Technology management
Which laptops and systems does your team use? Who checks that updates and device protection are working?
Explore managed cyber security Our approach to cyber security
SMB1001: a clear path to
SMB1001: a clear path to
better small business cyber security.
We recommend and follow SMB1001 to guide our cyber security advice. It helps us explain where your business stands, identify priorities and plan improvements that suit your risks and resources.
Our reviews guide improvements. They do not provide SMB1001 certification.
What is SMB1001?
A framework for deciding what to improve next.
SMB1001 is a cyber security standard developed by Dynamic Standards International (DSI) for small and medium-sized businesses. Its five levels provide a structure for improving security as your business needs develop.
For a business owner, the useful questions are practical: who can access your accounts, what happens when a laptop is lost, can you recover important files, and would your team recognise a fraudulent invoice?
We recommend SMB1001 because it gives those conversations a consistent structure across people, processes and technology. We follow it to guide advice on cyber maturity: how well your business puts security practices into use and maintains them over time.
Five areas of focus
What this means in your business.
These examples explain the kinds of questions we discuss. They are not the standard's requirements or a certification checklist.
Access management
When someone leaves, who removes their access? Do accounts have MFA and permissions appropriate to each person's work?
See how managed IT helpsBackup & recovery
If a file is deleted or a system fails, what can you restore? Who checks backup failures and plans for recovery?
Understand backup and recoveryPolicies, plans & procedures
Who does your team contact about a suspicious invoice? Is it clear who makes decisions and what happens during an incident?
Discuss your current setupEducation & training
Can staff recognise a suspicious message and report it? How do new starters learn your security practices?
Explore staff security trainingHow we use SMB1001
From understanding your setup to keeping it working.
We use the framework to give advice a clear direction. The depth of our work depends on the review, assessment or ongoing service you choose.
Understand your setup
Talk about your business, the systems you rely on and the concerns that brought you here. A free review is a high-level discussion with no technical access.
Identify gaps
If you need hands-on checks, agree a paid assessment scope. Written findings and recommendations explain what we found within that scope.
Agree priorities
Use your business risks, resources and findings to decide what needs attention first and what can be planned over time.
Implement improvements
Choose the support or project work you need. We confirm inclusions, scope and charges before additional work starts.
Review progress
With ongoing managed IT, maintain the practices covered by your plan and revisit priorities as your people, systems and business change.
Understanding the levels
Choose a starting point that fits your business.
SMB1001 has five levels with increasing requirements. The earlier levels establish and strengthen security foundations; later levels place more emphasis on managing risk and governance.
The right target depends on the information you hold, how your business operates and what your customers or suppliers require. We can discuss those needs with you. A Stack2 conversation or technical assessment does not award a level, and buying a managed IT plan does not automatically establish conformity with SMB1001.
For the standard and current certification information, visit DSI's official SMB1001 overview. DSI updates the standard annually, so check the applicable edition and requirements when considering formal certification.
Your next step
Get clarity, ongoing help or time to learn.
Review your security priorities
Start with a free 30-minute IT discussion, or choose a paid Business IT & Security Assessment with technical checks and written findings. Neither provides certification.
Compare reviews and assessmentsHave your IT managed
Compare Protect, Maintain and Manage for ongoing help. Each plan includes core security, with different support and project arrangements. Backup storage and software are separate.
View managed IT plansLearn at your own pace
Our free book, Secured, explains common threats, practical protection and what to do when something goes wrong. You can read it whether or not you become a customer.
Explore the cybersecurity guideAlready a Stack2 customer? Ask us about your next security priorities and how they fit your current services.
Your SMB1001 questions, answered.
Will a Stack2 review give my business SMB1001 certification?
No. Our free review is a high-level discussion; our paid assessment provides technical checks and written recommendations within an agreed scope. Neither issues certification, awards an SMB1001 level or replaces a formal certification assessment. Formal certification is a separate process through an authorised certifier.
Can I start improving security before pursuing certification?
Yes. We can use SMB1001 to guide a conversation about your priorities and practical improvements. If formal certification is a business requirement, tell us before we scope the work so the next steps are clear.
Does a managed IT plan include every SMB1001 requirement?
No automatic conformity or certification is included. Protect, Maintain and Manage include core security, but inclusions and support differ by plan. Backup storage and software, additional projects and any formal certification process are separate from the plan's stated inclusions.
Can I talk to you if I already have an IT provider?
Yes. Prospective and existing customers can discuss their security priorities with us. A free IT review is a 30-minute discussion with no technical access, detailed audit, troubleshooting or implementation. One complimentary review is available per business every 12 months.