Cyber insurance readiness • SMB1001 certification
Would your cyber
insurance claim actually
pay out?
NZ underwriters now want documented evidence – MFA everywhere, tested backups, a written incident response plan, alignment with a recognised framework – before they’ll grant cover or pay a claim. We close the gaps, build the evidence, and get you to the SMB1001 certification level your insurer or your biggest customer is asking for.
the challenge
Having control isn't the same as proving you have it
Insurers, tenders and procurement teams now want evidence, not just claims. It’s no longer enough to say “we have MFA” or “we do backups”. You need to show it, with policies, configuration, testing and documentation.
Loaded premium or declined renewal
If you can’t provide the evidence insurers want, you could face higher premiums or declined renewal.
Tender or supplier questionnaire fails
Many large customers now require SMB1001 alignment or equivalent evidence as part of their procurement process.
Claims get denied after an incident
Without documented evidence of controls, insurers can (and do) deny claims, even if you had the controls in place.
The SMB1001 certification
A certification build for business your size, not enterprise IT departments
SMB1001 is a tiered cyber security certification build for SMBs in New Zealand and Australia. It gives you a clear, practical framework to manage cyber risk and demonstrate your security maturity to insurers, customers and partners.
Bronze
Foundational cyber hygiene for smaller businesses.
Silver
Stronger controls and governance.
Most common
Gold
The level most insurers and large customers look for.
Platinum
Advance controls for broader assurance.
Diamond
Highest level of maturity and assurance.
You don't need to start at Bronze - most businesses certify at the tier that matches where they already sit and what their insurer or customer require.
The Process
From gap to evidence pack
We make it straightforward, with a clear process from assessment to certification beyond.
1
Gap assessment
We review your current setup against SMB1001 and insurer requirements.
2
Close the priority gaps
Stronger controls and governance.
3
Build the evidence pack
We document your policies, settings, testing and processing.
4
Certify
You achieve the right SMB1001 tier for your business.
5
Stay certified
We help you keep your controls, evidence and certification up to date.
comparison
The right-sized standard, not the enterprise one
SMB1001 gives your a practical, achievable path to certification, without the complexity and overhead of enterprise frameworks.
ISO 27001
- Global enterprise standard
- Comprehensive and complex
- Typically higher cost and longer timeframe
- Often more than SMBs need
Essential Eight
- Useful set of technical controls
- No certifications at the end
- Good starting point
- Doesn't cover the broader governanace, risks and documentation pieces insurer asks for
SMB 1001
- Build for SMBs in NZ and Australia
- Tiered, practical and achievable
- Covers technical, people and process controls
- Results in a real certification you can show to insurer and customers
real business, real results
We're doing this in our business too
We’re currently working towards SMB1001 Gold certification ourselves. Every control we’re implementing for clients, we’re implementing in our own environment first.
Accounting firm • Orewa • 18 staff
Passed cyber insurance renewal after MFA and backup gaps were closed. The right documentation gave the insurer the confidence they needed.
Construction company • Auckland • 60 staff
The evidence pack helped them stay on a key supplier panel after new security requirements were introduced.
Frequently asked questions
Frequently asked questions
Get started
Find out where you actually stand
Fifteen minutes tell you which tier fits your business, and how far along you already are. No pitch, no obligation.