SMB1001 Certification, Without Switching Your IT Provider

What's included, the SMB1001 Gold Uplift

This is a newly built offer. We've designed it directly from the same certification process we run and maintain for our own managed clients, Gold is the standard every business on our Fortress or Iron Dome plan already carries, but as a standalone package, sold on its own, it's new. We're saying that plainly rather than implying a long track record we don't have yet.

The engagement is built around a roughly 14-day timeline and covers:

• Gap assessment, where your current environment sits against Gold-level SMB1001 controls, control by control.
• A fixed remediation plan, exactly what needs to change, in plain terms, before certification can be attested.
• Remediation support, we do the technical work needed to close the gaps found (or, where a control sits with your existing IT provider, we tell you exactly what to ask them for).
• Certification submission, attesting Gold-level controls through the CyberCert portal.
• Ongoing maintenance, SMB1001 isn't a one-time badge. Once you're certified, we keep the certification current on an annual basis, the same way we do for our own managed clients.

Keep your SMB1001 controls under ongoing review

If you're not committed to your current IT provider, the work behind SMB1001 can be included in an ongoing managed relationship rather than purchased as an isolated project. Novaguard's managed IT services can include implementation, evidence maintenance, and reassessment support for the plan's stated SMB1001 target—Silver on Perimeter and Gold on Fortress and Iron Dome. Certification still depends on the applicable assessment and your organisation completing the required actions. If a provider switch is on the table, compare the managed-plan route before committing to a standalone project.

Keeping your internal IT team or current provider? Our managed cyber security service works alongside them. Bastion adds recurring checks of agreed controls, evidence reporting, and coordination of improvements against your scoped baseline, which can include SMB1001. Certification and any uplift work are agreed separately from those ongoing checks.

Why this matters beyond the badge

A certificate is only useful if it holds up when someone actually checks it. When we help a client reach or maintain an SMB1001 tier, they get a full GRC export alongside it, the controls in scope, how each one is actually met, and the evidence behind it, mapped to their real environment. That's what you hand to a cyber insurance underwriter during an application (or a claim), or attach to a tender response, proof the controls are genuinely in place and maintained, not just a logo on a website.

For a concrete example, read how a five-person Queensland startup achieved SMB1001 Gold. The engagement established security controls and prepared evidence for insurer and prospective partner questions.