Compliance case study

SMB1001 Gold Certification for a Five-Person Queensland Startup

Novaguard helped a five-person Queensland startup establish security controls and achieve SMB1001 Gold certification. The engagement responded to requests from an insurer and a prospective business partner for evidence of the organisation’s security practices.

By Michael Jordison, Director, Novaguard Technology Group

Brisbane-based, with remote support Australia-wide. Client details are anonymised.

The challenge

The startup had no formal security program when an insurer and a prospective partner began asking about its controls. It needed a documented security position it could explain and evidence.

Why SMB1001 Gold

SMB1001 provided a defined set of requirements for the business to work through. With a small environment and few legacy arrangements to unwind, the engagement focused on establishing controls and policies from the outset.

Gold is Level 3 in the SMB1001 framework. Platinum and Diamond sit above it. CyberCert distinguishes director-attestable Gold certification from the externally validated higher tiers. See CyberCert's certification levels and its verification approach.

What Novaguard changed

We implemented the controls required for the engagement and prepared supporting evidence. Work covered identity and MFA, device and update management, backups, access control, and documented security policies.

The documentation connected the requirements to controls in the client's environment, giving the business a basis for responding to due-diligence questions.

Results and verification

The business achieved SMB1001 Gold certification.
Security controls and policies were established from a standing start.
Supporting evidence was available for insurer and prospective partner questions.

This outcome is Gold certification, not a claim of an independent external audit. The case does not claim that certification guaranteed insurance cover or a new contract.

What this means for a similar organisation

A small team can work toward a defined security standard. The suitable level depends on the requirements it needs to meet and the controls it can maintain.

Explore SMB1001 certification or ongoing managed IT.

Questions about this engagement

Is Gold the highest SMB1001 level?

No. Gold is Level 3, with Platinum and Diamond above it. This engagement achieved Gold.

Did the certification guarantee insurance or a contract?

No such outcome is claimed. The business gained certification and supporting evidence to use in insurer and partner discussions.

How do we choose a certification target?

Begin with the requirement you need to satisfy. Ask the client, partner, or insurer what standard, level, and evidence they are requesting, then compare that with your current environment. This startup pursued Gold, but that does not make Gold the default for every organisation. The scope should reflect the requirement and the work needed to maintain the controls.

What preparation is useful before starting an SMB1001 engagement?

Gather your device and user lists, current policies, backup arrangements, and any security questions you have received from another organisation. Existing documentation helps establish the starting point, but missing documentation can itself become part of the work. For this startup, the engagement involved establishing controls and policies as well as preparing the evidence behind them.

What work remains after certification?

Controls need to remain part of daily operations as staff, devices, and applications change. Assign responsibility for maintaining policies, reviewing access, managing updates, and keeping supporting evidence current. Certification requirements and renewal arrangements should be checked against the applicable standard and certification process. The value to management is being able to explain the current environment when the next due-diligence question arrives.

Being asked to prove your security position?

Request a free call and we'll tell you honestly which tier you're actually being asked to demonstrate, and what it would take to get there.

Request a free call