SMB1001 Gold · Tier 3 of 5
SMB1001 Gold: the certification your customers can actually check
Supply chains, insurers and larger customers now ask small Australian businesses to prove their security, not describe it. Gold is the highest SMB1001 tier a director can self-attest: 27 controls, one certificate, renewed yearly. No external auditor required.
CYBERWHITE is a DSI Licensed Commercial Holder of SMB1001 and a DSI Founding Mission Supporter.
Why Gold is the tier that matters
The self-attestation ceiling
Bronze, Silver and Gold are signed by a company director. Platinum and Diamond need an independent certifier. Gold is the highest tier you can reach without one.
Built for regulated data
Gold adds the controls buyers look for: EDR, MFA everywhere, an incident response plan, cyber insurance and an AI usage policy.
A certificate you can show
Unlike a maturity score, Gold is a certification under a published Australian standard. It answers the supplier questionnaire in one line.
The 27 Gold controls, in plain English
Gold covers every Bronze and Silver requirement plus the Gold additions, 27 controls in total across five domains. Here is the full set, worded the way you would explain it to a colleague.
Technology Management (7 controls)
- Engage a technical support specialist (your MSP counts)
- Firewall installed and configured
- Antivirus on every device
- Automatic software updates and patches
- TLS certificates on public sites
- All servers patched
- Endpoint detection and response (EDR)
Access Management (8 controls)
- Strong password hygiene
- A password manager
- No admin privileges for everyday accounts
- An individual account for every person
- MFA on email
- MFA on business applications
- Remote Desktop only over a VPN
- Email anti-spoofing (SPF, DKIM, DMARC)
Backup and Recovery (2 controls)
- A backup and recovery strategy (3-2-1 rule)
- Cyber insurance
Policies, Processes and Plans (9 controls)
- A cybersecurity policy
- An incident response plan
- An AI usage policy
- A digital asset register
- Confidentiality agreements
- An invoice fraud procedure
- A visitor register
- Secure document destruction
- Secure device disposal
Education and Training (1 controls)
- Enhanced security training for staff
Control wording above is simplified. The platform assesses against the full SMB1001:2026 standard text under our DSI commercial licence.
How CYBERWHITE gets you to Gold
Most tools stop at a gap report. We deploy the fix, not just the report.
Scan Microsoft 365 in about 5 minutes
Connect your tenant read-only. The scan checks the technical Gold controls (MFA, patching, EDR signals, email authentication and more) against live configuration, not a questionnaire answer.
CARS ranks what to fix first
CYBERWHITE Adaptive Risk Scoring orders every gap by real risk to your business, so you start with the control that matters most instead of the one at the top of an alphabetical list.
AutoFix deploys the technical fixes
151 remediation actions mapped across Essential 8, SMB1001 and SOC 2, and 48 deploy in one click with a snapshot taken first and rollback available. Every change is approved by you.
Policies and evidence, ready for the attestation
Gold is one third paperwork: cybersecurity policy, incident response plan, AI usage policy and more. The platform provides the policy templates and keeps the evidence. The attestation itself is always signed by your director, never by software.
For MSPs: Gold is a service line
Because Gold is self-attested, you can deliver it end to end: set up the controls, keep the evidence, and hand your client a prepared attestation to sign. The SMB1001:2027 edition formally names that helper role the Technical Support Specialist, and tells businesses their existing MSP is usually the right place to start.
- Run Gold assessments across your whole client base from one dashboard
- Scan each client tenant and deploy fixes with snapshot and rollback
- Certificates renew yearly, so Gold becomes recurring work, not a one-off project
Gold and Essential 8 work together
Essential 8 is the ASD maturity model, and it stays the benchmark for government and enterprise work. SMB1001 was written for small and medium businesses, and it produces something Essential 8 does not: a certificate. The good news is the technical work overlaps heavily. MFA, patching, application control, backups and admin restrictions count toward both, and CYBERWHITE assesses both from the same Microsoft 365 scan.
Frequently asked questions
What is SMB1001 Gold?
Gold is the third of five SMB1001 certification tiers, covering 27 controls across five domains: technology management, access management, backup and recovery, policies and plans, and training. It is the highest tier a business can certify through director self-attestation. Certification is valid for one year.
Does SMB1001 Gold need an external auditor?
No. Bronze, Silver and Gold are certified by company-director self-attestation. Platinum and Diamond require independent third-party assessment. That makes Gold the highest tier a business, or its MSP, can deliver end to end without engaging a certifier.
How long does it take to reach SMB1001 Gold?
It depends on how many of the 27 controls are already in place. A business with Microsoft 365, MFA and working backups is often closer than it thinks. The technical controls can be verified with a scan in about 5 minutes, and the remaining work is usually policies, insurance and training rather than technology.
Is SMB1001 Gold better than Essential 8 for a small business?
They answer different questions. Essential 8 is the ASD maturity model used in government and enterprise contexts. SMB1001 is a certification standard written for small and medium businesses, with a certificate a director can sign and a supplier can show. Many Australian businesses run both, and most of the technical work overlaps.
Can an MSP deliver SMB1001 Gold for its clients?
Yes. Because Gold is self-attested, an MSP can set up the controls, keep the evidence, and prepare the attestation for the client director to sign. The 2027 edition of the standard formally names this helper role the Technical Support Specialist and points businesses at their existing MSP first.
See how far from Gold you are
Connect Microsoft 365, scan in about 5 minutes, and get a ranked list of exactly which Gold controls are missing.