SMB1001 certification readiness, tracked per client
SMB1001 is becoming the cyber certification Australian small businesses are asked about. For an MSP it is a repeatable service: baseline each client, close the gaps, and hand the assessor a clean evidence pack.
What SMB1001 is
SMB 1001 is a cyber security standard for small and medium businesses published by Dynamic Standards International. It is organised into tiers, from Bronze through to Diamond, so a business can start with the basics and step up as it matures. Certification is carried out through accredited assessment channels, such as CyberCert.
Where Graften helps
Graften's SMB1001 Certification screen tracks 38 controls across the tiers for each client and shows readiness for the tier the client is aiming at.
| Control type | How Graften handles it |
|---|---|
| Measurable from connected systems (14 controls today, for example MFA coverage, endpoint protection, conditional access, backup and disaster recovery readiness, and phishing and awareness training results) | Verdict calculated from live data. Where a signal only covers part of what a control requires, the verdict is capped at partial rather than compliant. |
| Policy, plan and governance items (24 controls, such as written policies, incident response plans and penetration tests) | Left as not assessed until a technician sets the status, with an evidence note. Graften does not invent a verdict for paperwork it cannot see. |
Stale evidence is not evidence. A measurement older than 90 days stops counting. The control shows as not assessed with the date of the last measurement, so an old audit cannot keep producing a fresh-looking pass.
Readiness that doesn't flatter
Tier readiness is the share of all applicable controls in the tier that are compliant, not the share of the ones that happened to be assessed. A client with one assessed control does not read as one hundred percent ready.
An evidence pack for the assessor
Download the SMB1001 evidence pack or email it to the assessor straight from the platform. It carries each control's status, the evidence behind it and when it was last measured, for the specific client being certified.
Frequently asked questions
Does Graften certify a business for SMB1001?
No. Certification is awarded through accredited assessors. Graften tracks readiness and assembles the evidence for them.
Why are some controls shown as not assessed?
Controls that depend on documents, plans or manual testing cannot be measured from connected systems. They stay not assessed until a technician records the status, which keeps the readiness figure honest.
Can I sell this as a recurring service?
Yes. Readiness updates as audits run, so the same view supports an initial gap assessment, the remediation work, and ongoing monitoring between certification renewals.