SMB1001 Silver Compliance

Overview

SMB1001 Silver is the second tier of the CyberCert SMB1001 certification, building on Bronze with enhanced access controls and security awareness.

Key additions include multi-factor authentication, employee cybersecurity training, formal access control policies, and incident response protocols.

Certification remains self-attestation-based with no external audit required, keeping it accessible for SMBs.

Silver significantly reduces risk from credential-based attacks and phishing, the two most common threats to small businesses.

It provides a solid foundation for progression to Gold, which introduces comprehensive security governance across five domains.

Key Areas

• Multi-factor authentication deployed on all critical business systems and email
• Formal access control policies defining who has access to what resources
• Regular system updates and structured patch management processes
• Mandatory employee cybersecurity training covering phishing, social engineering, and safe practices
• Enhanced incident response protocols with defined escalation procedures
• Structured backup procedures with documented schedules and retention policies
• User access reviews to remove unnecessary privileges and dormant accounts
• Email security measures including spam filtering and suspicious attachment handling

Who It's For

• SMBs that have achieved Bronze and are ready for the next level of security maturity
• Organisations where employees handle sensitive customer or financial data
• Businesses that have experienced phishing attempts or security incidents and want stronger defences
• Companies in supply chains where partners require evidence of MFA and staff training

Core Requirements

Policies and Governance

Silver requires documented access control policies that define user roles and permissions. Organisations must demonstrate that access is granted based on business need and reviewed periodically. A designated person should be responsible for managing user access.

Risk Management

While a full risk assessment is still not required, Silver expects organisations to understand their key assets and the threats most relevant to their business. Access controls should be informed by which systems and data carry the greatest risk if compromised.

Security Controls

All Bronze controls remain required. Silver adds MFA on critical systems, structured patch management beyond automatic updates, formal access controls, email security measures, and enhanced backup procedures with documented schedules.

Incident Response

Silver requires defined incident response protocols including escalation procedures and key contact information. Staff should know how to report suspected incidents and there should be a basic process for initial response and containment.

Evidence and Reporting

Evidence requirements remain self-attestation-based at Silver. However, organisations should maintain records of MFA deployment, training completion, and access control policies to support the director's attestation.

Implementation Steps

1. Verify Bronze controls - Confirm that all Bronze-level controls remain in place and are consistently applied. Silver builds on Bronze, so any gaps in foundational controls should be addressed before proceeding.
2. Deploy multi-factor authentication - Enable MFA on email, cloud services, remote access, and any system containing sensitive business data. Prioritise systems accessible from the internet. Ensure all users are enrolled and trained on MFA use.
3. Implement access controls - Define user roles and document who has access to which systems and data. Remove unnecessary privileges and dormant accounts. Establish a process for granting, reviewing, and revoking access.
4. Deliver cybersecurity training - Conduct formal cybersecurity awareness training for all employees. Cover phishing recognition, password hygiene, safe browsing, removable media risks, and incident reporting. Document training completion.
5. Establish incident protocols - Document a basic incident response procedure with escalation contacts, reporting steps, and initial containment actions. Ensure all staff know how to report a suspected incident.
6. Director attestation - Review all Silver controls, confirm they are operational, and submit the director attestation to CyberCert for Silver certification.

Frequently Asked Questions

What does Silver add beyond Bronze?

The key additions are multi-factor authentication on critical systems, mandatory employee cybersecurity training, formal access control policies, and defined incident response protocols.

Do we need an external audit for Silver?

No. Like Bronze, Silver certification is based on director self-attestation. External audits are only required at the Platinum and Diamond levels.

Which MFA methods are acceptable?

Authenticator apps, hardware tokens, and SMS-based verification are all acceptable. The key requirement is that a second factor beyond passwords is in place for critical systems.

How often must training be conducted?

Training should be conducted for all new starters and refreshed periodically. Annual refresher training is recommended as a minimum to keep security awareness current.

Is Silver sufficient for supply chain requirements?

Silver demonstrates meaningful security practices and may satisfy many supply chain partners. However, some enterprises and government agencies may require Gold or higher levels of certification.

Why It Matters

• Multi-factor authentication is one of the single most effective controls against credential-based attacks, which account for the majority of breaches affecting SMBs. Adding MFA at the Silver level addresses this critical vulnerability.
• Employee awareness is the frontline defence against phishing and social engineering. Silver's training requirement ensures that staff can recognise and respond to common attack techniques rather than being unwitting entry points for attackers.
• Enhanced access controls limit the blast radius of any successful attack. By ensuring users only have access to what they need, Silver reduces the risk of lateral movement and data exposure if a single account is compromised.

Common Challenges

• Staff resistance to MFA, particularly if they perceive it as inconvenient or time-consuming
• Identifying all systems that should have MFA enabled, especially shadow IT and personal devices
• Making cybersecurity training engaging and relevant rather than a tick-box exercise
• Maintaining accurate access control records as staff join, change roles, or leave the organisation
• Ensuring incident response protocols are actually known and followed, not just documented