A customer may ask for SMB1001 when deciding whether to trust a supplier with systems or information. Start with the requirement they have supplied and the level they expect.
We can help establish the preparation work without promising a certificate or representing our service as an authorised certification body.
Confirm the standard and requested result
SMB1001 is a security certification standard for small and medium businesses, maintained by Dynamic Standards International. DSI currently identifies the 2026 edition and a pathway with five levels.
We confirm the applicable edition, requested level and business scope during the initial review. A customer's actual requirement is more useful than choosing a level solely because its name sounds reassuring.
Keep preparation separate from certification
DSI maintains the standard and identifies CyberCert as its current certifier. Certification requirements and any independent assessment depend on the selected pathway.
Our proposed work concerns preparation and implementation within an agreed scope. It does not confer certified status, promise the outcome of an assessment or claim that A Dark Cloud Creative holds an assessor or partner credential.
Review gaps against the agreed requirement
We establish the relevant systems, existing practices and evidence available to the business. The gap register should distinguish an implemented setting, a policy awaiting approval and a requirement that still needs specialist input.
Access to the applicable standard and its use requirements need to be confirmed. We do not reproduce a licensed control list as a substitute for the official requirements.
Scope the changes your business needs
Preparation may involve updates, access changes, backup checks or policy work. Each job needs a responsible person, an approval path and evidence that can be followed.
The business approves the scope and fees before implementation. Subscriptions, standard access, certification and external assessment charges should be identified separately where they apply, rather than assumed to be included in support.
Make the evidence accurate and usable
The evidence record should describe what was checked, which systems were covered and which gaps remain. A written rule does not by itself show that staff follow it or that a setting operates.
The business retains responsibility for its statements and approvals. We can help organise the handover without answering a certification question as passed when its evidence is incomplete.
Plan for maintenance and further review
The preparation record should name who maintains the controls and responds to changes in staff or software. We confirm current certification and review requirements with the relevant provider.
Suitable workshops and configuration work can be remote across Australia. Perth physical work, independent assessment and any additional specialist advice have separate responsibilities to agree before the engagement begins.
