SMB1001 gives Australian small and medium businesses (SMBs) a clear, tiered path to strengthen cybersecurity readiness and show progress through certification. Many of its controls address how businesses manage access, from passwords and multifactor authentication (MFA) to onboarding and deprovisioning accounts. Password managers like Bitwarden can help Australian businesses put those access controls in place and keep them documented as they pursue certification.
SMB1001 is a tiered cybersecurity standard created in Australia by Dynamic Standards International for small and medium businesses. It is now available internationally, with certification administered by CyberCert.
Five tiers make up the standard: Bronze, Silver, Gold, Platinum, and Diamond. Each one builds on the last, with increasingly advanced cybersecurity requirements. Businesses can begin at the level appropriate to their needs and resources without first completing each preceding tier.
Verification scales, too. At Bronze, Silver, and Gold, a company director attests through the CyberCert portal that controls are in place. Platinum and Diamond add an independent external audit.
The result is a practical alternative to enterprise frameworks like ISO 27001. Australian businesses improve readiness in steps that fit their resources, risk, and business requirements, without the cost and complexity of a full enterprise program.
The standards body also maps SMB1001 to other frameworks, including the Australian Essential Eight, ISO 27001, UK Cyber Essentials, and the US Cybersecurity Maturity Model Certification. Those mappings show organizations where their work overlaps as security and compliance programs grow.
Several factors are driving interest in SMB1001, including commercial expectations, guidance from professional bodies, and industry proposals around procurement and supply chain security.
Customers, cyber insurers, and government or enterprise supply chain partners may ask Australian SMBs to show evidence of baseline cybersecurity controls. SMB1001 gives managed service providers (MSPs) a recognized standard for answering those requests and turning them into a clear plan.
The Queensland Law Society formally supports SMB1001 as a framework that helps law firms strengthen cyber resilience and demonstrate due diligence to clients, insurers, and regulators. Its recommendation is specific: members should work toward Gold certification as a reasonable standard for robust cybersecurity and professional assurance. That gives firms a clear target to build toward.
“Law firms have an ethical duty to take reasonable steps to protect the confidentiality of client information. Unfortunately, criminals won’t wait for the day you have time to sort it out—and being a small practice is no defence. SMB1001 provides an accessible, cost-effective foundation to strengthen your firm’s cybersecurity position and demonstrate your commitment to client care.”
– David Bowles, Special Counsel, Ethics, Queensland Law Society
In February 2024, Dynamic Standards International, then trading as Cyber Security Certification Australia, made a formal submission to the Department of Home Affairs. It recommended referencing SMB1001 in critical infrastructure risk management guidance and using it as a procurement requirement for governments and large organizations.
The Cyber Security Act 2024 does not name SMB1001. The submission reflects an industry recommendation rather than government policy or endorsement. For businesses, certification provides documented evidence that can be shared with customers and procurement teams.
Access is a natural place to start building that evidence. Access management is one of the five control domains in SMB1001, and many of its requirements address how a business manages credentials. Bitwarden Password Manager supports each of these areas:
MFA enforcement. SMB1001 requires MFA for email accounts at Silver and extends that requirement to cloud business applications at Gold. Bitwarden Enterprise policies can require two-step login for users within a Bitwarden organization, while the integrated authenticator generates time-based one-time passwords (TOTP) for compatible applications, helping businesses support MFA requirements at both tiers.
Stronger password practices. Built-in password generation and enterprise policies enable users to create strong, unique passwords that meet defined requirements for every account, supporting SMB1001 password controls in the access management domain.
Less credential sprawl. Secure sharing through a centralized organization vault reduces reliance on shared spreadsheets, sticky notes, and inboxes, making credential access easier to control and document. Centralized administration and event logs help businesses maintain records of credential access and administrative activity.
Structured access governance. Login with single sign-on (SSO), available on Bitwarden Enterprise plans, and automated user provisioning through System for Cross-domain Identity Management (SCIM) help businesses manage authentication, onboarding, and deprovisioning accounts within their organizations.. These capabilities enable more consistent access administration as businesses strengthen their security practices on the path to Gold.
Ongoing visibility. For enterprise companies, Access Intelligence identifies weak, reused, or exposed credentials owned by the organization, including MSPs with appropriate administrative access. That visibility supports ongoing security reviews and annual SMB1001 recertification.
SMB1001 moves businesses forward in stages. Bronze establishes foundational preventive controls, while Silver and Gold introduce broader security requirements and more comprehensive approaches to managing cyber risk.
SMB1001 also requires annual recertification, so those controls must continue to work year after year. That makes password and access management a persistent requirement for recertification rather than a one-time implementation.
An MSP supports a business throughout that process by:
Assessing current readiness against the target tier
Prioritizing improvements
Documenting how the business implements each control
Preparing for certification and annual recertification
With Bitwarden, MSPs manage client organizations from a multi-tenant platform, ensuring businesses maintain access controls and continue strengthening their security practices over time.
Certification depends on how each business implements and documents its own controls. The tools that protect credentials matter, too. Bitwarden is built on trusted open source code that anyone can inspect, and independent firms audit regularly. Bitwarden uses zero-knowledge, end-to-end encryption to protect vault data, so only users can access it.
No. SMB1001 is a voluntary certification, and the Cyber Security Act 2024 does not name it. Some customers, insurers, and industry bodies like the Queensland Law Society reference it as a benchmark for baseline cybersecurity readiness.
No. CyberCert issues SMB1001 certification. Bitwarden Password Manager supports the access management controls a business implements and documents as part of that process.
Every year. SMB1001 certification is valid for 12 months, and Dynamic Standards International updates the standard annually. Each renewal follows the current edition, so organizations should conduct an annual review of access controls to keep certification on track.
SMB1001 certification renews every year, and the access controls a business puts in place today can support future renewals. For Australian businesses building toward certification, a free trial of Bitwarden for business is an easy first step. For MSPs guiding clients through certification, the Bitwarden partner program offers usage-based pricing, consolidated billing, and multi-tenant management.