How do I choose a security certification for a small business?

There is no single law forcing an Australian small business to hold a cyber security certification, so the choice comes down to who is asking for proof and what they will recognise. For most small and mid-sized businesses, SMB1001 is the sensible starting point because it was built for their size. ISO 27001 and the Essential Eight each suit a different situation, which this article explains.

Table of Contents

• Is cyber security certification mandatory for small businesses in Australia?

• What are the different security certifications and standards for small businesses in Australia?

• Which certification should a small business choose first?

• How does SMB1001 work, tier by tier?

• What does certification cost in time and money, and what proof do you get?

• How do you know where you stand before choosing a certification?

• What mistakes should a small business avoid when picking a certification?

• Key Takeaways

• References

Is cyber security certification mandatory for small businesses in Australia?

No. No single law requires small businesses in Australia to hold a cyber security certification, according to The IT Agency.

The Privacy Act 1988 expects organisations to take reasonable steps to protect the personal information they hold, but it does not mandate a particular cyber security framework or certificate. That means the legal baseline is about sensible protection, not a specific badge on your website.

The Essential Eight is mandatory only for non-corporate Commonwealth government entities at Maturity Level Two. For a small business, it is a framework to align with, not a certificate to hold.

Pressure comes from the market instead. Clients, insurers and government tenders increasingly ask for proof of security before they will sign a contract or renew a policy. The Queensland Government notes that the average cost of cybercrime in Australia is $56,600 for small businesses, which is why buyers now ask for evidence.

What are the different security certifications and standards for small businesses in Australia?

A certificate is independent proof that you meet a standard. A framework is a set of controls you work to. The distinction matters because some options on the market are certificates you can hold, while others are simply good practice you can align with.

SMB1001 is a five-tier standard built specifically for small and medium businesses. It was published by Dynamic Standards International and runs from Bronze through Silver, Gold, Platinum and Diamond. Each tier includes the one below it, so you can start small and work up as you grow.

ISO 27001 requires formal governance, documented policies, ongoing risk management and independent certification. It suits larger or enterprise-facing businesses that need a globally recognised certificate and have the resources to maintain a full management system.

The Essential Eight is the Australian Signals Directorate's set of eight technical mitigation strategies, including multi-factor authentication, application control, patching and secure backups. It is a framework, not a certificate.

SMB1001's 2026 edition publishes control mappings to the Essential Eight, UK Cyber Essentials, US CMMC and ISO 27001, according to The IT Agency. Work done for one standard therefore counts towards others.

Which certification should a small business choose first?

Start with what the requester will recognise, then match the effort to your team size. If a client questionnaire asks for proof of security controls, choose the certificate that answers that questionnaire with the least overhead.

SMB1001 is the right first choice for most small and mid-sized businesses. The requirements are things a small team can actually do, and you can start at Bronze and work up as you grow. Alltasks describes it as a standard built for small and medium businesses rather than adapted from enterprise frameworks.

ISO 27001 is the better answer when a large client or tender explicitly asks for it, or when you need formal governance and independent certification to satisfy an enterprise buyer. It is a heavier lift, but sometimes the market leaves you no choice.

The Essential Eight is the right lens when you sell to government or want a technical baseline the ACSC recommends. The Queensland Government notes the ACSC recommends small businesses implement Maturity Level One of the Essential Eight after completing its small business guide.

SMB1001 aligns with these frameworks, so choosing it first does not lock you out of the others later.

How does SMB1001 work, tier by tier?

SMB1001 has five tiers, and each tier includes the one below it. Bronze has 7 requirements, Silver has 17, Gold has 27, Platinum has 32 and Diamond has 39.

Bronze, Silver and Gold are director-attested. That means a company director signs off that the listed controls are in place. Platinum and Diamond are independently verified, which carries a separate external audit fee and typically takes two to three months.

Bronze covers the basics: IT support, firewalls, antivirus, auto-updates, backup and recovery, and password policies. Silver adds multi-factor authentication on emails, TLS for websites, password managers, no shared logins and confidentiality agreements.

Gold moves into governance with an asset register, secure device disposal, a cyber security policy, an incident response plan and training. Platinum and Diamond add advanced monitoring, regular vulnerability assessments, business continuity planning and continuous improvement.

The standard is updated yearly to address emerging threats and best practices, according to Alltasks. CyberGrape supports SMB1001:2026 and the January 2027 update.

What does certification cost in time and money, and what proof do you get?

Published figures for the Platinum and Diamond external audit fee, and for how long each tier takes, are not readily available. Ask the certifier for a quote and timeline before you commit, because the independent audit is a separate cost from the preparation work.

Director attestation requires a signed declaration that the listed controls are in place, backed by records you can show. It is a legal-style declaration, not a casual tick, so you need evidence behind every claim.

CyberCert is the certifier that issues SMB1001 certificates. CyberGrape is a licensed CyberCert partner: we prepare and submit your evidence and track your controls, but we do not issue certificates.

The certificate itself gives clients, insurers and tender panels something concrete to look at. We do not promise insurance acceptance or a lower premium, but a recognised certificate gives your broker something to show.

How do you know where you stand before choosing a certification?

The sensible first step is a readiness check, not a certificate, so you know which tier is realistic in 2026 before spending money. A short assessment shows you the gaps between where you are and where the standard expects you to be.

The free CyberGrape readiness assessment asks a few simple questions about your business, needs no account, and gives you your likely SMB1001 tier, the gaps holding you back and a plain-English action plan.

The evidence then lives in the CyberGrape GRC Platform. It supports SMB1001, ISO 27001, NIST CSF and NZISM, so one set of evidence answers client questionnaires, insurer requests and auditors.

If you want senior help, CSO-as-a-Service gives you a named security leader without a full-time salary. That leader works from the CyberGrape platform, so your risk register, policies and reports stay current.

What mistakes should a small business avoid when picking a certification?

Do not pick the biggest standard by default. ISO 27001 is a poor first step if a client questionnaire or insurer is the actual driver, because it demands formal governance and ongoing risk management that a small team may not need yet.

Do not treat a certificate as a one-off. SMB1001 is updated yearly and higher tiers expect continuous improvement, so plan for renewal and ongoing maintenance rather than a single project.

Do not chase a tier you cannot evidence. Director attestation is a legal-style declaration, so only sign off what you can show records for. An auditor or client may ask to see the proof behind your claim.

Do not ignore the technical basics while chasing paperwork. The ACSC's starting actions, including multi-factor authentication, patching and backups, underpin every standard on the list. The Queensland Government lists these as the foundation for small business security.

Key Takeaways

• No single Australian law requires small businesses to hold a cyber security certification; demand comes from clients, insurers and tenders.

• The Privacy Act 1988 expects reasonable steps to protect personal information but does not mandate a framework or certificate.

• SMB1001 has five tiers, Bronze through Diamond, and each tier includes the one below.

• Bronze, Silver and Gold under SMB1001 are director-attested; Platinum and Diamond require an independent audit.

• The Essential Eight is mandatory only for non-corporate Commonwealth government entities at Maturity Level Two.

• SMB1001's 2026 edition maps its controls to the Essential Eight, UK Cyber Essentials, US CMMC and ISO 27001.

• ISO 27001 suits businesses that need formal governance and independent certification, typically for larger or enterprise clients.

References

1. Do Australian small businesses need cyber security certification? — The IT Agency — Updated July 2026

2. SMB1001: The Cyber Security Certification Built for Small and Medium Businesses — Alltasks — Date unknown

3. Keeping your business cyber secure — Queensland Government — Date unknown

4. The Ultimate Small Business Cyber Security Guide — Solutions IT — July 9, 2026