Lead the way.
Secure suppliers. Maintain compliance.

Achieve enterprise compliance with SMB1001 certification helping SMBs secure their operations, which in turn helps you strengthen supply chains and ensure business resilience.

Cybersecurity is hard for SMBs. Simplify their challenge. Give them a reason to engage, and you've simplified your compliance obligations and secured their business.

As a leader in your industry, you set the standard for your suppliers. Your organization’s buying power gives you immense influence - why not use it to strengthen your entire supply chain at zero cost?

By making cybersecurity certification a requirement for your SMB suppliers, you’re not just mitigating third-party cyber risk - you’re shaping the market, acting as a regulator where governments can’t.

You reduce your exposure to cyber threats, improve supplier accountability, and contribute to a more secure digital economy. Your influence ensures that even the smallest suppliers meet critical security standards, proving that real change comes from the top. When you take the lead, others follow - because power, when used wisely, protects everyone.

This is more than just risk management; it’s a demonstration of leadership. By enforcing a baseline cybersecurity standard, you create a stronger, more resilient supply chain while positioning your organization as a force for good.

Enterprises have a unique opportunity to transform supply chain security by helping SMBs achieve compliance. By making cybersecurity certification a condition of supplier contracts, enterprises ensure that cybersecurity evolves from an afterthought to a business necessity.

This approach not only mitigates risks but also strengthens supplier resilience and continuity, addressing key compliance mandates like GDPR, CMMC, SOCI, and Privacy.

Introducing:

E-SCAP

Supplier Cyber Assurance Program for Enterprises.

SMB1001 certification presents an immediate opportunity to streamline and strengthen the management of SMB cyber risks across all government third-party suppliers through a scalable, certifiable, and continuously updated standard.

Supplier Cyber Assurance Program for {title}.

SCAP for

Enterprises

(E-SCAP)

3 Simple Steps for Your Enterprise.

1

Categorize your supplier pool into 2 types of suppliers.

Tiered Supplier Assurance Model

Tier 1: Enterprise suppliers
Strategic Enterprise Partners Designed for high-impact suppliers with mature security postures. These entities are required to maintain globally recognized, comprehensive certifications such as ISO/IEC 27001 or SOC 2 to align with complex corporate risk frameworks.

Tier 2: SMB suppliers
Agile SMB Network Recognizing that small-to-medium businesses comprise the vast majority of the global supply chain, this tier offers a streamlined path to compliance. SMB1001 provides a purpose-built, cost-effective certification starting at $95 USD, removing the resource barriers of traditional audits while ensuring robust baseline security.

2

Strategic Implementation of SMB1001.

Annual Cyber Health Checks: Require all SMB suppliers to achieve and maintain SMB1001 certification as part of a mandatory annual cyber health review.

Simplified Compliance Tiers: Determining the appropriate SMB1001 level is straightforward, simply refer to the Supplier Categorization Matrix. to align requirements with supplier risk profiles.

Streamlined Onboarding: Partner with an authorized Dynamic Standard Certifier (DSC) (such as CyberCert) to generate dedicated, branded portals. These customized access points allow your global supply chain to seamlessly initiate their certification journey.

The "Social Impact" Model: To accelerate adoption and strengthen your ecosystem, consider a sponsored model by providing the standard and necessary subscriptions for your key SMB partners.

Global Standard of Excellence: SMBs can now adopt SMB1001 as the universal benchmark for year-on-year cyber resilience!

3

Enhanced Supply Chain Visibility.

Real-Time Ecosystem Transparency: Utilizing the certification platform provided by your Dynamic Standard Certifier (DSC) (e.g., CyberCert), you gain immediate visibility into your SMB partners' current certification levels and identified control gaps.

Strategic Maturity Pathways: With this data-driven oversight, you have the framework to systematically uplift your supply chain’s cyber resilience.

Automated Progression: For example, you can set a long-term security roadmap by requiring all Level 1 (Bronze) certified suppliers to transition to Level 2 (Silver) within a 24-month window, eliminating the administrative burden of manual questionnaires and repetitive audits.

How to Implement SCAP.

  1. Mandate SMB1001 cybersecurity certification as the minimum requirement for all suppliers that don’t have a pre-existing, pre-approved cybersecurity certification.

  2. Direct your suppliers to an SMB1001 certifier (e.g. CyberCert) to categorize and certify all your suppliers. You can categorize your suppliers too if you choose.

  3. Repeat annually, and maintain ongoing supplier cyber assurance visibility via the certification registry via the certifier’s API or Dashboard.

  4. It’s that simple!

Take the Next Step:

How to Get Started with E-SCAP and SMB1001 for Enterprises.

1

Do it Yourself (DIY)

Download our “How to implement SCAP” playbook and implement yourself. This playbook includes step-by-step instructions, best practices, and practical examples to streamline adoption. It also includes a ready-to-use clause template tailored for seamless integration into procurement processes, contracts, and tenders, ensuring organizations can easily embed SCAP requirements into their existing programs.

2

Get Assistance

If you would like assistance with implementing and managing a SCAP program, CyberCert the official certifier for SMB1001 can assist. CyberCert provides a platform to streamline compliance and an ecosystem of trusted integration partners. These partners specialize in embedding SCAP into procurement, contracts, and tenders, ensuring a smooth rollout. Click on Get Assistance to get in touch with us and we will connect you with the CyberCert team.

Current TPRM Approaches are inefficient and ineffective.

Current Approaches to Third-Party Cyber Risk Assessments are very hard for SMBs.

Lengthy Questionnaires

35% of third-party assessments have over 100 questions (RiskRecon by Mastercard, 2024). 3

Delays and competing priorities

75% of vendors do not participate or fail to participate in a timely manner (Viso Trust, 2024). 4

Low confidence

Leading to only 4% of enterprises being highly confident in the third-party assessments (RiskRecon by Mastercard, 2024). 5

3 RiskRecon by Mastercard. (2024). The state of third-party risk management. Retrieved from https://www.riskrecon.com/state-of-third-party-risk-management-20244 Viso. (2024). State of Third Party Risk Management in 2024: AI’s Impacts & Future Trends. Retrieved from https://www.visotrust.com/resources/state-of-third-party-risk-management/5 RiskRecon by Mastercard. (2024). The state of third-party risk management. Retrieved from https://www.riskrecon.com/state-of-third-party-risk-management-2024

Current Approaches to Third-Party Cyber Risk Assessments are very hard for Large Organizations. (e.g. Governments)

Long delays to procurement onboarding

90% of surveyed business take longer than 30 days to assess their third party risk (52% of companies take 31-60 days; 38% takes 61-90 days) (EY, 2023) 6

Lengthy assessments

Gartner (2019) found the average time for third party risk assessment process takes on average 90 days. 7

Inability to manage the Entire supply Chain

Prevalent (2024) found that organizations only manage about 33% of their vendors. 8

6 EY. (2023). 2023 EY Global Third-Party Risk Management Survey. Retrieved from https://www.ey.com/en_au/insights/risk/2023-ey-global-third-party-risk-management-survey7 Gartner. (2019). Third-Party Risk Management Survey. Retrieved from https://www.gartner.com/en/newsroom/press-releases/2019-08-15-gartner-says-more-than-eight-in-10-organizations-disc8 Prevalent. (2024). The 2024 Third-Party Risk Management Study. Retrieved from https://www.prevalent.net/content-library/2024-third-party-risk-management-study/

What happens during Step 2
(when your suppliers get certified)?

All suppliers will be doing their own gap assessments, and closing their gaps!

Here’s what each SMB supplier will do:

Conduct a Certification GAP Assessment:

Your supplier will understand where your supplier stands. By starting their SMB1001 certification subscription, they will assess their current cybersecurity maturity to determine the SMB1001 level they can immediately certify to and identify what requirements they need to implement to reach higher levels.

Work with IT or Managed Service Providers:

SMB1001 certification requires your suppliers to work with their own trusted IT advisor through the standard. These MSPs can offer tailored services to help them implement the necessary requirements to certify to their desired or required level. This could include technology management, access control, backup solutions, policy development, and employee training.

Complete the Attestation and Certification:

As suppliers complete their certifications, you could celebrate their achievement. Encourage your suppliers to finalise the certification process, allowing these suppleirs to proudly display their certification badges for marketing purposes, and enhancing their credibility with their own customers, partners, and regulators. This has a ripple effect, for good!

Why is SCAP more efficient?

It doesn’t cost you (the enterprise) anything, as it doesn’t require expensive software to manage ALL suppliers:

You only need to adopt SMB1001 as your SMB supplier certification.

SCAP is a concept which is already supported by DSI’s DSCs.

All the suppliers need to do is to certify against the SMB1001 standard, and all you need to do is to recognize the levels they are required to certify against!

No more lengthy questionnaires:

You and all suppliers speak the same language – i.e. the levels of SMB1001.

For example, if a supplier is certified against Level 3 (Gold) of SMB1001, then you can easily on board them without them filling in lengthy questionnaires – saving precious time for your, and their business!

Annual updates:

Since SMB1001 certification requires an annual recertification against the latest cyber threats and controls, the suppliers will recertify and let you know.

Whole supply chain cyber maturity uplift:

You can easily uplift your entire SMB suppliers from Level 1 to 2 through mandating the new levels according to their categorization!

Key Features of SMB1001

Your client can be certified to any of the levels - they do not need to complete all levels. This multi-tiered system recognises that the cybersecurity maturity required for clients may vary depending on their trading partners' requirements or what the client can implement.

SMB1001 Standard
SMB1001 Standard

Level 1 (Bronze)

Establishes basic preventive controls, such as firewalls and antivirus software.

SMB1001 Standard

Level 2 (Silver)

Introduces more advanced preventive measures, adding layers of protection against sophisticated threats.

SMB1001 Standard

Level 3 (Gold)

Expands to a holistic risk management approach, addressing risks related to people, processes, and technology.

SMB1001 StandardSMB1001 Standard

Levels 4 (Platinum)
and 5 (Diamond)

Advance to complex governance procedures and best practices in risk management.