StarLabs Glossary / Cybersecurity & Network Terms
CSA Cyber Trust Mark
A risk-based, tiered cybersecurity certification for organisations with more digital operations.
The Cyber Trust mark is a cybersecurity certification from the Cyber Security Agency of Singapore (CSA) for organisations with more extensive digital operations. It is risk-based: you assess your risk profile, then show you meet the practices for one of five preparedness tiers. An appointed certification body audits both your documents and how well the controls actually work.
How it works
Cyber Trust is the step up from the Cyber Essentials mark. Both sit under CSA’s SG Cyber Safe Programme. Where Cyber Essentials is a fixed baseline checklist, Cyber Trust starts with a question: how much risk does your organisation actually carry? A firm that runs online sales, holds lots of customer data or depends on cloud systems faces more risk than a small shop, so it should be held to a higher standard.
The process runs roughly like this:
- Risk assessment. You use CSA’s Cyber Trust risk assessment framework to work out your risk profile.
- Pick a tier. That profile points you to one of five cybersecurity preparedness tiers. Each tier adds more domains to cover, including areas such as governance, asset management, access control, backups, incident response and supplier risk.
- Prepare evidence. You put the required practices in place and document them. A self-assessment template is available from CSA.
- Audit. An independent assessor from a CSA-appointed certification body reviews your documents and checks how the controls are implemented and whether they are effective.
The current standard is Cyber Trust (2025), published as Singapore Standard SS 712:2025. Since CSA’s expansion on 15 April 2025, it also covers cloud, AI and operational technology security. CSA added new risk scenarios, such as insecure APIs, prompt injection into a poorly secured large language model, and malware spreading from a vendor’s infected laptop into an OT network.
| Cyber Essentials | Cyber Trust | |
|---|---|---|
| Best for | Organisations starting out with limited IT resources | Organisations with more extensive digital operations |
| Approach | Fixed baseline measures | Risk-based, five tiers |
| Assessment | Desktop review of self-assessment | Audit of documents, implementation and effectiveness |
| Validity | 2 years | 3 years, with a yearly audit |
What it means for your business
Cyber Trust suits SMEs that handle sensitive data or whose customers want proof of a mature security programme. Expect more paperwork and a yearly audit. CSA funding support, deducted from the certification fee, applies only to an organisation’s first successful Cyber Trust certification, is limited to Singapore-incorporated SMEs and non-profits, and CSA states it runs until 6 February 2028. StarLabs is not a certification body, but we can help with the groundwork the auditor will look for: an asset register, patching records, MFA, tested backups and network segmentation.
Common questions
How long is Cyber Trust certification valid?
Three years, with a yearly audit by the certification body during that period.
Do we need Cyber Essentials before Cyber Trust?
No, you can apply for Cyber Trust directly. Many smaller firms find Cyber Essentials a sensible first step because it builds the basic habits Cyber Trust assumes are already in place.
Who carries out the Cyber Trust audit?
An independent assessor from a certification body appointed by CSA. You can choose any appointed body. CSA lists them on its website.
Preparing for a Cyber Trust audit?
Get your devices, backups and network in order with StarLabs.
Sources: CSA: Cyber Trust mark, CSA: Certification for the Cyber Trust mark, CSA press release, 15 April 2025
Reviewed by the StarLabs technical team · Last checked 18 October 2026
← Cybersecurity & Network Terms · ← All terms · Common questions
