Level 4 · Platinum · Independently verifiedWhen a buyer wants an outside check, not only your word.
Platinum is the first independently verified tier. An outside auditor reviews your proof before the certificate is issued, which matters when a buyer will not accept a director's sign-off alone.
- Requirements so far
- 32 of 39
- Checked by
- Independently verified
- Valid for
- 12 months
- Typical time
- Two to three months
Four questions before you commit to Platinum.
Who needs Platinum?
Platinum suits a business that sells to buyers who require independent verification.
- A supplier to larger organisations that check their suppliers more closely.
- A business in a regulated field where an outside review carries weight.
- A firm that already holds Gold and has been asked for more.
What does it ask of you?
Five more requirements on top of Gold, aimed at remote access, cloud logins and recovery.
- Regular checks of your internet-facing systems for known weaknesses.
- Sign-in methods that resist phishing, starting with email.
- Control over cloud logins and who holds them.
- Two-step sign-in on remote access and wherever important data is stored.
- A backup you have tested by restoring it, and a service agreement with your IT provider.
What will it take?
Two to three months, plus a separate external audit fee.
- Time goes on the remote access and cloud login changes, and on testing a restore.
- The audit is run by an outside party and is charged separately.
- CyberGrape prepares the proof so the auditor has what they need.
What proof is needed?
An independent auditor reviews your proof before the certificate is issued.
- Everything Gold needs, held to a higher standard of detail.
- Results of your regular system checks.
- A record of a restore test, and your IT provider's service agreement.
What is new or raised at Platinum, in plain words.
Each tier includes everything below it. These are the requirements Platinum adds or raises to a higher standard.
MSP Service Level Agreement: incident response
Your IT provider or MSP must have a documented SLA that guarantees key incident response staff are available within 8 working hours when something goes wrong. Vague support arrangements aren't enough at this level.
Regular vulnerability scanning of internet-facing assets
Every public-facing resource: web servers, VPN portals, APIs: must be scanned regularly for known vulnerabilities. High-risk assets weekly, medium-risk monthly, low-risk quarterly. If an external provider manages these, you need written confirmation they're scanning.
Phishing-resistant MFA on email: stronger methods required
At Gold, MFA on email was required. Platinum upgrades the method: only authenticator apps, hardware devices, or U2F tokens are acceptable. SMS, voice, and email codes are specifically excluded: they're too easy to intercept or redirect.
Cloud credential and IAM management
Cloud access must be configured to minimise privileges across all accounts, including admin accounts. SSH keys and other remote access credentials must be stored securely: not on individual user devices. Where possible, cloud identity should be federated with your organisation's identity system.
MFA where important digital data is stored
Any system or service storing critical, sensitive, or operational data needs MFA on all accounts: not just email. This closes a common gap where MFA is applied to email but not to the cloud storage, CRM, or document platform that holds your most valuable information.
MFA on VPN connections
VPN access: both from the internet and from the corporate network: must be protected by MFA. Not applicable if your organisation doesn't use VPN.
MFA on RDP connections
Remote Desktop Protocol connections must be protected by MFA. Both internet-facing and internal RDP connections are in scope. Not applicable if your organisation doesn't use RDP.
Enhanced backup and recovery strategy
Platinum significantly extends the backup requirements from Gold. Backups must run at least weekly (ideally daily), retain at least 6 months of history, be aligned to your digital asset register, and include a tested restoration plan validated at least once per year. A register of where backups are stored and who can access them is also required.
The SMB1001 standard has 39 requirements across five tiers. Each tier includes the one before it, so the running totals are 7, 17, 27, 32 and 39. The CyberGrape platform tracks 52 control codes, because enhanced variants of a requirement are counted separately. Requirements are from SMB1001:2026, published by Dynamic Standards International.
How CyberGrape gets you to Platinum.
We prepare your evidence, complete the certification, submit it and manage it as it renews. The certificate is issued by CyberCert.
- 01
See where you stand
We check your connected tools and answers against each requirement and show what is covered and what is not.
- 02
Fix what matters first
Gaps become tracked actions with owners and dates, starting with the ones that block the certificate.
- 03
Prepare the proof pack
Dated evidence and documents are gathered so the auditor has what they need.
- 04
Prepare for the independent audit
We help you get ready for the audit. The audit has a separate external fee.
- 05
Submission and certificate
We complete the certification and submit it to CyberCert, which issues the certificate.
CyberGrape is a licensed partner of CyberCert, certification authority for Dynamic Standards International (DSI), the publisher of the SMB1001 standard.
Certificates are issued by CyberCert against the SMB1001 standard published by Dynamic Standards International. CyberGrape prepares and submits your evidence but does not issue the certificate.
Common questions about Platinum.
Who checks. At Gold a director attests. At Platinum an independent auditor verifies your proof. Platinum also adds requirements for remote access, cloud logins and backup testing.
The audit carries a separate external fee, charged by the auditor and not by CyberGrape. We will help you plan for it.
Two to three months, with a separate external audit fee.
Yes, because Platinum includes everything in Gold. You still need to meet every Gold requirement as well as the new ones.
Compare the tiers
Platinum is the first tier with an outside check. Compare it with the rest.