Level 3 · Gold · Director-attestedShow you have a plan before something goes wrong.
Gold adds the policies, the incident plan and the protection that spots threats on every device. It suits a business that a client, a tender panel or an insurer asks to see more than the basics from.
- Requirements so far
- 27 of 39
- Checked by
- Director-attested
- Valid for
- 12 months
- Typical time
- Weeks
Four questions before you commit to Gold.
Who needs Gold?
Gold suits a business that is asked, in writing, how it would cope with an incident.
- A supplier answering a tender that asks for a recognised standard.
- A firm that holds client data and is asked about its incident plan.
- A business whose insurer asks about protection on devices and sign-in.
What does it ask of you?
Ten more requirements on top of Silver, covering protection, policy and planning.
- Protection on every device that spots and responds to threats (EDR).
- Two-step sign-in on every business app, and a password manager for everyone.
- A full email protection setup, so others cannot pose as you.
- A cybersecurity policy, an incident plan and an AI use policy.
- Cyber insurance, an asset register and safe disposal of devices and documents.
What will it take?
Usually weeks, with the longest part being the policies and the incident plan.
- Starting from templates saves most of the writing.
- Rolling out device protection needs a short window with each device.
- A director signs off at the end.
What proof is needed?
A director confirms the measures are in place, backed by documents and readings from your tools.
- Approved policies and an incident plan with owners and dates.
- Reports showing device protection and sign-in settings.
- Your cyber insurance details and a current asset register.
What is new or raised at Gold, in plain words.
Each tier includes everything below it. These are the requirements Gold adds or raises to a higher standard.
Endpoint Detection and Response (EDR)
Antivirus catches known threats. EDR catches behaviour that looks malicious even when the threat is new. It monitors all workstations, laptops and servers continuously, flags anomalies, and can isolate a device automatically when something suspicious happens.
Password manager: extended to all users
At Gold, the password manager requirement extends to all staff who manage more than one credential. The system must support audit logging, role-based access, MFA, and staff education on credential hygiene.
MFA on all business applications and social media
MFA on email was required at Silver. Gold extends this to every cloud-hosted business application and social media account. Any account associated with your business is a potential entry point: this control closes that door.
RDP only over VPN
Remote Desktop Protocol should never be exposed directly to the internet. If your team uses RDP, it must only be accessible through a centrally managed VPN or application proxy. Not applicable if you don't use RDP.
Email authentication, DKIM and DMARC added
Bronze added SPF. Gold extends this to DKIM (cryptographic email signing) and DMARC (which tells receiving mail servers what to do with unauthenticated messages). Together, these three protocols make it very difficult to spoof your domain.
Business or cyber insurance
A policy that covers cyber incidents: ransomware recovery, incident response costs, business interruption, and notification expenses. This is the financial safety net that lets you survive a serious incident without it destroying the business.
Cybersecurity policy
A formal document defining your security requirements, staff responsibilities, and acceptable use. Every employee reads and signs it. This is the foundation of a security culture: it makes expectations explicit and creates accountability.
Incident response plan
A documented plan for what to do when something goes wrong. Who to call, what steps to follow, how to communicate with customers and law enforcement, and how to contain and recover from the incident. Having this before you need it is everything.
Secure physical document destruction
Sensitive paper documents: contracts, financial records, HR files: must be shredded or disposed of through a secure destruction service. Physical data exposure is a real risk that digital security can't address.
Secure device disposal
Old computers, hard drives, USBs, and media must be wiped beyond recovery before disposal, resale, or donation. If the device contained sensitive data and the storage isn't properly destroyed, it can become a breach.
Digital asset register
A maintained inventory of where your sensitive and critical data lives: which servers, cloud services, drives, and devices hold what. You can't protect what you haven't catalogued, and you can't recover what you don't know exists.
AI use policy
A policy governing how AI tools are used within your organisation: what's acceptable, what data employees can feed into AI systems, how risks are managed, and how compliance with privacy regulations is maintained. AI usage without a policy is a growing and underappreciated risk.
Ongoing cybersecurity awareness campaign
At Bronze, basic training was required. Gold extends this to a continuous awareness programme: phishing simulation, vishing awareness, email safety, invoice fraud, physical security, and an annual policy review. Security culture is built over time, not in a single session.
The SMB1001 standard has 39 requirements across five tiers. Each tier includes the one before it, so the running totals are 7, 17, 27, 32 and 39. The CyberGrape platform tracks 52 control codes, because enhanced variants of a requirement are counted separately. Requirements are from SMB1001:2026, published by Dynamic Standards International.
How CyberGrape gets you to Gold.
We prepare your evidence, complete the certification, submit it and manage it as it renews. The certificate is issued by CyberCert.
- 01
See where you stand
We check your connected tools and answers against each requirement and show what is covered and what is not.
- 02
Fix what matters first
Gaps become tracked actions with owners and dates, starting with the ones that block the certificate.
- 03
Prepare the proof pack
Dated evidence and documents are gathered in the form the certifier expects.
- 04
Sign-off and submission
A director signs off. We complete the certification and submit it to CyberCert, which issues the certificate.
CyberGrape is a licensed partner of CyberCert, certification authority for Dynamic Standards International (DSI), the publisher of the SMB1001 standard.
Certificates are issued by CyberCert against the SMB1001 standard published by Dynamic Standards International. CyberGrape prepares and submits your evidence but does not issue the certificate.
Common questions about Gold.
It depends on the client. Some name a tier and some ask only for SMB1001. Ask them which tier they need before you choose.
We cannot promise that. Gold gives you evidence insurers ask for. CyberCert connects certified businesses with insurance partners who recognise the certificate.
No. Gold is director-attested. The certificate is issued by CyberCert.
Usually weeks, depending on how many policies and protections are already in place.
Compare the tiers
Gold is where plans and policies come in. Compare it with the tiers either side.