How LAI Solutions reached SMB1001 Gold certification without an enterprise rulebook

LAI Solutions is a Perth-based AI consultancy of fewer than ten people. Earlier this year, procurement teams at their own clients started asking for evidence of cyber controls before awarding or continuing work — the same pressure a growing number of Australian SMEs are starting to feel from their own customers. That's what brought LAI Solutions and Coastal Cyber together to pursue SMB1001 Gold certification.

The result is a useful case study, not because the technology was complicated, but because it shows what certification actually requires for a business this size: less new infrastructure, more disciplined governance.

What the gap assessment found

SMB1001 Gold is assessed against 27 controls, 17 carried over from Silver and 10 added at Gold. Coastal Cyber ran a control-by-control assessment against LAI's actual environment rather than taking the self-attestation questionnaire at face value — which is the point of engaging an independent advisor in the first place.

The finding was that LAI's technical baseline was already solid for a business its size. Centralised Microsoft 365 identity, multi-factor authentication enforced across staff and admin accounts, Microsoft Defender deployed as endpoint detection and response, administrative access separated from daily-use accounts, critical patches applied within 14 days, and segregated, immutable backups were all in place before the engagement started. These are the controls that are genuinely expensive or slow to retrofit, and LAI had already done the work.

The actual gap, once verified, came down to two technical implementation items (an enterprise password manager and stronger email authentication) and roughly ten missing documents and registers: a formal cybersecurity policy, an incident response plan, a password policy, confidentiality agreements, an invoice fraud policy, a visitor register, a digital asset register, secure document destruction and device disposal policies, and a responsible AI use policy. No new infrastructure. No capital spend. A gap that was almost entirely about governance, not technology.

Building an ISMS sized for a ten-person business

This is the part of the engagement most worth explaining to other small businesses reading this. Coastal Cyber didn't hand LAI Solutions a generic template pack lifted from an enterprise ISO 27001 binder. Each control gap was prioritised against what a business of LAI's size could realistically adopt and maintain, then built out specifically for that context: proportionate scope, plain language, and owners who could action each document without a compliance team behind them.

The finished set ran to 17 policies, registers and plans, covering core governance (cybersecurity policy, password and access management, third-party supplier, backup and recovery, acceptable use), AI-specific governance (AI and LLM policy, AI safe usage policy, prompt injection advisory), a single consolidated incident response plan covering ransomware, business email compromise and lost or stolen devices as distinct scenarios within it, workforce controls (staff onboarding acknowledgement, security awareness and training, confidentiality obligation acknowledgement), and operational registers (digital asset register, visitor register, secure device disposal, invoice fraud prevention, and a production deployment sign-off record).

Coastal Cyber drafted every one of them. LAI Solutions reviewed, adopted, and put each into practice. That division of labour is deliberate: Coastal Cyber advises and verifies, LAI Solutions and its IT support implement and operate. Neither side does the other's job.

A detail worth sitting with

One item in the build deserves particular attention. Requirement 26 in the Gold control set is a responsible AI use policy. For most businesses that's a compliance line. For LAI Solutions, an AI consultancy, it's closer to a credibility asset. The finished set didn't stop at a single policy either: LAI ended up with an AI and LLM policy, a separate AI safe usage policy, and a prompt injection advisory, all specific to how the business actually uses AI day to day — a documented, independently-verified position on AI use, ready to hand to the same engineering and construction clients driving the certification in the first place. An AI company that can produce governed AI policy on request is a stronger sales conversation than one that can only claim good intentions.

Why independent verification made the attestation credible

SMB1001's Bronze, Silver and Gold tiers are director self-attestations: a signed confirmation that the listed controls are in place, without a third-party audit behind it. That makes the attestation only as trustworthy as the process behind it. Coastal Cyber's role in this engagement was to make LAI's attestation defensible before Jack Shannon, LAI's Director, signed it — by verifying the evidence for every control rather than accepting the questionnaire response.

That's only credible because Coastal Cyber doesn't sell the tools, the managed services, or the IT support sitting underneath the assessment. Advice and verification stay separate from implementation, which is the whole basis on which a client's customers, insurers, or procurement teams can trust the result.

The result

Asked what's changed since certification, Jack Shannon's answer was direct: “Adds an extra trust signal to our services. It also gives more visibility to the employees.”

Platinum, which introduces independent audit rather than self-attestation, has been scoped as a future second phase once the Gold control base has had time to settle in day-to-day use.

If a client, insurer or procurement process is asking your business to prove its cyber controls, and you're not sure how much of that proof you can already stand behind, a gap assessment is the place to start. It's usually smaller than people expect, and it's rarely the technology that's missing.