A multi-tiered cybersecurity certification standard for small and medium-sized businesses.
Release date - 1 September 2025.
Read our License Agreement.
The SMB1001 cybersecurity standard provides a practical, cost-effective, and scalable solution specifically designed to meet the needs of small and medium-sized businesses (SMBs).
Offering an affordable, multi-tiered certification pathway, SMB1001 enables businesses to demonstrate their cybersecurity maturity while effectively addressing evolving threats.
Flexible & Multi-Tiered
Offers a flexible, tiered approach, allowing businesses to start at the right cybersecurity level based on their needs and resources.
Annually Updated
Is regularly updated to ensure continued relevance in a rapidly changing threat landscape.
The Global Standard for SMBs
SMB1001 is a borderless security framework designed to provide a globally unified language of digital trust. Aligned to global best practices with practical accessibility, it empowers SMBs to scale and trade internationally with a universally recognized standard.
Supports Trusted Advisors
Supports IT providers and managed service providers (MSPs) by offering a consistent framework for cybersecurity certification.
Simplifies Supplier Assurance
Provides governments and large enterprises with confidence that SMB suppliers meet cybersecurity requirements.
SMB1001 was developed to bridge the gap between the critical need for digital defense and the practical limitations faced by smaller organizations. In today’s digital age, cybersecurity has shifted from a luxury to a necessity for small and medium-sized businesses (SMBs). The standard addresses three primary challenges:
Practicality and Cost: Traditional standards like ISO/IEC 27001 often require fully implemented management systems that demand significant financial and human resources, making them impractical for many SMBs.
Agility: While many certifications are only updated every few years, SMB1001 is designed to keep pace with a rapidly changing threat landscape to ensure businesses don't remain exposed to evolving risks.
Scalability: SMB1001 provides a flexible, multi-tiered pathway that allows businesses to improve their security maturity over time without losing the progress of their previous efforts.
Unlike regional or overly rigid frameworks, SMB1001 is uniquely designed for universal relevance. It stands as the only cybersecurity standard specifically tailored for SMBs that is globally applicable, providing a consistent language of trust for businesses operating in any market across the world.
SMB1001 is a multi-tiered cybersecurity certification standard comprising five levels, each progressively increasing in complexity and maturity.
This structure allows SMBs to begin at the level that best matches their current context and cybersecurity posture. They are not required to complete all five levels, providing flexibility in how they approach their cybersecurity journey.
The logos used are trademarks of their respective owners.
SMB1001 has been mapped to and aligns with leading international guidelines, frameworks, and standards, such as the United Kingdom’s Cyber Essentials, and the United States’ CIS Controls and CMMC.
This means that SMBs who begin working towards the requirements of SMB1001 will also be starting their journey towards aligning with these globally recognized frameworks and standards.
See how MSPs and IT Providers are using SMB1001 to streamline cyber certification, boost client trust, and build authentic cyber resilience.
CAP for MSPs
Daniel Johns
MyCISO
Michael Lester
Catalytic IT
Fiona Long
Assuredly
Beau Dean
Shadow IT
Luke Irwin
Aegis Cyber
Arno Brok
Semaphore Consulting Partners
Troy Adams
TechPath
Michael Gibby
SEQ IT
Reece Appleton
Huntress
Regan Vaudrey
Process Ops
Peter Soulsby
Brennan
SMB1001 is based on a ‘People, Process, Technology’ approach to managing cyber risk and cover five (5) core areas of focus.
Each of these areas is developed by considering common elements found in leading international cybersecurity guidelines and recommendations. These areas and their supporting controls also address common gaps and the “essential” controls recognized in global industry surveys.
This 5-tiered structure ensures that SMBs can build their cybersecurity gradually while meeting the demands of their clients and regulatory requirements. Within each level, SMBs address critical areas such as:
Technology Management
This involves overseeing and securing all technology assets within the business, such as hardware, software, and networks. Effective technology management ensures that systems are up to date, vulnerabilities are patched, and security configurations are properly maintained.
Access Management
Ensures that only authorized personnel have access to sensitive data and systems. This includes implementing strong password policies, introducing multi-factor authentication, and monitoring user activity to prevent unauthorized access.
Backup & Recovery
Regularly backing up critical data and having a recovery plan in place to restore systems after a cyber incident. Backup and recovery strategies are crucial for minimising downtime and data loss in the event of a breach or system failure.
Policies, Plans & Procedures
Establishing clear cybersecurity policies, procedures, and contingency plans. These define how the organization manages its cybersecurity risks, including how to respond to incidents and how to protect sensitive information.
Education & Training
Ongoing cybersecurity training for all employees to ensure they are aware of the latest threats and best practices. A well-informed workforce is a key line of defence in preventing security incidents caused by human error.
1-20 employees
21-200 employees
201-1000 employees
1000+ employees
per department
Within platforms for service delivery
Your purchase helps support the operational costs of managing the standard. Thank you. 🙏
SMB1001 is a multi-tiered cybersecurity certification standard. This standard comprises of five tiers that support an organization in their journey of developing their cyber security hygiene.
SMB1001 provides organizations of any sector with guidance for developing their cybersecurity hygiene. This standard has a particular awareness of small and medium-sized businesses with their needs and resources being considered in the development of SMB1001.
Meeting the tiers of SMB1001 indicates that an organization has implemented good cybersecurity measures.
Adopting SMB1001 enables organizations to proactively manage the likelihood and impact of cyber threats, establishing a resilient security baseline. This robust foundation can then serve as a direct, streamlined path toward meeting the comprehensive requirements of ISO/IEC 27001.
As a dynamic standard, SMB1001 is updated annually by industry experts, ensuring it remains aligned with the ever-changing cyber threat landscape. Unlike many other standards that don’t update as frequently, SMB1001 regularly updates to help SMBs stay current with best practices and maintain a mature cybersecurity posture over time.
In the global marketplace, cybersecurity is no longer just a technical requirement, it is a strategic border crossing. SMB1001 is the only globally applicable standard specifically designed to give smaller organizations the credentials they need to compete on a world stage.
By transforming security from a barrier into a “ticket to trade,” the SMB1001 five-tier system empowers businesses to:
Procurement processes and international contracts increasingly demand proof of cyber maturity. While traditional enterprise-grade certifications can be an impractical barrier for smaller firms, SMB1001 levels the playing field. It provides a tailored, multi-tiered framework that proves your business is ready for global commerce.
Whether SMB1001 is your final destination for robust security or a modular foundation for other optional global standards, it ensures your business is never locked out of an opportunity due to a lack of certification.
For the IT Providers all over the world, Managed Service Providers (MSPs), and Managed Security Service Providers (MSSPs) that support the millions of SMBs, SMB1001 offers a consistent framework for taking their clients on a pathway to affordable cybersecurity certification.
The tiered approach allows providers to offer scalable services, adapting their cybersecurity solutions to meet the current and future needs of their clients. As a certifiable standard, it also simplifies compliance, reducing the complexity involved in guiding SMBs through their cybersecurity certification journeys.
Governments and major corporations now view cybersecurity as a non-negotiable “ticket to trade,” requiring rigorous assurance that every link in their supplier network is secure.
SMB1001 bridges the gap between enterprise expectations and small business capabilities by providing:
Verified Resilience: It offers a fit-for-purpose, dynamic standard that significantly reduces systemic risk across global supply chains.
A Universal Language of Trust: As the only globally applicable standard of its kind, it gives large entities the confidence that their international partners meet recognized benchmarks.
Future-Proof Security: Because it is annually updated, SMB1001 ensures suppliers stay ahead of evolving threats rather than relying on outdated certifications.
Scalable Compliance: It provides a structured, multi-tiered framework that allows smaller partners to demonstrate maturity without the prohibitive costs of large-scale enterprise systems.
By adopting SMB1001, organizations don’t just meet a requirement, they secure their position as a trusted, long-term partner in the global economy.
What is DSI?
DSI stands for Dynamic Standards International. We are a not-for-profit organization that develops dynamic cybersecurity standards to help small and medium-sized businesses (SMBs) improve their cybersecurity practices and protect their data.
What is SMB1001?
SMB1001 is a multi-tiered cybersecurity certification standard created by DSI globally for small and medium-sized businesses. SMB1001 helps these businesses improve their cybersecurity in a manageable and affordable way.
Why is cybersecurity important for SMBs?
Cybersecurity is crucial for SMBs because they are often targets of cyber-attacks. Good cybersecurity practices help protect sensitive data, ensure business continuity, and build trust with customers and partners.
How many levels are there in SMB1001?
There are five levels in the SMB1001 standard:
Each level has specific requirements that help businesses progressively improve their cybersecurity.
What are the main areas covered by SMB1001?
SMB1001 covers five key areas:
1. Technology Management
2. Access Management
3. Backup and Recovery
4. Policies and Processes
5. Education and Training
What are the benefits of SMB1001?
How does SMB1001 compare to other cybersecurity standards?
SMB1001 is designed to be more affordable and easier for SMBs to adopt compared to enterprise-level standards such as ISO/IEC 27001. While ISO/IEC 27001 is the global benchmark for large-scale information security management, SMB1001 provides a practical and structured pathway for smaller organizations to gradually improve their cybersecurity maturity.
By aligning with the foundational requirements of international frameworks like the UK’s Cyber Essentials and the U.S. CIS Controls, SMB1001 allows businesses to build a robust security posture without the complexity and resource overhead typically associated with enterprise standards.
Where can I obtain certification for this Standard?
As the standard-setting body, Dynamic Standards International (DSI) maintains the integrity and development of the SMB1001 Standard but does not issue certifications directly. This ensures a transparent, third-party validation process consistent with international best practices.
Certification is managed by authorized Dynamic Standard Certifiers (DSCs). Currently, CyberCert is the official DSC for SMB1001. They provide the global digital platform required to assess your business and issue certification upon meeting the Standard’s requirements.
How does SMB1001 differ from other frameworks like ISO/IEC 27001?
Unlike traditional frameworks designed for large-scale enterprises, SMB1001 is purpose-built for the small and medium business ecosystem. While standards such as ISO/IEC 27001 or the US Cybersecurity Maturity Model Certification (CMMC) are often the benchmark for global corporations, they frequently include complexities and overhead that are not relevant or accessible for smaller organizations.
The SMB1001 Advantage:
The primary difference is intent. While enterprise standards aim for universal complexity, SMB1001 delivers a tiered, SMB-centric architecture that provides high-level security through a lens of practical business logic.
What are some basic requirements of Level 1 compliance?
For Level 1, businesses need to: