Level 1 · Bronze · 7 Controls · Self-attestedEvery secure business starts somewhere.
Bronze is the foundation. Seven controls that cover the basics every business needs: a firewall, antivirus, patching, strong passwords, a backup, and staff who know what to watch for. If your security hasn't been formally assessed before, this is where you begin.
What does Bronze actually mean?
Bronze is SMB1001 Level 1. It's the globally recognised starting point for small businesses that want to demonstrate they've taken cybersecurity seriously: without the complexity and cost of enterprise-grade frameworks.
It covers the controls that stop the most common attacks: phishing, ransomware, and credential theft. Not because they're the only threats, but because they're the ones most likely to hit a business your size.
Certification is self-attested through an accredited certifier. CyberGrape handles every step: from the initial gap assessment through to evidence documentation and submission. You get the certificate. We do the work.
Who it's for
Businesses starting their security journey. Typically fewer than 20 staff or under $1M annual revenue: though any organisation can certify at Bronze.
What it proves
That you've implemented baseline protections across technology, access control, backup, and staff awareness. Sufficient for many supplier and insurer requirements at the foundational level.
What comes next
Silver adds 10 more controls covering formal policies, MFA and password management. Most businesses use Bronze as a 3-to-6 month stepping stone.
The 7 Bronze controls, explained plainly
These aren't bureaucratic checkboxes. Each control addresses a real risk. Here's what each one requires and why it matters.
Engage a technical support specialist
Have a trusted IT professional or MSP you can call on. They don't need to be full-time, but they need to be reliable. This is the person who helps you implement the rest of the controls.
Install and configure a firewall
A firewall is the gate between your network and the internet. It needs to be installed, configured correctly, and have its default password changed. Every device should have its firewall switched on.
Install antivirus on all devices
Every computer, laptop, and phone used for work needs up-to-date antivirus software. For mobile devices, this means using only official app stores and keeping built-in security protections active.
Automatic software updates and patches
Outdated software is one of the most common ways attackers get in. Set everything: operating systems, apps, browsers: to update automatically. If something can't auto-update, patch it manually at least every three months.
Strong password hygiene
Every device and account needs a strong, unique passphrase. Default passwords must be changed immediately. If a breach happens, passwords need to be updated within 30 days. If you use password expiry, rotate them at least once a year.
Backup and recovery strategy
You need at least one offline backup of your critical data: email, files, client records: stored separately from your main network. If ransomware hits, this is what saves you. Test that backups actually restore.
Cybersecurity awareness training
Every staff member needs to understand the threats they face, what they're responsible for, and what to do if they suspect something's wrong. Keep a record of who has completed training.
Controls sourced from SMB1001:2026, published by Dynamic Standards International (DSI). Full standard available at dsi.org.
How CyberGrape gets you to Bronze
Most businesses trying to self-certify spend weeks figuring out what evidence is required, how to document it, and whether they've actually met each control. We've done this hundreds of times. You get the outcome without the headache.
Gap assessment
We review your current security posture against all 7 Bronze controls and tell you exactly where you stand.
Remediation support
For any control not yet met, we implement the fix: firewall configuration, antivirus deployment, backup setup, password policies, training.
Evidence package
We document everything the certifier needs: screenshots, configuration records, policy acknowledgements, training logs.
Submission and certificate
We manage the certifier engagement and submission. You receive your Bronze certificate, valid for 12 months.
What Bronze certification delivers
- A recognised certificate you can show clients, insurers, and procurement teams
- Documented evidence for every control: ready for audits or contract requirements
- A clear security baseline to build on as you grow
- Staff who understand basic cyber threats and their responsibilities
- An offline backup strategy that protects you from ransomware
- 12 months of certification validity, managed through the CyberGrape platform
Common questions about Bronze
Explore the full certification pathway
Bronze is the beginning. See what comes next.