Can an MSP certify a client to SMB1001 Gold?

An MSP can do the work and prepare the evidence, but the client's director signs the attestation. Bronze, Silver and Gold are self-attested under the standard published by Dynamic Standards International (DSI). Platinum and Diamond need an independent assessment.

How many controls does SMB1001 Gold have?

Gold is Level 3 of SMB1001:2026 and has 27 controls across five domains: technology management, access management, backup and recovery, policies and plans, and training. Certification is valid for 12 months.

How long does it take to get a client to Gold?

It depends on what is already in place. A client on Microsoft 365 with MFA and working backups can move quickly, and the sample plan below runs for 8 weeks. Clients with no policies, no insurance or no EDR should expect longer, and published guidance often allows three to six months.

Yes. Certification is valid for 12 months, so each client needs a yearly re-attestation. That is why Gold works as a recurring service line, not a one-off project.

SMB1001 Gold for MSPs: an 8-week plan to take one client to Gold

Q: What do clients usually miss on the way to Gold?

Paperwork and non-technical controls. Cyber insurance, an incident response plan, an AI usage policy, an invoice fraud procedure and staff training are common gaps, because they sit outside the tools an MSP already manages.

The short version: SMB1001 Gold is the highest tier an MSP can deliver end to end, because it is certified by the client director's self-attestation, with no outside auditor. It has 27 controls. About two thirds are technical and sit in tools you already run. The rest is paperwork a director must own. Below is an 8-week plan for one client. Run it once, then repeat it.

What is an MSP delivering at Gold?

You are delivering a configured environment, a folder of dated evidence and a document the director signs. Gold is Level 3 of SMB1001:2026. It covers every Bronze and Silver control plus the Gold additions, across five domains. See what Gold covers for the full list.

The honest scope line for the client: you set it up and prove it. The director attests. DSI's 2027 edition names the helper role the Technical Support Specialist and says a business's existing MSP is usually the right place to start. We cover that in SMB1001:2027 for MSPs.

Week 1: Baseline and scope

Scan the tenant and list every Gold control as pass, fail or needs evidence. Do not start fixing until you have the list, because it sets your quote. Confirm the director will sign. If they will not, stop here.

Evidence to save: the dated baseline report.

Week 2: Access controls

This is the biggest technical block. Check MFA on email and on business apps, no everyday admin accounts, one account per person, a password manager, and remote desktop only over a VPN. In Microsoft 365 most of this is Conditional Access and role clean-up. Phishing-resistant sign-in is also on the way for other reasons: Microsoft is retiring SMS MFA from 1 February 2027.

Evidence to save: Conditional Access policy exports and an admin role list with dates.

Week 3: Devices and email

Confirm antivirus on every device, automatic updates, servers patched and a firewall in place. Gold also asks for endpoint detection and response (EDR), which is more than antivirus. Then check SPF, DKIM and DMARC. Gold-level email authentication needs all three. ManageProtect, an Australian MSP, reports the DMARC policy must be enforced, so move past monitor-only.

Evidence to save: EDR deployment report, DNS records for SPF, DKIM and DMARC.

Week 4: Backups and insurance

The standard expects a backup and recovery strategy based on the 3-2-1 rule, so run a test restore and save the result. Gold also lists cyber insurance as a control. Ask the client for the current certificate and renewal date, and flag it early if there is no policy, because that gap takes time to close.

Evidence to save: restore test log and the insurance certificate.

Weeks 5 and 6: Policies

Gold is roughly one third paperwork. The client needs a cybersecurity policy, an incident response plan, an AI usage policy, a digital asset register, confidentiality agreements, an invoice fraud procedure, a visitor register, and secure document and device disposal. Use templates, then sit with the director for an hour per document. Documents the director has not read will not hold up if anyone asks.

Evidence to save: signed and dated copies.

Week 7: Training

Gold asks for enhanced staff security training. Run a session, record attendance and keep the material. Treat it as a repeating task, since the training evidence will age before the certificate does.

Evidence to save: attendance list, training content, date.

Week 8: Re-scan, review and attest

Re-scan the tenant and compare it to the week 1 baseline. Fix what is left. Walk the director through the evidence folder, then they attest. Set a calendar reminder at month 10 for the renewal work.

If you're a small business

Ask your IT provider: "Which of the 27 Gold controls do we already meet, and who signs?" You should get a list in a week, not a quote for a year. The signature is yours, so you should be able to read everything you sign.

If you're an MSP

Price it as a fixed project plus a yearly renewal. The first client takes the longest because you are building templates. By the fifth, the policy and evidence steps are mostly reuse. Insurance recognition of SMB1001 is still limited in Australia, according to CCP Australia, so do not promise premium cuts.

Worked example

Take a 20-person accounting firm already on Microsoft 365 Business Premium, with MFA on and a cloud backup. Week 1 shows 19 of 27 controls pass. The gaps are EDR, DMARC enforcement, insurance evidence, the AI usage policy, an invoice fraud procedure and staff training. The MSP closes the technical gaps in weeks 2 and 3, writes the policies with the director in weeks 5 and 6, and the director attests in week 8. This is an illustrative example, not a customer.

Where CYBERWHITE fits

CYBERWHITE is a DSI SMB1001 licensed commercial holder. It scans a client's Microsoft 365 tenant against the technical Gold controls, supplies the policy templates, and keeps the evidence per control. Where a control cannot be read from the tenant, such as insurance or a visitor register, it is recorded as attestation or "Needs review", not a false pass. AutoFix can deploy some fixes with a snapshot first and rollback available. The attestation always stays with the director. See SMB1001 for MSPs, pricing, or book a free proof check on the demo page. We scan one tenant with you and show what an assessor would still ask for.

Your checklist

Scan the tenant and save the dated baseline.
Confirm the director will sign before you start.
Fix MFA, admin roles, accounts and remote desktop access.
Deploy EDR, then check updates, firewall and servers.
Publish SPF, DKIM and an enforced DMARC policy.
Run and log a test restore.
Collect the cyber insurance certificate.
Write and sign the nine policy documents.
Run staff training and keep the attendance list.
Re-scan, review the evidence folder, then attest.
Diary the renewal for month 10.

Sources

Dynamic Standards International: SMB1001:2026 and SMB1001:2027 standard, Gold (Level 3) control set
ManageProtect: SMB1001:2026 Gold certification, what is new for MSPs and clients (vendor blog, attributed as reported)
CCP Australia: commentary on insurer recognition of SMB1001

Keep reading: SMB1001 Certification in Australia: Bronze, Silver, Gold and Beyond and The evidence problem and Cyber insurance questionnaire: an MSP walkthrough