StarLabs Glossary / Cybersecurity & Network Terms
CSA Cyber Essentials Mark
Singapore’s baseline cybersecurity certification for organisations that are just getting started.
The Cyber Essentials mark is a cybersecurity certification from the Cyber Security Agency of Singapore (CSA). It shows that an organisation has put basic cyber hygiene in place, such as knowing its devices and data, controlling access, patching software, backing up and having an incident plan. It suits organisations with limited IT or security resources.
How it works
Cyber Essentials sits under CSA’s SG Cyber Safe Programme, alongside the more advanced Cyber Trust mark. CSA describes Cyber Essentials as designed for organisations with limited IT and cybersecurity expertise and resources. In practice that means most small offices, shops, clinics and service firms in Singapore.
The standard groups its measures under five headings. Each one is a habit you can check, not an expensive product you must buy.
| Category | What it asks you to do |
|---|---|
| Assets | Train staff, keep an up-to-date list of hardware and software, and know where your important data sits. |
| Secure / Protect | Run malware protection and firewalls, give people only the access they need, change default passwords, use MFA for admin accounts and lock down settings. |
| Update | Install security patches promptly from trusted sources, with automatic updates for critical fixes. |
| Backup | Back up business-critical data regularly, keep copies separate and offsite, and test restores at least twice a year. |
| Respond | Have a basic incident response plan, tell staff about it and review it every year. |
On 15 April 2025, CSA expanded the mark beyond classical IT security. It now includes guidance on cloud security (such as the shared responsibility model and user-level cloud settings), AI security (such as visibility over the third-party AI tools staff use) and operational technology security (such as segmenting older machines that cannot support strong access controls).
Certification is carried out by certification bodies appointed by CSA, not by CSA itself. The assessment is a desktop review: you complete a self-assessment and an independent assessor from the certification body checks your evidence. Fees and timelines vary with the scope you certify. Once awarded, Cyber Essentials certification is valid for two years.
What it means for your business
Cyber Essentials gives a small business a clear checklist and a recognised badge to show customers and partners. CSA offers funding support, deducted from the certification fee, for Singapore-incorporated SMEs and non-profit organisations. It applies only to an organisation’s first successful Cyber Essentials certification, and CSA states it is available until 6 February 2028. SMEs can also get up to 70% co-funding for consultants under CSA’s CISO-as-a-Service scheme to build a cybersecurity health plan. StarLabs is not a certification body, but we can help you get ready: building your device inventory, patching, setting up MFA, sorting out backups and writing down a simple incident plan before your assessor arrives.
Common questions
Is Cyber Essentials compulsory in Singapore?
No. It is voluntary. Some customers and tenders may ask for it, and CSA has said it is studying whether organisations with access to sensitive data should hold its marks before bidding for government contracts, but that is not a rule today.
How long does Cyber Essentials certification last?
Two years from the date it is awarded. After that you need to be assessed again to keep the mark.
Should we get Cyber Essentials or Cyber Trust?
Start with Cyber Essentials if you have a small team and no in-house security staff. Cyber Trust is risk-based and suits organisations with more extensive digital operations that need a deeper, audited programme.
Getting ready for Cyber Essentials?
We can help tidy up devices, patching, MFA and backups before your assessment.
Sources: CSA: Certification for the Cyber Essentials mark, CSA press release, 15 April 2025, CSA Cyber Essentials (2025) document, CSA: CISO-as-a-Service
Reviewed by the StarLabs technical team · Last checked 18 October 2026
← Cybersecurity & Network Terms · ← All terms · Common questions
