Level 2 · Silver · Director-attestedControl who gets in and how money moves.
Silver builds on Bronze with the measures that protect accounts and payments. It suits a business that handles client money or data and wants its rules written down and followed.
- Requirements so far
- 17 of 39
- Checked by
- Director-attested
- Valid for
- 12 months
- Typical time
- Weeks
Four questions before you commit to Silver.
Who needs Silver?
Silver suits a business where one stolen password or one fake invoice would hurt.
- A firm that pays suppliers or sends invoices by email.
- A business with staff sharing logins or holding more access than they need.
- A supplier whose customer asks about sign-in protection.
What does it ask of you?
Ten more requirements on top of Bronze, mostly about accounts and people.
- Two-step sign-in on every email account.
- A password manager, and no shared logins.
- Staff without admin rights on their own accounts.
- Email set up so others cannot pose as your domain.
- An invoice fraud procedure, confidentiality agreements and a visitor register.
What will it take?
Usually weeks. The effort is in changing habits, not in buying tools.
- Two-step sign-in and a password manager need staff to adopt them.
- The procedures can start from templates in the platform.
- A director signs off at the end.
What proof is needed?
A director confirms the measures are in place, backed by sign-in and email settings from your tools.
- Reports showing two-step sign-in is on for email accounts.
- Your email protection settings.
- Signed copies of the invoice fraud procedure and confidentiality agreements.
What is new or raised at Silver, in plain words.
Each tier includes everything below it. These are the requirements Silver adds or raises to a higher standard.
TLS certificates on public websites
Every public-facing website your business operates needs a valid SSL/TLS certificate from a trusted authority. This encrypts data in transit and is now a baseline expectation from browsers, search engines, and customers.
Servers updated and patched
Servers: whether on-premises, cloud-hosted, or managed by a third party: need a documented patching schedule. Critical patches must be applied within 14 days of release. The schedule can't run longer than 6 months.
No admin privileges for standard accounts
Staff who don't need to install software shouldn't have admin rights. This limits the damage an attacker can do if they compromise a standard employee account. Applies to both local and domain accounts.
Individual user accounts for all employees
Every employee must have their own login. No shared accounts, no shared passwords. This makes it possible to trace activity, revoke access when someone leaves, and hold individuals accountable.
Password manager system
Privileged users must use a centralised, enterprise-grade password manager with MFA, role-based access control, and audit logging. This is the infrastructure that makes strong, unique passwords actually workable across a team.
MFA on all employee email accounts
Email is the single most attacked entry point for SMBs. Multi-factor authentication on every email account: including admin accounts: means a stolen password alone isn't enough to get in.
Email authentication and anti-spoofing (SPF)
Configure Sender Policy Framework (SPF) on every domain you use to send email. This prevents attackers from sending emails that appear to come from your domain: a common tactic in invoice fraud and phishing attacks.
Confidentiality agreements
All staff, contractors, and third parties must be bound by confidentiality obligations before accessing organisational data or systems. This can be a signed NDA or a confidentiality clause in their contract.
Invoice fraud policy and procedures
Invoice fraud: where attackers redirect payments to their own accounts: is one of the most financially damaging cyber crimes for SMBs. Silver requires a documented policy with dual-verification for bank account changes and sign-off thresholds for large transactions.
Visitor register
A written or digital register logging all visitors and contractors who enter staff-only areas. Records name, organisation, contact details, signature, and check-in/out times. Must be retained for at least six months.
The SMB1001 standard has 39 requirements across five tiers. Each tier includes the one before it, so the running totals are 7, 17, 27, 32 and 39. The CyberGrape platform tracks 52 control codes, because enhanced variants of a requirement are counted separately. Requirements are from SMB1001:2026, published by Dynamic Standards International.
How CyberGrape gets you to Silver.
We prepare your evidence, complete the certification, submit it and manage it as it renews. The certificate is issued by CyberCert.
- 01
See where you stand
We check your connected tools and answers against each requirement and show what is covered and what is not.
- 02
Fix what matters first
Gaps become tracked actions with owners and dates, starting with the ones that block the certificate.
- 03
Prepare the proof pack
Dated evidence and documents are gathered in the form the certifier expects.
- 04
Sign-off and submission
A director signs off. We complete the certification and submit it to CyberCert, which issues the certificate.
CyberGrape is a licensed partner of CyberCert, certification authority for Dynamic Standards International (DSI), the publisher of the SMB1001 standard.
Certificates are issued by CyberCert against the SMB1001 standard published by Dynamic Standards International. CyberGrape prepares and submits your evidence but does not issue the certificate.
Common questions about Silver.
Yes. Each tier includes the one below, but you do not need to certify at Bronze first. The free assessment shows which tier fits.
Getting everyone onto two-step sign-in and a password manager. The technical settings are quick. The habit change takes longer.
No. Silver is director-attested. The certificate is issued by CyberCert.
It gives you evidence for the sign-in and email questions clients commonly ask. It does not replace a questionnaire a client insists on.
Compare the tiers
Silver adds accounts and payments. See what comes before and after.