Level 5 · Diamond · Independently verifiedFor buyers who ask you to prove everything, including your own suppliers.
Diamond is the top SMB1001 tier. It adds outside testing, round-the-clock monitoring and a programme for the suppliers you depend on, and it is independently verified.
- Requirements so far
- 39 of 39
- Checked by
- Independently verified
- Valid for
- 12 months
- Typical time
- Two to three months
Four questions before you commit to Diamond.
Who needs Diamond?
Diamond suits a business whose buyers set the highest bar and check how it manages its own supply chain.
- A supplier to government or a critical industry.
- A business that holds sensitive personal or client data at scale.
- A firm whose own customers will ask who its suppliers are and how it checks them.
What does it ask of you?
Seven more requirements on top of Platinum, and several depend on outside providers.
- Encryption of important data and approved software only.
- Yearly testing by outside specialists, including attempts to trick staff.
- Protection on every device, watched around the clock by a managed service.
- A programme for checking and managing your suppliers.
- Police vetting for staff with privileged access, and a live incident exercise.
What will it take?
Two to three months, plus a separate external audit fee, and more planning than any other tier.
- Outside testing and a managed monitoring service have to be booked and set up.
- Supplier checks take time to start and then run all year.
- Scope the work with us first so the order is right.
What proof is needed?
An independent auditor reviews a larger body of proof, including reports from outside providers, before the certificate is issued.
- Reports from your outside testing and your monitoring service.
- Records of supplier checks and of your incident exercise.
- Evidence of encryption and approved-software settings.
What is new or raised at Diamond, in plain words.
Each tier includes everything below it. These are the requirements Diamond adds or raises to a higher standard.
Encryption of important data at rest
All critical, confidential, sensitive, and personally identifiable data must be encrypted where it is stored: on servers, workstations, laptops, external drives, and cloud services. For personal devices used for work, no data should be stored locally if avoidable; where it is, the device itself must be encrypted.
Application control
Only approved applications are permitted to run on workstations and laptops. This is enforced using cryptographic hash rules, publisher certificate rules, or path rules: not just an honour system. The approved application list must be defined, reviewed, and maintained. This is one of the most effective controls against malware.
Disable untrusted Microsoft Office macros
Macros in Office documents are a common malware delivery mechanism. All untrusted macros must be disabled across all workstations, laptops, and servers. 'Enable all macros' must never be selected.
Annual penetration, vulnerability and social engineering testing
An external specialist must conduct a full penetration test and vulnerability assessment at least once per year. The engagement must also include social engineering testing: assessing how susceptible your staff are to phishing, vishing, and physical security bypass attempts.
EDR with Managed Detection and Response (MDR) service
Diamond upgrades EDR to include a Managed Detection and Response service. An external MDR provider monitors your environment continuously, investigates alerts, and provides contained and remediation guidance for confirmed threats: backed by a formal SLA covering detection, triage, and response timeframes.
Phishing-resistant MFA on all business apps and social media
At Platinum, phishing-resistant MFA was required for email. Diamond extends this standard to all cloud business applications and social media accounts: authenticator apps, hardware tokens, or U2F devices only. SMS and email codes are not acceptable.
Enhanced incident response plan: with breach notification procedures
Diamond requires a more comprehensive incident response plan than Gold. It must include communication templates and playbooks for customers, staff, investors, media, and authorities. It must also include guidance for identifying whether data exposure has occurred and the subsequent notification obligations under applicable data breach laws.
Enhanced digital asset register: with personal data mapping
The Diamond asset register goes beyond listing where data is stored. It must identify all digital assets containing personal data, map who and which external providers have access to each, and be audited annually to confirm it remains current and accurate.
Digital trust programme with suppliers
A formal, risk-based programme governing your suppliers' cyber hygiene. Suppliers without ISO 27001 (or equivalent) must meet minimum cyber hygiene requirements aligned to SMB1001. All suppliers must contractually notify you of any cyber incident. You review the scope of any certifications they hold to ensure relevance.
Police vetting for privileged access staff
All employees and contractors with administrative privileges or regular after-hours access to your premises must undergo police vetting checks. This includes cleaning contractors and maintenance staff with physical access outside business hours.
Incident response plan testing: red team, blue team, or purple team
The incident response plan must be tested in a live exercise at least once per year: not just reviewed. Red team, blue team, or purple team exercises with your incident response staff, ideally facilitated by an external specialist. This is how you find out if the plan actually works before a real incident forces the question.
The SMB1001 standard has 39 requirements across five tiers. Each tier includes the one before it, so the running totals are 7, 17, 27, 32 and 39. The CyberGrape platform tracks 52 control codes, because enhanced variants of a requirement are counted separately. Requirements are from SMB1001:2026, published by Dynamic Standards International.
How CyberGrape gets you to Diamond.
We prepare your evidence, complete the certification, submit it and manage it as it renews. The certificate is issued by CyberCert.
- 01
See where you stand
We check your connected tools and answers against each requirement and show what is covered and what is not.
- 02
Fix what matters first
Gaps become tracked actions with owners and dates, starting with the ones that block the certificate.
- 03
Prepare the proof pack
Dated evidence and documents are gathered so the auditor has what they need.
- 04
Prepare for the independent audit
We help you get ready for the audit. The audit has a separate external fee.
- 05
Submission and certificate
We complete the certification and submit it to CyberCert, which issues the certificate.
CyberGrape is a licensed partner of CyberCert, certification authority for Dynamic Standards International (DSI), the publisher of the SMB1001 standard.
Certificates are issued by CyberCert against the SMB1001 standard published by Dynamic Standards International. CyberGrape prepares and submits your evidence but does not issue the certificate.
Common questions about Diamond.
Businesses whose buyers ask for the highest tier or for independent verification of supplier management. If nobody has asked, Gold or Platinum may be enough. The free assessment helps you decide.
The audit carries a separate external fee, charged by the auditor and not by CyberGrape.
Two to three months, with a separate external audit fee. Some measures need outside providers, so planning early helps.
It covers a lot of the same ground, but it is a different standard. ISO 27001 has its own requirements and its own independent certification. CyberGrape supports both.
Compare the tiers
Diamond is the top tier. Compare it with the rest.