SMB1001 Gold Compliance

Overview

SMB1001 Gold is the professional tier of CyberCert SMB1001, covering 22-23 controls across five security domains.

The five domains are Technology Management, Access Management, Backup & Recovery, Policies Plans & Procedures, and Education & Training.

Gold is the highest tier achievable through director self-attestation alone, with no external audit required.

It provides comprehensive security governance comparable to foundational enterprise practices, scaled for SMB realities.

Gold is the recommended target for most SMBs and establishes a strong foundation for Platinum or ISO 27001 progression.

Key Areas

• Technology Management: device management, patching, network security, endpoint protection across 6 controls
• Access Management: advanced authentication, privileged access controls, user access policies across 6 controls
• Backup & Recovery: cloud service backups, disaster recovery testing, data restoration procedures
• Policies, Plans & Procedures: confidentiality agreements, incident response plans, security policy documentation, risk management across 8 controls
• Education & Training: formal cybersecurity awareness programme with ongoing staff education
• Network security configurations including segmentation and secure wireless
• Privileged access management limiting administrative rights to authorised personnel
• Documented risk management framework proportionate to organisational size

Who It's For

• SMBs seeking the highest level of certification achievable without external audit costs
• Organisations in regulated industries or supply chains with security governance expectations
• Growing businesses that need structured security management as they scale
• Companies preparing for potential progression to Platinum or transition to ISO 27001

Core Requirements

Policies and Governance

Gold requires comprehensive security policy documentation including information security policies, acceptable use policies, confidentiality agreements, and incident response plans. Management must demonstrate active oversight of the cybersecurity program with defined roles and responsibilities.

Risk Management

A documented risk management framework is required at Gold. This includes identification of key information assets, assessment of threats and vulnerabilities, documented risk treatment decisions, and periodic review. The framework should be proportionate to the organisation's size and complexity.

Security Controls

All Bronze and Silver controls remain required. Gold adds network security configurations, privileged access management, endpoint detection capabilities, cloud backup procedures, and disaster recovery testing. Controls span all five domains ensuring balanced coverage.

Incident Response

Gold requires a documented incident response plan with defined roles, escalation procedures, containment strategies, and communication protocols. The plan should be reviewed periodically and key staff should understand their responsibilities during an incident.

Evidence and Reporting

While still self-attestation-based, Gold organisations should maintain comprehensive evidence including policy documents, training records, access control logs, backup test results, and risk assessment documentation. This evidence supports the director attestation and prepares the organisation for Platinum if they choose to progress.

Implementation Steps

1. Domain assessment - Assess current capabilities across all five Gold domains: Technology Management, Access Management, Backup & Recovery, Policies & Procedures, and Education & Training. Identify gaps against the 22-23 required controls.
2. Policy development - Draft and formalise required policy documents: information security policy, acceptable use policy, incident response plan, confidentiality agreements, and risk management framework. Ensure policies are approved by management and communicated to staff.
3. Technical uplift - Implement advanced technical controls: network security configurations, privileged access management, endpoint detection, cloud backup for key services (Microsoft 365, Google Workspace), and disaster recovery testing procedures.
4. Training programme - Establish a formal, ongoing cybersecurity education programme. Move beyond one-off training to regular awareness sessions, phishing simulations, and role-specific security guidance. Document all training activities and completion records.
5. Risk management - Implement the risk management framework: identify critical assets, assess key threats and vulnerabilities, document risk treatment decisions, and establish a schedule for periodic review. This does not need to be complex but must be documented and active.
6. Evidence collection and attestation - Compile evidence across all five domains. Ensure documentation is current and complete. The company director reviews all evidence and submits the self-attestation to CyberCert for Gold certification.

Frequently Asked Questions

Is Gold the most common target tier?

Yes. Gold is recommended for most SMBs as it provides comprehensive security governance through self-attestation without the cost of external audits required at Platinum and Diamond.

What are the five security domains?

Technology Management (6 controls), Access Management (6 controls), Backup & Recovery (1 control area), Policies Plans & Procedures (8 controls), and Education & Training (1 control area).

Do we need an external audit for Gold?

No. Gold is the highest tier achievable through director self-attestation alone. External audits are only required from Platinum level onwards.

How long does Gold certification take?

From a Silver baseline, expect several months of implementation work. The exact timeline depends on the gap between current practices and Gold requirements, particularly in policy development and risk management.

Is Gold equivalent to ISO 27001?

No. Gold covers foundational enterprise security practices but is not equivalent to ISO 27001 in scope or rigour. However, organisations that achieve Gold will have established many of the practices that ISO 27001 requires, making future certification easier.

Can we skip straight to Gold?

While the tiers are progressive, some organisations may be able to address Bronze and Silver requirements quickly and focus their implementation effort on the Gold-specific controls. The key is ensuring all lower-tier requirements are also met.

Why It Matters

• Gold certification covers five security domains, providing balanced protection across technology, people, processes, and governance. This holistic approach ensures that organisations are not just technically secured but operationally resilient.
• As the highest self-attestation tier, Gold delivers the maximum level of independently recognised security certification without the cost and complexity of external audits. This makes it the optimal choice for SMBs seeking strong certification at a practical price point.
• The structured domain approach at Gold creates a natural governance framework. Policies, procedures, and training requirements mean the organisation is not just implementing controls but building a sustainable security management practice.

Common Challenges

• Developing comprehensive policy documentation when the organisation has operated with informal practices
• Implementing a risk management framework without prior experience in structured risk assessment
• Establishing a formal training programme that maintains engagement beyond initial enthusiasm
• Managing privileged access in small teams where individuals often wear multiple hats
• Balancing the time investment required for Gold with ongoing business operations
• Ensuring disaster recovery procedures are actually tested rather than just documented