CNETS · Melbourne & Australia
SMB1001 certification & consulting
Cyber Security for Small & Medium Businesses
SMB1001 is a tiered cyber security standard designed for small and medium businesses. It provides a staged way to strengthen security across technology, policies, people and processes. CNETS helps assess your starting point, choose an appropriate level and prepare controls and evidence for the applicable certification process.
The business case
Why invest in SMB1001?
Smaller organisations need a realistic way to improve security without treating every control as equally urgent. SMB1001 has five levels with progressively more demanding requirements. A business can begin at the level suited to its current context and move toward higher levels as risks and customer expectations change.
A suitable level should reflect what you need to protect, how you operate and what customers require. It is not simply a badge to buy: the controls need owners, implementation and records that show they are being maintained.
Built for your organisation
Small and medium businesses seeking staged security uplift and customer assurance.
- Build security foundations
- Choose a tier suited to risk
- Prepare certification evidence
- Plan future security improvements
Scope & requirements
What does SMB1001 cover?
Scope comes first. The work should reflect your operations, risks and assurance requirements.
Technology safeguards
Assess practical controls around identities, devices, networks, software and data protection against the requirements of the chosen level.
Policies and responsibilities
Establish clear security expectations and accountable owners. Make procedures proportionate to your team and operating environment.
People and awareness
Help employees recognise common threats, protect information and report suspicious activity through an understood escalation path.
Recovery and continuity
Review incident response, backup and recovery practices against the relevant requirements and the needs of the business.
Evidence and progression
Identify the evidence and assessment arrangements for your target tier, track gaps and plan future improvements without overstating certification coverage.
Practical outputs
What we work on with you
The proposal confirms the deliverables and responsibilities for your engagement.
- Current-state security review and target-tier recommendation
- Requirements-to-control gap assessment
- Prioritised remediation plan and assigned owners
- Relevant security policies and supporting records
- Evidence checklist for the applicable assessment
- Maintenance and progression plan
Before we begin
What helps us scope the work
You do not need everything ready to start a conversation. Existing material helps us avoid duplicating work.
- Business size, services and customer security expectations
- Devices, cloud services and key outsourced IT providers
- Current security controls and policies
- Incidents, backup arrangements and important data types
Choose with clarity
SMB1001 or ISO 27001? Start with the requirement
- Approach
- SMB1001
Tiered cyber security requirements aimed at smaller businesses.
- ISO 27001
A risk-based Information Security Management System.
- Decision
- SMB1001
Useful for staged security uplift and relevant customer assurance.
- ISO 27001
Appropriate when an ISMS or ISO certification is required.
- Progression
- SMB1001
Can establish controls and evidence useful for future work.
- ISO 27001
Additional management-system requirements must still be implemented.
From assessment to action
How CNETS approaches SMB1001
- 01
Review security
Understand your information, systems, suppliers and existing safeguards.
- 02
Agree the tier
Match the target level to your risk, customer requirements and readiness.
- 03
Close the gaps
Implement relevant controls and assign people to maintain them.
- 04
Prepare evidence
Organise records and review readiness for the applicable assessment.
- 05
Maintain and progress
Plan continuing reviews and consider a higher tier when appropriate.
Keep the work effective after delivery
Maintain safeguards as staff, devices, services and threats change. Confirm the current standard edition, target-tier assessment requirements and renewal arrangements before committing to a certification plan.
Our proprietary platform
Checkmate
Connect the work. Keep the evidence.
Checkmate helps bring security policies, responsibilities and evidence together. Policy acknowledgement and knowledge checks support staff understanding, while tracked actions give your team a clearer view of what remains to be completed.
Checkmate.
One connected view. From implementation to your next audit.
Policies & evidence
A single source of truth.
People & ownership
Clear responsibilities.
Risks & controls
A connected management system.
Straight answers
SMB1001: your questions answered
- What is SMB1001?
SMB1001 is a cyber security standard designed for small and medium businesses, with progressively more demanding tiers. The appropriate target depends on your security risks, current maturity and customer expectations.
- Which SMB1001 level should we choose?
Start with a review of your existing safeguards and assurance requirements. CNETS can map gaps against a proposed level so the choice is based on evidence and available resources rather than a label alone.
- Is SMB1001 the same as ISO 27001?
No. SMB1001 is a tiered cyber security standard, while ISO 27001 specifies requirements for an Information Security Management System. Neither should be described as interchangeable with the other.
- Can SMB1001 help us work toward ISO 27001?
Yes. Policies, controls and evidence may provide useful foundations. An ISO 27001 gap assessment is still needed to address scope, risk methodology, management-system requirements and control applicability.
- Does SMB1001 replace the Essential Eight?
No. They are different frameworks. Relevant technical safeguards may overlap, but a requirement for a particular Essential Eight maturity level must be assessed separately.
- What will implementation cost?
The target tier, existing controls, number of devices and reliance on suppliers affect effort and remediation costs. Request a scoped proposal and confirm certification or assessment fees separately.
Connected expertise
ISO 27001
Protect sensitive information with a risk-based security management system.
Awareness Training
Turn your workforce into a human firewall with continuous training and phishing simulations.
Firewall Audit
Identify excessive access, obsolete rules and configuration weaknesses.
Standards & further reading
General guidance, not legal advice. Requirements depend on your scope and the applicable standard edition. Confirm certification and assessment arrangements for your organisation.
Next step
Your next step starts
with a conversation.
Tell us where you want to go. We’ll help you understand what it takes to get there.