Question 1

What is SMB1001:2026?

Accepted Answer

SMB1001 is an Australian cybersecurity standard written specifically for small and medium businesses. The 2026 revision raises the bar at every certification tier and adds new requirements — most notably a documented AI policy. Gold (Level 3) sits above Bronze and Silver, and is the level most commonly asked for in supply chain and insurance questionnaires.

Question 2

Why does Gold Level 3 matter to my business?

Accepted Answer

Larger clients, insurers, and government buyers increasingly ask for evidence of a recognised cyber standard before they will contract with you. Gold gives you a defensible answer, and the controls behind it are the same ones that actually reduce your risk of an incident.

Question 3

Do I need to be a Little IT Co client to get the gap check?

Accepted Answer

No. The gap check is free and comes with no obligation. You get the report either way, and you are welcome to hand it to your existing IT provider to action.

Question 4

How long does remediation usually take?

Accepted Answer

It depends where you are starting from. Most businesses we assess already have three or four controls in place. MFA, a password manager, and EDR can typically be rolled out in a couple of weeks; policies, incident response, and backup testing usually run alongside over the following month.

Question 5

Does Little IT Co issue the certification?

Accepted Answer

No — certification is issued by the scheme's assessors. What we do is get you ready for it: benchmark your environment, close the control gaps, and produce the evidence assessors ask to see.

Key Gold Control Area	Requirement Detail
Managed IT Provider Engaged	Contracted MSP / qualified IT support team in place
MFA Everywhere	Enforced across all emails, cloud systems, and admin accounts
Password Manager Deployed	Enterprise password vault mandated for all employees
Endpoint Protection (EDR)	Active antivirus / EDR installed across all endpoints
Firewall Management	Perimeter and device firewalls active and monitored
Patch Management SLA	Critical security patches deployed within 14 days
Secure Backups & Testing	Encrypted, immutable/offline copies with regular restore tests
Incident Response Plan	Documented, tested breach escalation and response playbook
Staff Security & Phishing Training	Ongoing awareness programs and simulated drills active
Cybersecurity Policies Documented	Core policies signed, including new SMB1001:2026 AI Policy

Is your business really gold-standard secure?

Free Gap Check

Plain-English Report

Fast Remediation

The 10 Gold Control Areas

Book your free Gold Control assessment

Request your free gap check

Common Questions