SMB1001 Platinum Compliance

Overview

SMB1001 Platinum is the fourth tier of CyberCert SMB1001, introducing mandatory third-party external audit verification.

It builds on all Gold controls and adds advanced threat monitoring, enhanced incident response, and audit-ready documentation.

The external audit requirement transforms the certification from self-attestation to independently verified security assurance.

Platinum is designed for organisations that need to demonstrate audited security credentials to supply chain partners, regulators, or customers.

It represents near-enterprise security maturity, providing a bridge between SMB-scaled certification and enterprise frameworks.

Key Areas

• All Gold-level controls across five security domains remain required
• Advanced threat monitoring and anomaly detection capabilities
• Enhanced incident response with detailed documentation and defined roles
• Third-party external audit by an accredited auditor
• More comprehensive security documentation and evidence management
• Active security monitoring rather than purely preventive controls
• Enhanced logging and audit trail capabilities
• Regular security assessments and vulnerability management

Who It's For

• SMBs in enterprise or government supply chains requiring independently audited security assurance
• Organisations in regulated industries where self-attestation is insufficient
• Businesses handling sensitive customer data or operating in high-risk environments
• Companies seeking a stepping stone between SMB1001 Gold and enterprise frameworks like ISO 27001

Core Requirements

Policies and Governance

All Gold governance requirements apply. Platinum adds the requirement for policies and governance documentation to be maintained at a standard suitable for external audit review. Management must demonstrate active oversight with documented evidence of security governance activities.

Risk Management

The risk management framework from Gold must be enhanced with more detailed threat analysis, regular reviews, and documented risk treatment decisions. The risk management process should demonstrate maturity and be evidenced through historical records.

Security Controls

All Gold controls remain in force. Platinum adds advanced monitoring capabilities: threat detection, anomaly alerting, enhanced logging, and vulnerability management. These controls shift the posture from purely preventive to detective and responsive.

Incident Response

The incident response plan must be comprehensive with defined roles, detailed procedures for different incident types, communication protocols, post-incident review processes, and evidence of periodic testing or tabletop exercises.

Evidence and Reporting

Evidence management at Platinum must support external audit scrutiny. This means organised, current documentation with clear traceability between controls, evidence, and outcomes. The external auditor will review this evidence as part of the certification process.

Implementation Steps

1. Gold certification baseline - Ensure Gold certification is current and all Gold-level controls are fully operational. Platinum builds on Gold, so any gaps at the Gold level must be addressed before proceeding.
2. Monitoring capability - Implement threat monitoring and anomaly detection. This may involve security information and event management (SIEM) tools, managed detection and response (MDR) services, or enhanced logging and alerting. The approach should be proportionate to the organisation's size.
3. Enhanced documentation - Uplift all security documentation to audit-ready standards. Ensure policies are current, evidence is organised and traceable, incident response plans are detailed, and risk management records demonstrate an active process with historical context.
4. Incident response maturity - Enhance the incident response plan with detailed procedures for different incident types, defined roles and responsibilities, communication templates, and post-incident review processes. Conduct at least one tabletop exercise to test the plan.
5. Pre-audit preparation - Conduct an internal review or gap assessment against Platinum requirements. Address any findings before engaging the external auditor. Ensure all evidence is current and accessible.
6. External audit - Engage an accredited CyberCert auditor to conduct the third-party audit. The auditor will review documentation, evidence, and control implementation. Address any audit findings and submit for Platinum certification.

Frequently Asked Questions

Why does Platinum require an external audit?

External audit provides independent verification that controls are operational, not just documented. This level of assurance is required by many supply chain partners and is a fundamental shift from the self-attestation model used at lower tiers.

How much does the external audit cost?

Audit costs vary depending on the auditor and the complexity of the organisation. Contact CyberCert for a list of accredited auditors and indicative pricing. The audit cost is in addition to the certification fee.

What monitoring tools are required?

The standard does not prescribe specific tools. Options range from managed detection and response services to SIEM platforms to enhanced logging with alerting. The approach should be proportionate to the organisation's size and risk profile.

Is Platinum necessary for most SMBs?

Most SMBs will find Gold sufficient. Platinum is recommended for organisations in supply chains with audited security requirements, in regulated industries, or handling particularly sensitive data.

How long does the audit process take?

The audit itself typically takes days, but preparation, scheduling, and addressing findings can extend the process to weeks or months. Plan for the full cycle when targeting Platinum certification.

Why It Matters

• Third-party audit provides independent assurance that controls are not just documented but operational. This is a fundamental shift from self-attestation and carries significantly more weight with customers, partners, regulators, and insurers.
• Advanced threat monitoring moves the organisation from a purely preventive posture to one that actively detects anomalies and potential attacks. This capability is critical as threats evolve and purely preventive controls become insufficient.
• For SMBs competing for enterprise or government contracts, Platinum certification demonstrates a level of security assurance that can open doors otherwise closed to organisations without audited security credentials.

Common Challenges

• The cost of external audit is a significant step up from the self-attestation model of lower tiers
• Implementing meaningful threat monitoring without enterprise-scale budgets requires careful vendor selection
• Preparing documentation to audit-ready standards demands significant effort beyond operational adequacy
• Finding and scheduling accredited auditors may involve lead times that extend the certification timeline
• Maintaining audit-ready evidence on an ongoing basis requires discipline and process that many SMBs find challenging
• The gap between Gold self-attestation and Platinum external verification can reveal controls that are documented but not consistently operational