Most small businesses know they should improve cyber security.
The problem is knowing where to start.
Many frameworks are written for large enterprises with dedicated security teams. Standards like ISO 27001 can feel overwhelming for small businesses that simply want to protect their systems, keep customer data safe and meet supplier expectations.
That’s exactly why SMB1001 exists.
It’s a cyber security certification framework designed specifically for small and medium-sized businesses, offering a five-tier pathway that allows organisations to start small and build stronger protection over time – the first step on that journey is SMB1001 Bronze (Level 1).
What is SMB1001 Bronze?
SMB1001 Bronze focuses on the foundational cyber hygiene controls every small business should have in place.
The goal isn’t perfection.
The goal is getting the basics right.
At Bronze level, the standard introduces a small set of essential protections that reduce the risk of common cyber incidents. These controls focus on:
technology protection
secure access
data resilience
staff awareness
For organisations with limited resources or early-stage security, this tier provides a clear and achievable starting point.
The seven foundations of SMB1001 Bronze
SMB1001 Level 1 includes seven core controls across four key domains.
1. Engage a technical support specialist
Small businesses rarely have an internal security team.
The standard recommends working with a trusted IT or cyber security provider who can help manage systems securely.
This ensures someone is responsible for:
maintaining systems
implementing security controls
responding to incidents
For many organisations, this means partnering with a managed service provider (like Black Swan).
2. Install and configure a firewall
A firewall controls traffic entering and leaving your network.
Properly configured firewalls help prevent:
unauthorised access
exposed services
attackers scanning your systems
Even simple misconfigurations can expose businesses to risk.
3. Install antivirus or anti-malware protection
Every device used by the business should have security software installed and actively updating.
This includes:
desktops
laptops
servers
business mobile devices
These tools help detect and block known malware threats.
We recommend Heimdal and Huntress for SMB1001
4. Automatically install security updates
Unpatched software is one of the most common entry points for cyber attacks.
SMB1001 requires organisations to ensure operating systems and applications receive regular updates and patches automatically.
This dramatically reduces the attack surface.
We recommend Heimdal Patch & Asset Management
5. Maintain strong password hygiene
Weak passwords remain one of the easiest ways for attackers to gain access.
SMB1001 recommends:
strong passphrases
unique passwords
regular password changes after incidents
secure configuration of devices and routers
Simple changes here can block a large number of attacks.
6. Implement a backup and recovery strategy
Every organisation relies on digital data.
Emails, documents, financial records, customer details.
SMB1001 requires businesses to maintain reliable backups, including at least one offline or isolated copy so data can be restored after incidents such as ransomware.
Without backups, recovery becomes extremely difficult.
We recommend Axcient for servers and endpoints and Connectwise Cloud Backup for M365.
7. Provide cyber security awareness training
People remain a critical line of defence.
Employees should receive basic training on:
recognising phishing emails
reporting suspicious activity
protecting company data
responding to incidents
Even short awareness sessions can significantly reduce risk.
We recommend CyberSmart Learn, Huntress and Usecure
The SMB1001 Cyber Security Ladder
SMB1001 gives small businesses a practical way to improve cyber security in stages. Rather than trying to do everything at once, each tier builds on the last and helps organisations strengthen their cyber posture over time.
| Tier | Focus | What it Adds |
|---|---|---|
| Bronze Level 1 Foundational cyber hygiene | Basic protection for small businesses starting their cyber security journey | Firewall, antivirus, automatic patching, strong password hygiene, backups and cyber awareness training. |
| Silver Level 2 Formalising security practices | Adds stronger access controls and practical policy-based protections | TLS certificates, server patching, separate employee accounts, password manager, MFA on email, email anti-spoofing and key business policies. |
| Gold Level 3 Advanced cyber hygiene | Moves beyond prevention into detection, planning and stronger cyber maturity | EDR, MFA on business applications, VPN-only RDP access, cyber incident response planning, asset registers, cyber policy and AI usage policy. |
| Platinum Level 4 Mature governance and control | Improves resilience with tighter control over access, exposure and recovery | Vulnerability scanning of public-facing assets, stronger MFA coverage, management of remote access cloud credentials and enhanced backup maturity. |
| Diamond Level 5 Advanced cyber resilience | Designed for organisations aiming for a more advanced and defensible cyber posture | Encryption at rest, application control, macro restrictions, penetration and social engineering testing, MDR, supplier trust controls and incident response testing. |
Each tier builds on the previous one, creating a clear maturity path for small businesses.
Why SMB1001 matters for small businesses
Cyber attacks are no longer limited to large enterprises.
Small organisations are frequently targeted because they often lack security controls.
Frameworks like SMB1001 help businesses:
improve security in manageable steps
demonstrate cyber maturity to customers and suppliers
meet growing procurement requirements
reduce the likelihood of costly incidents
The standard is also updated regularly to keep pace with evolving threats, something many traditional frameworks struggle to do.
A practical starting point
Cyber security doesn’t have to begin with complex frameworks or expensive tools.
It starts with strong foundations.
SMB1001 Bronze provides exactly that.
For many small businesses, reaching Bronze level means they already have protection against the majority of everyday cyber risks.
From there, organisations can gradually progress through the tiers as their needs and resources grow.
How Black Swan helps
At Black Swan Cyber Security Solutions, we help small businesses move through the SMB1001 security ladder in a practical and affordable way.
That includes:
implementing Bronze-level security controls
improving cyber hygiene
preparing organisations for higher certification tiers
providing managed detection and response
supporting cyber insurance and compliance requirements
The aim is simple.
Make strong cyber security achievable for small businesses.
For many small businesses, SMB1001 Bronze is the ideal starting point.
It focuses on the practical security foundations every organisation should have in place.
As your business grows, you may choose to progress further up the cyber maturity ladder.
This could include:
- higher SMB1001 tiers
- Cyber Essentials certification
- advanced monitoring and threat detection
At Black Swan Cyber Security Solutions, we help organisations implement the controls needed for both SMB1001 and Cyber Essentials, making the journey toward stronger cyber security far more achievable.
If you’re unsure which framework is right for your organisation, we’re always happy to help you work out the most practical starting point.
Book a call with Black Swan Cyber Security Solutions and take the first step toward Bronze certification.
