Level 1 · Bronze · Director-attestedShow a client the basics are in place.
Bronze is the first SMB1001 tier. It covers the everyday protections that stop many common attacks, and it gives you something to show when a customer asks whether you take security seriously.
- Requirements so far
- 7 of 39
- Checked by
- Director-attested
- Valid for
- 12 months
- Typical time
- Weeks
Four questions before you commit to Bronze.
Who needs Bronze?
Bronze suits a business that has never been asked for proof, or is being asked for the first time.
- A new supplier filling in its first customer questionnaire.
- A small firm whose owner wants a written record that the basics are done.
- A business that expects to aim higher later and wants a clear starting point.
What does it ask of you?
Seven requirements, all of them everyday protections.
- A firewall and protection on every device.
- Updates that install themselves.
- Strong passwords, and staff who know what to watch for.
- A backup that ransomware cannot reach.
- Someone reliable you can call for IT help.
What will it take?
Usually weeks, and shorter if you already do most of this.
- Most of the work is checking and switching things on, not buying new systems.
- CyberGrape finds the gaps and tells you which to fix first.
- A director signs off at the end.
What proof is needed?
A director confirms the measures are in place, backed by evidence from your own tools.
- Settings and reports from your connected tools, dated.
- Training records for your staff.
- A note of how your backup is kept apart from your main systems.
The Bronze requirements, in plain words.
These are all of the requirements at Bronze. Each one answers a common way small businesses get caught out.
Engage a technical support specialist
Have a trusted IT professional or MSP you can call on. They don't need to be full-time, but they need to be reliable. This is the person who helps you implement the rest of the controls.
Install and configure a firewall
A firewall is the gate between your network and the internet. It needs to be installed, configured correctly, and have its default password changed. Every device should have its firewall switched on.
Install antivirus on all devices
Every computer, laptop, and phone used for work needs up-to-date antivirus software. For mobile devices, this means using only official app stores and keeping built-in security protections active.
Automatic software updates and patches
Outdated software is one of the most common ways attackers get in. Set everything: operating systems, apps, browsers: to update automatically. If something can't auto-update, patch it manually at least every three months.
Strong password hygiene
Every device and account needs a strong, unique passphrase. Default passwords must be changed immediately. If a breach happens, passwords need to be updated within 30 days. If you use password expiry, rotate them at least once a year.
Backup and recovery strategy
You need at least one offline backup of your critical data: email, files, client records: stored separately from your main network. If ransomware hits, this is what saves you. Test that backups actually restore.
Cybersecurity awareness training
Every staff member needs to understand the threats they face, what they're responsible for, and what to do if they suspect something's wrong. Keep a record of who has completed training.
The SMB1001 standard has 39 requirements across five tiers. Each tier includes the one before it, so the running totals are 7, 17, 27, 32 and 39. The CyberGrape platform tracks 52 control codes, because enhanced variants of a requirement are counted separately. Requirements are from SMB1001:2026, published by Dynamic Standards International.
How CyberGrape gets you to Bronze.
We prepare your evidence, complete the certification, submit it and manage it as it renews. The certificate is issued by CyberCert.
- 01
See where you stand
We check your connected tools and answers against each requirement and show what is covered and what is not.
- 02
Fix what matters first
Gaps become tracked actions with owners and dates, starting with the ones that block the certificate.
- 03
Prepare the proof pack
Dated evidence and documents are gathered in the form the certifier expects.
- 04
Sign-off and submission
A director signs off. We complete the certification and submit it to CyberCert, which issues the certificate.
CyberGrape is a licensed partner of CyberCert, certification authority for Dynamic Standards International (DSI), the publisher of the SMB1001 standard.
Certificates are issued by CyberCert against the SMB1001 standard published by Dynamic Standards International. CyberGrape prepares and submits your evidence but does not issue the certificate.
Common questions about Bronze.
If you have never been asked to show your security, yes. You can also start higher. The free assessment shows where you stand and which tier fits.
A director of your business signs off, and the certificate is issued by CyberCert. Bronze is director-attested, so no outside audit is needed.
Usually weeks. It depends on how many of the basics are already in place.
The certificate is valid for 12 months. You can renew at Bronze or move up to Silver. CyberGrape keeps watching your measures so renewal is not a fresh start.
Compare the tiers
Bronze is the first tier. See what the others add.