One in three small businesses suffered a successful cyber attack in 2025. Average breach costs have hit £200,000. And yet most small business owners still don’t have a clear, affordable path to proving they’re protected. That’s about to change.
The problem with how we’ve done this
I’ve spent twenty years helping small and medium-sized organisations navigate the world of cyber security and here’s the honest truth: the industry has consistently failed SMEs. Not because business owners don’t care – they do. Survey after survey shows that over 90% of SME leaders understand cyber security matters. The failure has been one of approach.
Traditional frameworks were designed for large enterprises with dedicated IT teams, six-figure security budgets and months to spare. Dumping those same expectations on a 5-person accountancy firm in Leeds or a 30-person manufacturer in the Midlands is like handing someone a Formula 1 manual when all they need to know is how to drive safely on the motorway.
Fear has been the dominant message – breach statistics, horror stories, worst-case scenarios and while fear raises awareness, it doesn’t produce action. If anything, it produces paralysis. If a breach is “inevitable,” why invest?
What small businesses actually need is a clear, achievable standard. A certification they can point to. Proof, not promises.
Enter SMB1001 – The cyber roadworthiness certificate for small business
The SMB1001 standard, developed by Dynamic Standards International and administered in the UK through CyberCert, is purpose-built for exactly this challenge. Think of it like the MOT for your business’s cyber security.
Just as drivers aren’t expected to be mechanics – they just need a roadworthy vehicle, business owners aren’t expected to become cyber security experts. They just need to meet a clear, verifiable standard and then get a certificate that proves it.
SMB1001 has five progressive tiers:
Tier | Name | Cost (USD) | Best For |
Bronze | Baseline Hygiene | $95 | Every SME – your starting point |
Silver | Insurance-Ready | $195 | Businesses seeking affordable cyber cover |
Gold | Compliance-Aligned | $395 | Regulated sectors & enterprise suppliers |
Platinum | Internally Hardened | $595 + audit | Tech firms & high-risk operations |
Diamond | Supply Chain Leader | $995 + audit | Healthcare, finance & government suppliers |
The genius of this model is that you start where you are and grow at your own pace. You don’t have to commit to a single, expensive, all-or-nothing programme. Get your Bronze certificate this month. Upgrade to Silver when you’re ready to tackle your cyber insurance renewal. Move to Gold when that enterprise contract requires it.
How does SMB1001 compare to Cyber Essentials?
If you’ve been in business for any length of time, you’ve probably heard of Cyber Essentials – the UK government-backed certification scheme that’s become something of a standard requirement for public sector contracts.
Cyber Essentials is genuinely valuable. It covers five core technical controls and has government backing through the NCSC. If you’re bidding for government contracts, it remains the go-to standard. I’d never tell you to abandon it.
But here’s where SMB1001 offers something different and, for many small businesses, something better:
Lower cost of entry
Cyber Essentials certification typically costs £300–£500 at the basic level — before you factor in the remediation work to get there. SMB1001 Bronze starts at $95 (roughly £75). For cash-strapped small businesses, that difference matters.
Progressive tiers that grow with you
Cyber Essentials offers two levels: Essentials and Essentials Plus. SMB1001 has five, giving you a much clearer roadmap from basic hygiene to supply chain leadership. You’re not choosing between “entry level” and “advanced”, you’re on a journey with clear milestones.
Internationally recognised
SMB1001 is an international standard, meaning certification achieved in the UK carries weight globally. As cross-border supplier requirements become more common, that matters.
Business-enabling, not just compliance-focused
SMB1001 is explicitly designed to help businesses win contracts, reduce insurance premiums and accelerate supplier onboarding – not just tick a regulatory box.
Important caveat: SMB1001 does not currently carry the same government-backed status as Cyber Essentials in the UK. The NCSC endorses Cyber Essentials and for UK public sector contracts, Cyber Essentials remains the required standard. SMB1001 government recognition is growing – Australia is actively exploring adoption and uptake is building across the UK, US, Europe and New Zealand – but it is not yet an NCSC-recognised scheme. If government contracts are your primary goal, Cyber Essentials should still be your first priority. For everything else? SMB1001 is compelling.
What does certification actually involve?
The process is refreshingly practical:
- Complete a guided online questionnaire that maps your current controls against the standard’s requirements
- A company director signs a legal declaration confirming implementation – this creates real accountability without requiring an army of consultants
- Receive a digital certificate and entry in a public registry that partners, insurers and enterprise customers can verify instantly
- Bronze, Silver, and Gold are subject to random independent audits. Platinum and Diamond include a structured independent audit as part of the process
- Annual renewal keeps your certification current as threats evolve
Managed Service Providers (your IT support company, if you have one) are increasingly becoming certified partners, meaning your existing IT relationship may already be your path to certification.
Why this matters right now
The business case for cyber security certification is now as strong as the security case. Enterprise customers are demanding supplier attestations. Cyber insurers are using certification tiers to set premiums and SMBs with verifiable security postures are winning contracts that their uncertified competitors are losing.
Cyber security is no longer just about protecting against bad things. It’s about unlocking good things – contracts, coverage, trust and growth.
Getting started
If you’re a small business owner and your cyber security currently consists of “we have antivirus and we back things up sometimes,” Bronze certification is your next move. It’s affordable achievable, and addresses the controls that prevent 85% of common attacks.
If you’re already doing the basics and facing pressure from insurers or enterprise customers, Silver or Gold may be where you need to be.
And if you’re a managed service provider reading this – certification is your new value proposition. Not “we’ll configure your firewall.” We’ll get you certified.”
The roadworthy revolution is underway. Three hundred million small businesses worldwide need a practical path to cyber security. SMB1001 is building that path, one certificate at a time.
If you would like to get started on this journey, please get in touch.
Learn more at cybercert.ai | Verify certifications at verify.cybercert.ai | MSP partnerships at partners.cybercert.ai
