Cybersecurity Compliance for SMBs

But unless cybersecurity is your profession, it can be difficult to know:

• Whether your controls are appropriate
• Whether important gaps exist
• Whether your insurer's expectations are being met
• Whether your clients would be satisfied with your answers
• Whether your current approach will stand up to scrutiny
  
  

That's why many businesses look for an objective benchmark rather than relying on assumptions. SMB1001 provides a recognised framework designed specifically for small and medium-sized businesses.

You don't need to understand every component inside your vehicle.

You simply want confidence that it has been maintained, inspected, and certified against a recognised standard.

Cybersecurity should work the same way.

The SMB1001 Cyber Roadworthy

The goal is not to turn business leaders into cybersecurity experts.

The goal is to provide confidence that the business is protected, compliant, and independently verified.

Increasingly, it is a business requirement.

Clients, insurers, project partners, and supply chain participants want evidence that cybersecurity risks are being managed appropriately.

Questions appearing more frequently include:

• How do you protect sensitive information?
• Do you use multi-factor authentication?
• Are staff trained in cybersecurity awareness?
• What would happen if a cyber incident occurred?
• Can you demonstrate compliance with a recognised cybersecurity framework?
  
  

For many businesses, providing confident answers is difficult, not because they have done nothing, but because they have no structured way to demonstrate what they are already doing.

AEC organisations manage:

• Project information
• Intellectual property
• Client information
• Financial information
• Complex project ecosystems and supply chains
  
  

A significant cyber incident can affect:

• Project delivery
• Client confidence
• Collaboration
• Contractual obligations
• Future business opportunities
  
  

That's why many AEC firms are using SMB1001 as a practical way to strengthen cybersecurity and demonstrate that strength to clients, insurers, and project partners.

Learn More: Why AEC Firms Are Turning to SMB1001 to Win Work and Reduce Risk

Step 1: Understand Your Current Position

We assess your current cybersecurity maturity and identify any gaps against the SMB1001 standard.

Most organisations already have controls in place. The objective is to understand what's working, what's missing, and what matters most.

Step 2: Implement and Manage the Required Controls

Netcare implements, operates, and maintains the controls required for your selected SMB1001 level.

Cybersecurity is treated as an ongoing operational service rather than a one-off project.

Step 3: Achieve Independent Certification

Netcare prepares and manages your organisation for certification.

Certification is independently issued by CyberCert, providing objective verification that your organisation meets the required standard. Annual reassessment helps maintain compliance over time.

Bronze | Essential Protection

Designed for businesses establishing a secure cybersecurity foundation.

Includes

• Managed firewall
• Endpoint protection
• Patch management
• Secure cloud backup
• Security awareness training

Best Suited For

Businesses beginning their cybersecurity improvement journey.

Business Outcome

A secure and independently verifiable cybersecurity baseline.

Silver | Insurance Ready

Builds on Bronze by strengthening identity security and governance.

Includes

Everything in Bronze, plus:

• Multi-factor authentication
• Password management
• Least-privilege access
• Microsoft 365 security hardening
• SPF, DKIM and DMARC
• Core cybersecurity policies

Best Suited For

Businesses handling customer information or seeking alignment with insurer expectations.

Business Outcome

Reduced identity-related cyber risk and stronger assurance capability.

Gold | Business Critical

Provides advanced monitoring, governance, and resilience capabilities.

Includes

Everything in Silver, plus:

• 24×7 Managed Detection and Response (MDR)
• Identity threat monitoring
• Incident response planning
• Cybersecurity policy framework
• Risk register
• Digital asset register
• Backup recovery testing

Best Suited For

Organisations with contractual, regulatory, or supply-chain cybersecurity obligations.

Business Outcome

Demonstrates a mature cybersecurity capability for organisations where cybersecurity is business critical.

The goal is not to collect another certificate.

The goal is to build a stronger business.

When SMB1001 is implemented successfully, organisations often achieve:

• Greater confidence during tender submissions
• Improved cyber resilience
• Better alignment with insurer expectations
• Increased trust with clients and partners
• Clear visibility of cybersecurity risks
• Independent evidence of cybersecurity maturity
  
  

Most importantly, the business moves:

From:  saying "We take cybersecurity seriously."

To:       Being able to prove it.

Pricing depends on whether you are an existing Technology Success client or engaging Netcare under an OnDemand arrangement.

Technology Success Clients

OnDemand Clients

Additional certification fees, audit fees, third-party licensing, major remediation projects, or infrastructure upgrades may apply where required.

This service is ideal for:

• Businesses with 20-100 staff
• AEC businesses
• Professional services firms
• Organisations handling client information
• Businesses pursuing cyber insurance
• Organisations facing security questionnaires
• Companies participating in tenders or supply chains
• Leadership teams seeking confidence rather than uncertainty
  
  

Particularly those asking:

"How do we know whether we've done enough?"