Frequently asked questions

SMB1001 is an Australian cyber security standard designed specifically for small and medium businesses. It has five tiers — Bronze, Silver, Gold, Platinum and Diamond — each adding controls. Unlike the ACSC Essential Eight, SMB1001 is certifiable, so you receive a certificate and badge you can show customers, insurers and supply-chain partners. The standard is published by Dynamic Standards International (DSI).

There are two parts: the Aussie Cyber plan that delivers the controls (per user per month), and an annual certificate fee paid to the certifying body — from $95 a year at Bronze up to $995 at Diamond. Higher tiers (Platinum and Diamond) also require an external audit, which is quoted separately. Full pricing is on our pricing page, and every fee is shown before you commit.

The Essential Eight is a set of eight technical mitigation strategies from the ACSC. You self-assess your maturity against it — there is no certificate, badge or independent validation. SMB1001 is a broader, tiered standard built for small business, covering both technical and organisational controls, and you can be independently certified against it. Many businesses use the Essential Eight as a technical baseline and pursue SMB1001 to prove their security to others.

Increasingly, Australian contracts, tenders and cyber insurers ask whether you take security seriously. SMB1001 is the most accessible way for a small business to prove it, without the cost and complexity of ISO 27001. If customers or insurers are asking about your security posture, certification is worth pursuing.

It depends on your starting point and the level you are targeting. Bronze is achievable quickly once the controls are in place; higher levels take longer because they require more controls and, at Platinum and above, an external audit. We work through the gaps with you and prepare the evidence.

No. SMB1001 certification is issued by CyberCert, the certifying body for the standard in Australia. Aussie Cyber gives you everything needed to achieve certification — the controls, the policies and the evidence — and guides you through the process. We hold SMB1001 Diamond, the top level, ourselves.

Endpoint Detection and Response is monitored security software on your computers. Ours is powered by Huntress: AI watches each device for signs of an attack, a human threat hunter verifies anything of concern, and if a real compromise is underway the security operations centre isolates the affected device — 24/7. It catches the hands-on attacker and the compromise-through-a-legitimate-tool that antivirus misses.

Identity Threat Detection and Response monitors your Microsoft 365 for account takeover — impossible-travel sign-ins, rogue apps, suspicious mailbox rules — and the quiet steps an attacker takes after getting in. On a confirmed takeover, the Huntress SOC can disable the account and revoke the attacker's sessions. It is the layer that catches an attacker who already has a password, which multi-factor authentication does not stop.

No. Microsoft guarantees the service is available; it does not guarantee your data against deletion, ransomware or a lapsed licence — backup is explicitly the customer's responsibility under their agreement. Our Microsoft 365 backup keeps a daily copy of mail, files and SharePoint in Australia, so you can restore well beyond Microsoft's 30-to-90-day recycle bin.

Yes, measurably. Around a third of Australian staff click a phishing email before any training. Across large industry studies, consistent training and simulation cuts that by roughly 85% over twelve months. It is one of the highest-return security controls available to a small business.

Never. If a simulated login page is presented and someone enters credentials, we record only that a submission happened — the actual values are never captured, stored, logged or transmitted. This is an architectural guarantee, not just a policy.

Plans are priced per user per month on a 12-month agreement, and you can pay annually up front or monthly across the term. Endpoint protection, managed patching and the web filter are per device (the per-user price assumes one device per user). SMB1001 plans add an annual certificate fee. Every fee is shown before you commit, and all prices are ex GST.

No — instead we offer a 90-day money-back guarantee. If you are not happy within 90 days, we refund the subscription fees you have paid. A short trial cannot show the value of security that works over months; the guarantee lets you commit with no risk.

Choose a plan, enter your details, and finish by signing in with your Microsoft 365 account. Setup is guided from there — most of the work is ours. You will be up and running in under a day.

Usually, yes — up to around 20%. Most businesses buying Microsoft 365 direct pay list price on a month-to-month term. We buy at partner rates, sell on a thinner margin, and put you on the right commitment term. Same licences, same tenant, nothing changes for your staff. We will show you your actual saving before you switch.

Yes. Aussie Cyber is a division of DJC Systems Pty Ltd, an Australian business securing Australian companies since 1999. Your data is hosted in Australia.