SMB1001 2026 update focuses on email-based attacks, threat detection

Dynamic Standards International (DSI) has updated the Australian-born SMB1001 small business cybersecurity standard, introducing new controls to combat the rise in email-based attacks and to improve threat detection.

The release of SMB1001:2026 reflects the standard's nature of being updated annually to address the current threat landscape.

The SMB1001:2026 update includes six significant changes compared to the previous (2025) version, beginning with new controls for email authentication to fight email fraud, phishing and brand impersonation.

The standard now mandates the implementation of email authentication protocols, specifically DMARC (Domain-based Message Authentication, Reporting, and Conformance), along with SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail).

The standard has also introduced controls for Endpoint Detection and Response (EDR) and Managed Detection and Response (MDR) services.

The requirement for cyber awareness training has been moved into the Bronze (entry-level) tier, aiming to make foundational security education a 'day one' priority. The update strengthens the entry point for minimal cyber hygiene by ensuring the 'human firewall' is addressed immediately, rather than at a later maturity stage.

A new control has been added requiring organisations to develop and implement a formal policy for the acceptable and secure use of Artificial Intelligence (AI).

DSI said this is a direct response to the growth of generative AI tools in the workplace and addresses the "urgent, real-world risks of data leakage, intellectual property loss, and privacy breaches", intending to provide guardrails for SMBs.

The 2026 update also addresses practitioner-raised issues, such as clarifying guidance on modern password hygiene, as well as providing clearer and more detailed guidance on its definition of an SMB.

DSI continues to map the SMB1001:2026 controls against other major international frameworks and has released both a Detailed Standards Mappings report and a Standards Analysis report.

The former provides a cross-reference of controls from a number of cybersecurity standards and frameworks mapped to the SMB1001 standard, designed to help organisations understand how SMB1001 aligns with other widely adopted standards, while the latter evaluates the best security standards for organisations, covering applicability, cost, complexity, and suitability for SMBs across different industries and regulatory requirements.