SMB1001 Bronze Compliance

Overview

SMB1001 Bronze is the entry-level tier of the CyberCert SMB1001 cybersecurity certification framework, developed by Dynamic Standards International.

It covers foundational controls: firewalls, antivirus, automatic updates, password policies, backups, and device security.

Certification is achieved through director self-attestation with no external audit required.

Bronze addresses the most common attack vectors targeting small businesses and establishes a baseline for progressive improvement.

It serves as the first step in a five-tier progression: Bronze, Silver, Gold, Platinum, and Diamond.

Key Areas

• Firewall installation and configuration on all internet-facing connections
• Antivirus and anti-malware software deployed on all endpoints
• Automatic system updates enabled across operating systems and applications
• Routine password changes enforced for all user accounts
• Basic data backup strategies with regular backup schedules
• Device security measures including screen locks and encryption
• Engagement with technical support for IT issues and security concerns
• Basic password policies establishing minimum complexity requirements

Who It's For

• Micro businesses and sole traders taking their first step into cybersecurity
• Small businesses without dedicated IT staff or security expertise
• Organisations that need to demonstrate basic cybersecurity to clients or insurers
• Businesses in supply chains where partners are beginning to require security evidence

Core Requirements

Policies and Governance

At the Bronze level, formal policy documentation is minimal. The primary governance requirement is that a company director acknowledges and attests to the implementation of required controls. This creates accountability at the leadership level without requiring extensive documentation.

Risk Management

Bronze does not require a formal risk assessment. However, organisations should understand the basic threats facing their business: phishing, ransomware, and data loss. The controls at this tier are designed to mitigate these common risks without requiring a structured risk management process.

Security Controls

The technical controls are foundational: firewalls protecting network boundaries, antivirus on all devices, automatic updates to patch known vulnerabilities, and basic backup procedures. These controls address the most frequently exploited attack vectors targeting SMBs.

Incident Response

Bronze requires basic awareness of what to do if a security incident occurs. This includes knowing who to contact (IT support, managed service provider) and understanding that incidents should be reported rather than ignored. A full incident response plan is not required at this tier.

Evidence and Reporting

Evidence at Bronze is primarily the director's self-attestation confirming that controls are in place. There is no requirement for detailed evidence collection, screenshots, or configuration documentation at this tier.

Implementation Steps

1. Assess current state - Review existing IT setup to identify whether firewalls, antivirus, and automatic updates are already in place. Many SMBs will find some of these controls are partially implemented but not consistently applied across all devices and systems.
2. Deploy foundational controls - Install or verify firewalls on all internet connections, deploy antivirus software on every endpoint, enable automatic updates for operating systems and key applications, and establish a regular backup schedule for critical business data.
3. Establish password practices - Implement a basic password policy requiring minimum complexity and routine changes. Ensure all user accounts, particularly those with access to sensitive data or systems, comply with the policy.
4. Secure devices - Enable screen locks, disk encryption where available, and ensure devices are physically secured. This applies to desktops, laptops, tablets, and mobile devices used for business purposes.
5. Director attestation - The company director reviews the controls in place and signs the self-attestation confirming compliance with Bronze requirements. Submit the attestation to CyberCert to receive Bronze certification.

Frequently Asked Questions

How quickly can we achieve Bronze certification?

Most organisations can achieve Bronze within days to a couple of weeks. If firewalls and antivirus are already in place, it is primarily a matter of verifying coverage across all devices and completing the director attestation.

Does Bronze require an external audit?

No. Bronze certification is based entirely on director self-attestation. No external auditor or third-party review is required.

Is Bronze certification meaningful?

Yes. While it covers foundational controls, these controls address the most common attack vectors targeting SMBs. Many successful cyberattacks exploit the absence of exactly these basic protections.

What comes after Bronze?

Silver certification builds on Bronze by adding multi-factor authentication, employee training, and enhanced access controls. The progression from Bronze to Silver is the natural next step.

How much does Bronze certification cost?

Certification fees are designed to be accessible for SMBs. The primary investment is ensuring controls are in place. Contact CyberCert for current pricing.

Why It Matters

• Small businesses are disproportionately targeted by cybercriminals because they often lack basic protections. Bronze certification addresses this by ensuring the most fundamental defences are in place, closing the gap between no security and structured security.
• Supply chain partners and customers increasingly ask for evidence of cybersecurity practices. Even at the Bronze level, certification provides a credible signal that the organisation takes security seriously and has implemented baseline protections.
• Cyber insurance providers are beginning to factor certification into underwriting decisions. Bronze certification may help SMBs qualify for cyber insurance or secure better terms by demonstrating that basic controls are in place.

Common Challenges

• Organisations may assume these basic controls are already in place when they have not been verified across all devices and systems
• Employees using personal devices for work may not have antivirus or automatic updates enabled
• Backup strategies that have never been tested may fail when actually needed
• Password policies can meet resistance from staff accustomed to simple or shared passwords
• The perception that Bronze is too basic to be worthwhile, when it actually addresses the most common attack vectors