Do I have to start at Bronze?

No. Each tier includes the one below it, but you do not need to certify at each level first. The free assessment shows where you stand and which tier fits.

What is the difference between director-attested and independently verified?

At Bronze, Silver and Gold, a director confirms the measures are in place, backed by evidence. At Platinum and Diamond, an independent auditor reviews your proof before the certificate is issued, and the audit has a separate external fee.

Which tier should I choose?

Ask the client, tender or insurer which tier they need. If nobody has named one, take the free assessment and start at the tier your current measures support.

Who publishes SMB1001, and who issues the certificate?

Dynamic Standards International publishes the standard. Certificates are issued by CyberCert, the Dynamic Standard Certifier. CyberGrape prepares and submits your evidence but does not issue the certificate.

How long does a certificate last?

Every tier is valid for 12 months. CyberGrape keeps watching your measures through the platform, so renewal is a review rather than a fresh start.

Will a certificate help with cyber insurance?

It gives you evidence insurers ask for. We do not promise acceptance or a lower premium. CyberCert connects certified businesses with insurance partners who recognise the certificate.

How does CyberGrape help with certification?

We check where you stand, help you fix what matters first, prepare the proof pack, complete the certification and submit it, then manage it as it renews. For Platinum and Diamond we also help you prepare for the independent audit.

We already work with an MSP. Can they use CyberGrape?

Yes. If your MSP is on the CyberGrape platform, they can manage your SMB1001 programme from their console. If they are not, ask us about getting them connected.

SMB1001 certification

A certificate your clients, insurers and tenders will understand.

SMB1001 is a cybersecurity certificate built for small businesses. It gives you one thing to show when a customer, an insurer or a tender panel asks whether your security is real.

Check where you stand, free Compare the five tiers

Why it matters

What the certificate is for.

People who buy from you or cover you want proof, not promises. The certificate is a recognised way to give it.

Clients

A customer asks how you protect their data. A certificate answers it once, instead of a new questionnaire each time.

Insurers

It gives you evidence insurers ask for. We do not promise acceptance or a lower premium.

Tenders

Some buyers name SMB1001 or a tier in their requirements. Holding it means you can respond to those.

Who does what

Who does what.

Three parties are involved, and CyberGrape is only one of them.

Dynamic Standards International

Publishes the SMB1001 standard and decides what each tier requires.

CyberCert

The Dynamic Standard Certifier. It issues the certificate.

CyberGrape

Prepares your evidence, completes the certification, submits it and manages it for you. We do not issue certificates.

CyberGrape is a licensed partner of CyberCert, certification authority for Dynamic Standards International (DSI), the publisher of the SMB1001 standard.

Certificates are issued by CyberCert against the SMB1001 standard published by Dynamic Standards International. CyberGrape prepares and submits your evidence but does not issue the certificate.

Compare

The five tiers, side by side.

Each tier includes the one before it. Bronze, Silver and Gold are director-attested. Platinum and Diamond are independently verified.

Tier	Who it suits	Main measures	Checked by	Typical time	Next step
Bronze7 requirements so far	A small business with the basics in hand that has never had to show them to anyone.	A firewall, protection on every device, automatic updates, strong passwords, a backup kept apart from your main systems, staff awareness training and a reliable IT contact.	Director-attested	Weeks	Take the free assessment. If the basics are in place, certify at Bronze.Bronze in detail
Silver17 requirements so far	A business that has the basics and now wants rules around who can get in and how money moves.	Everything in Bronze, plus two-step sign-in on email, a password manager, protection against email spoofing, individual accounts for staff and an invoice fraud procedure.	Director-attested	Weeks	Move up from Bronze, or start here if the basics are already in place.Silver in detail
Gold27 requirements so far	A business whose clients, tenders or insurers ask for written policies and a plan for when something goes wrong.	Everything in Silver, plus protection on every device that spots and responds to threats, two-step sign-in on all business apps, a cybersecurity policy, an incident plan, an AI use policy and cyber insurance.	Director-attested	Weeks	Close the gaps the assessment finds, then certify at Gold.Gold in detail
Platinum32 requirements so far	A business whose buyer wants an outside party to have checked, not only the director's word.	Everything in Gold, plus regular checks of your internet-facing systems, stronger sign-in that resists phishing, control of cloud logins, two-step sign-in on remote access and a backup you have tested.	Independently verified	Two to three months, with a separate external audit fee	Plan the external audit alongside the fixes, and allow for its separate fee.Platinum in detail
Diamond39 requirements so far	A business that must show the highest level of assurance, including how it manages its own suppliers.	Everything in Platinum, plus encryption of important data, only approved software running, yearly testing by outside specialists, protection on every device watched around the clock, supplier checks and vetting of privileged staff.	Independently verified	Two to three months, with a separate external audit fee	Talk to us about scope before you start, because several measures need outside providers.Diamond in detail

Bronze

7 requirements so far

Who it suits: A small business with the basics in hand that has never had to show them to anyone.
Main measures: A firewall, protection on every device, automatic updates, strong passwords, a backup kept apart from your main systems, staff awareness training and a reliable IT contact.
Checked by: Director-attested
Typical time: Weeks
Next step: Take the free assessment. If the basics are in place, certify at Bronze.

Bronze in detail

Silver

17 requirements so far

Who it suits: A business that has the basics and now wants rules around who can get in and how money moves.
Main measures: Everything in Bronze, plus two-step sign-in on email, a password manager, protection against email spoofing, individual accounts for staff and an invoice fraud procedure.
Checked by: Director-attested
Typical time: Weeks
Next step: Move up from Bronze, or start here if the basics are already in place.

Silver in detail

Gold

27 requirements so far

Who it suits: A business whose clients, tenders or insurers ask for written policies and a plan for when something goes wrong.
Main measures: Everything in Silver, plus protection on every device that spots and responds to threats, two-step sign-in on all business apps, a cybersecurity policy, an incident plan, an AI use policy and cyber insurance.
Checked by: Director-attested
Typical time: Weeks
Next step: Close the gaps the assessment finds, then certify at Gold.

Gold in detail

Platinum

32 requirements so far

Who it suits: A business whose buyer wants an outside party to have checked, not only the director's word.
Main measures: Everything in Gold, plus regular checks of your internet-facing systems, stronger sign-in that resists phishing, control of cloud logins, two-step sign-in on remote access and a backup you have tested.
Checked by: Independently verified
Typical time: Two to three months, with a separate external audit fee
Next step: Plan the external audit alongside the fixes, and allow for its separate fee.

Platinum in detail

Diamond

39 requirements so far

Who it suits: A business that must show the highest level of assurance, including how it manages its own suppliers.
Main measures: Everything in Platinum, plus encryption of important data, only approved software running, yearly testing by outside specialists, protection on every device watched around the clock, supplier checks and vetting of privileged staff.
Checked by: Independently verified
Typical time: Two to three months, with a separate external audit fee
Next step: Talk to us about scope before you start, because several measures need outside providers.

Diamond in detail

How many requirements are there?

The SMB1001 standard has 39 requirements across five tiers. Each tier includes the one before it, so the running totals are 7, 17, 27, 32 and 39. The CyberGrape platform tracks 52 control codes, because enhanced variants of a requirement are counted separately.

Who checks

Director-attested or independently verified.

This is the difference that matters most when you choose a tier.

Director-attested

Bronze, Silver and Gold. A director of your business confirms the measures are in place, backed by evidence. No outside audit is needed.

Independently verified

Platinum and Diamond. An independent auditor reviews your proof before the certificate is issued. The audit has a separate external fee.

Choosing

Which tier is for you?

Ask the buyer first. If a client, tender or insurer names a tier, start there. If nobody has, the free assessment shows where you stand and what to fix first.

Check where you stand, free

See what you get

Three things you can hold in your hands.

These are the reports the platform produces. Each one below is a sample made from invented information, so you can see the layout before you share anything of your own.

Here is where you stand.

Most areas are in good shape and a few are exposed. Start with the three below.

In good shape

Email protection
Software updates
Staff awareness

Exposed

Multi-factor sign-in
Leavers and old accounts
Backup testing

Your top three fixes

Turn on multi-factor sign-in for every administrator account. Stops a stolen password from opening the door.
Remove access for people who have left. Closes accounts nobody is watching.
Get your backup tested, not just switched on. Proves you can get your data back.

What it would take to be client-ready: two more fixes after these, then your proof is ready to share.

SampleAn invented example, not a real customer.

Sample only. Names and figures are invented and no real customer data is used. Your own reports are built from the tools and records you connect.

Check where you stand, free

Questions

Common questions.

Find out which tier fits.

The free readiness assessment shows you where you stand and what to fix first. If we are not the right fit, we will tell you that too.

Check where you stand, free Talk to us