SMB1001 Gold Certification in NZ: You May Be Closer Than You Think

Secure Your Business. Improve Trust. Demonstrate Due Diligence.

 

Cybersecurity is no longer just an IT issue.

Customers are asking tougher questions about security. Insurers increasingly require evidence of cyber controls. Boards are demanding visibility of cyber risk. Suppliers and procurement teams want assurance that their data is protected.

SMB1001 Gold Certification provides New Zealand businesses with a practical and achievable framework for demonstrating cybersecurity maturity.

Unlike large enterprise frameworks that can be expensive and complex, SMB1001 was developed specifically for small and medium-sized organisations. It focuses on implementing practical controls that reduce real-world business risk.

At Vertech, we help organisations understand where they stand today, identify gaps, and build a roadmap toward certification using technology and processes that deliver genuine business value.

What Is SMB1001 Gold?

 

SMB1001 is a cybersecurity certification framework designed specifically for small and medium-sized businesses.

It provides a structured pathway to demonstrate that an organisation has implemented essential cybersecurity controls across:

Gold Certification represents a mature level of implementation and evidence collection.

It gives customers, insurers, suppliers and stakeholders confidence that cybersecurity risks are being actively managed.

Why Businesses Are Pursuing SMB1001

 

We typically see organisations begin their SMB1001 journey for one or more of the following reasons:

Insurers are becoming increasingly focused on cybersecurity controls when determining eligibility, premiums and exclusions.

Many organisations are being asked to complete security questionnaires before engaging with larger customers.

Government and private sector tenders increasingly assess cybersecurity maturity.

Directors need confidence that cyber risks are being managed appropriately.

Certification demonstrates commitment to protecting customer information.

The Business Benefits of SMB1001 Gold

 

Many organisations start the process seeking certification.

The real value comes from strengthening business resilience.

Benefits typically include:

Improved protections against phishing, ransomware and business email compromise.

Greater confidence during insurance applications and renewals.

Independent validation of security practices.

Improved disaster recovery and incident response capabilities.

Customers, suppliers and partners gain confidence in your security posture.

What Controls Are Required?

 

SMB1001 evaluates multiple security domains.

Controls include:

For organisations using Microsoft 365 Business Premium, many of these capabilities are already available as part of existing licensing.

Endpoint Protection

 

Requirements typically include:

Many Vertech clients already meet or exceed these requirements using:

Email Security

 

Email remains the primary attack vector.

Controls generally include:

Backup and Recovery

 

Requirements include:

Governance and Documentation

 

Often the biggest challenge.

Typical requirements include:

The technology may already exist.

The supporting governance documentation often needs refinement.

The Most Common Gaps We See

 

After assessing numerous New Zealand environments, several themes emerge repeatedly.

Most organisations have SPF and DKIM configured.

Far fewer have implemented a DMARC enforcement policy.

Lack of Policy Documentation

 

Technical controls exist.

Formal documentation is often incomplete.

Limited Evidence Collection

 

Controls may be implemented but evidence is not being retained.

Certification requires demonstrable proof.

Backup Testing

 

Backups exist but restoration testing has never occurred.

Vendor Risk Management

 

Third-party suppliers are often overlooked despite representing significant business risk.

Why Existing Vertech Clients Are Closer Than They Think

 

One of the biggest misconceptions is that SMB1001 requires significant new technology investment.

In reality many existing Vertech managed clients already possess:

✅ Business Premium licensing

✅ MFA

✅ Intune

✅ Conditional Access

✅ Managed backups

✅ Security monitoring

✅ Endpoint protection

✅ Email security

✅ Security awareness training

✅ Patch management

✅ Asset inventory

✅ Device compliance

For many businesses, the pathway to certification involves:

This is why clients are often pleasantly surprised to discover they are already 70-90% of the way toward Gold certification.

Using ControlMap to Manage the Journey

 

Vertech uses ControlMap to simplify the certification process.

ControlMap provides a single platform for:

Rather than managing spreadsheets and folders, businesses gain a centralised compliance management platform.

Trust Portal Access

 

A major challenge for growing organisations is responding to repetitive security questionnaires.

ControlMap Trust Portals enable organisations to securely share:

This helps:

Gain confidence in your security controls.

Assess security posture efficiently.

Accelerate procurement reviews.

Access required documentation faster.

Trust Portals help turn cybersecurity from an operational burden into a competitive advantage.

Start with:

PLUS

PLUS

PLUS

Questions:

The more "Yes" answers, the lower the implementation cost is likely to be.

Many cyber insurers require controls similar to SMB1001.

Businesses that achieve SMB1001 Gold are often well positioned for cyber insurance assessments because the majority of foundational controls are already addressed.

SMB1001 Gold Checklist

 

✅ MFA enabled

✅ Privileged accounts identified

✅ Conditional Access configured

✅ Password management solution

✅ EDR deployed

✅ Devices managed

✅ Patch management implemented

✅ Asset inventory maintained

✅ SPF

✅ DKIM

✅ DMARC

✅ Anti-phishing controls

✅ Backups configured

✅ Recovery testing completed

✅ Backup monitoring enabled

✅ Security policy

✅ Incident response plan

✅ Risk register

✅ Asset register

✅ Vendor management process

✅ Security awareness programme

✅ Phishing simulations

✅ Regular training schedule

SMB1001 Readiness Assessment

 

Many businesses assume certification will require extensive investment.

The reality is often very different.

Our readiness assessment helps you:

For existing Vertech clients, the results are frequently encouraging because many technical controls are already operating in the background as part of managed services.

The question is often not:

The question is:

Ready to Explore SMB1001 Gold?

 

Vertech can assess your current environment, map it against SMB1001 requirements, and provide a clear, evidence-based roadmap to certification.

Whether you're responding to customer requirements, preparing for cyber insurance renewal, or strengthening organisational resilience, SMB1001 Gold provides a practical framework that delivers real business value beyond the certification badge itself.