months or more |
Bronze and Silver move quickly because the control sets are small and the business attests to its own controls. Gold is still self-attested, but its much larger control set makes it a multi-month project. Platinum and Diamond add an independent verification step by the certifier, with findings to address before the certificate is issued. Plan for Gold and above as a project, not a checklist exercise.
SMB1001 Bronze: the starting point for most Australian SMBs
Bronze covers foundational cyber hygiene: active antivirus on all devices, enabled firewalls, automatic security patching, multi-factor authentication on key accounts, secure email settings, regular tested backups, and basic staff cyber awareness training.
One change to note for 2026: cyber awareness training moved into the Bronze tier, making staff education a day-one requirement rather than something deferred to Silver.
Bronze is self-attested, which means no independent verifier to book, no consulting day rate, and no scheduling delay. A 10-20 person business with a Microsoft 365 tenant can reach Bronze in around 30 days if controls are tackled in the right order. The detailed sequence and evidence pack are covered in our SMB1001 Bronze checklist.
Most Australian SMBs pursue Bronze first because it satisfies an immediate trigger: a government supplier requirement, a cyber insurance question sheet, or a customer due-diligence request.
SMB1001 Silver: stepping up on access and governance
Silver raises the bar across the same five domains as Bronze. Additional controls at Silver typically cover stricter access management policies, stronger password requirements, more rigorous patch management cycles, and early governance practices such as a documented incident response procedure.
Silver remains self-attested. A business that reaches Bronze can typically reach Silver within 30-60 days by closing the gaps identified during its Bronze self-assessment. Because the tiers are cumulative, there is no backtracking to earlier controls.
A business at Silver begins to look credible to mid-market customers and enterprise procurement teams that want evidence of a proactive security posture, not a minimum-viable checkbox.
SMB1001 Gold: the highest self-attested tier
Gold is the last tier that can be self-attested. Controls at Gold extend into mature access management, advanced incident response planning, supply chain awareness, and formal risk management processes.
Gold is the right target for businesses that hold regulated data, operate in healthcare or financial services, or supply to enterprise organisations with stringent third-party security requirements.
The larger control set means Gold takes longer than Bronze or Silver. Expect a three-to-six month runway: close the gaps, build the evidence for each control, and attest with confidence that every control is genuinely in place. Self-attestation is not a shortcut, and DSI can act if false information is provided. Build this into your planning before committing to a Gold timeline to a customer or insurer.
SMB1001 Platinum and Diamond: advanced maturity for high-stakes environments
Platinum extends Gold with controls around threat detection, continuous monitoring, and formal governance structures. It is the first tier that requires independent third-party verification, and it carries a higher evidence burden than Gold.
Diamond is the highest SMB1001 maturity level and adds independent penetration testing and ongoing monitoring requirements, again with independent third-party verification. Diamond is designed for organisations where a cyber failure would have serious legal, commercial, or reputational consequences.
Few Australian SMBs target Diamond as an initial goal. The path that works in practice is Bronze, then Silver, then plan for Gold once internal processes are mature enough to evidence every control. Platinum and Diamond typically follow Gold by one to two years once the organisation has embedded mature security operations.
Which SMB1001 maturity level should your business target first?
The right starting level depends on why you are pursuing certification:
- Contract or procurement requirement: Bronze satisfies most Australian government and commercial supplier requirements. Start here.
- Cyber insurance premium reduction: Bronze to Silver is typically the threshold insurers look for when assessing risk maturity.
- Enterprise customer due diligence: Silver or Gold, depending on how sensitive the data you handle is.
- Healthcare, financial services, or DISP supply chain: Gold as the target, with Bronze and Silver as interim milestones.
If you are uncertain, start at Bronze. It delivers a real certification, a tangible evidence pack, and a clear view of what needs closing before Silver. To understand how SMB1001 compares against Essential 8 when choosing where to invest first, read our post on Essential 8 vs SMB1001. Pricing for guided maturity progression is on our pricing page.
How CYBERWHITE accelerates SMB1001 maturity progression
CYBERWHITE is a DSI Licensed Commercial Holder of the SMB1001 standard (ABN 31 598 198 475) and an Australian-owned platform built around guided compliance. The platform covers self-guided and automated SMB1001 assessment, scans your Microsoft 365 environment for control gaps across all five domains, and captures evidence automatically as it goes.
Where gaps can be fixed programmatically, the AutoFix engine applies one-click remediation through Microsoft Graph with a full snapshot, execute, and rollback workflow. CYBERWHITE has 149 AutoFix actions across Essential 8 and SMB1001 combined, covering the controls that account for the most common gaps in Australian SMB environments.
MSPs using CYBERWHITE can manage SMB1001 maturity progression across their full client portfolio from one dashboard, tracking each client from Bronze through Diamond rather than running separate assessments manually.
To see the platform against your own environment, book a demo. For the full framework overview and tier breakdown, see the SMB1001 page.
Keep reading: SMB1001:2027: What Changes for Your Business (and What to Do Now) · SMB1001 Gold for MSPs: an 8-week plan to take one client to Gold