SMB1001 certification readiness
At Bronze, Silver and Gold, a director of the client signs a declaration that the SMB1001 controls are in place. At Platinum and Diamond, an independent auditor checks for themselves.
Either way, the statement has to be true on the day and stay true after it. We get the client there at the tier they’re aiming for: technical controls configured, policies written for them to adopt, and the evidence gathered and filed.
The director declares that:
- Multi-factor authentication is enforced for every account. Including the shared reception mailbox, the scanner’s service account and the admin account left over from setup?
- Business data is backed up and can be restored. When was a restore last tested, and is the record of it anywhere?
- Software and devices are kept up to date. The firewall, the NAS and the laptop that last checked in months ago count too.
- Staff have completed security awareness training. Who, and when? A session nobody recorded is hard to stand behind.
Signing this is a personal statement, so it needs evidence behind it.
Five tiers, each built on the one below
SMB1001 runs from Bronze to Diamond. Each tier includes every requirement of the tiers below it and adds its own, so a client going for Gold is also meeting Bronze and Silver in full.
The standard is revised from time to time, and requirements can move between tiers from one edition to the next. We work to the edition the client will certify against.
The biggest change sits between Gold and Platinum. Up to Gold, a director attests. From Platinum, an independent auditor looks, so the evidence has to make sense to someone who wasn’t there when the work was done.
- Tier 1Bronze
- Tier 2Silver
- Tier 3Gold
- Tier 4Platinum
- Tier 5Diamond
Choosing the tier
Often someone else has already chosen it: a customer’s supplier requirements, a tender, an insurer’s questions. Start from that, and from the exact wording they use.
Where the client does have a choice, we’d point them to the tier they can keep running all year, rather than the highest one they could reach once. Controls that lapse after the certificate arrives leave the declaration untrue.
The gaps we usually find
Most clients looking at SMB1001 believe they already do most of it, and they’re usually close. The remaining work is the gap between “mostly” and “every”. These are the usual places we find it.
-
“We have policies.”
A template pack downloaded years ago, with another company’s name still in the footer, that nobody has read. A policy has to describe what the client does in practice, and be approved by someone with the authority to approve it.
-
“Our email is protected.”
An SPF record that has grown past its lookup limit, DKIM not signing for the service the client sends from, and DMARC left at monitoring-only since the day it was published.
-
“Leavers are removed.”
The Microsoft 365 account is disabled. The login to the accounting software, the supplier portal and the building alarm app are not, because each has its own.
-
“Nobody has admin rights.”
Except the staff given local admin to install something during a busy week, and the owner, whose everyday account is also a global administrator.
-
“We know what devices we have.”
The register lists the laptops. It doesn’t list the phones receiving company email, the NAS in the comms cupboard or the PC that runs the reception software.
-
“There’s an incident response plan.”
It exists. Nobody outside IT has read it, the phone numbers are out of date, and it assumes email still works on the day the client needs it.
Ready means three things agree
What’s configured in the systems, what the policy says and what the records show. A gap between any two of them is where a declaration goes wrong, and it’s exactly what an auditor at Platinum or Diamond is there to find. We work each requirement until all three line up.
| Requirement | Configured | Written down | On record |
|---|---|---|---|
| Multi-factor authentication | Enforced for every user in the identity platform, with each exception named and justified. | The access control policy says who needs it, by what method, and who can approve an exception. | The enforcement settings as exported, and the excluded accounts with the reason for each. |
| Backups | Jobs covering the data that matters, with backup credentials kept apart from everyday admin. | The backup policy sets what is kept, how often and for how long. | Recent job reports and a dated record of a test restore that worked. |
| Security awareness | Training assigned to everyone, including new starters from their first weeks. | The policy says how often training happens and who makes sure it does. | Completions by name and date. |
| Incident response | The contacts, accounts and access the plan depends on still work when the usual systems don’t. | A plan the client has adopted, naming who decides and who to call. | The approved version, its date and when it was last reviewed. |
What the client ends up with
-
Controls in place for the target tier
Configured in the client’s own systems and checked against each requirement at that tier.
-
A policy set for the client to adopt
Written in plain language to describe how this client works, ready for them to review, change and approve.
-
An evidence pack for certification
Filed requirement by requirement and dated: settings, reports, records and approvals. It’s what the director signs against, or what the auditor asks to see, and where the next renewal starts.
-
A readiness summary
Where the client stands against every requirement at the tier, anything still open and who owns it, so nobody signs on an assumption.
Hand us the readiness work
Delivered remotely as a white-label project, under your brand or as your named partner, at a fixed price for the agreed scope. You keep the client, and the ongoing work of keeping the controls running between renewals.