Singapore Cyber Essentials and Cyber Trust: preparing for cloud, AI and OT requirements

Singapore's Cyber Essentials and Cyber Trust marks now reflect the environments organisations actually run. Cloud services, AI use and operational technology need to be considered alongside traditional IT.

CSA expanded both marks on 15 April 2025. Cyber Essentials provides a baseline for organisations starting their cybersecurity journey. Cyber Trust is designed for organisations with greater digitalisation needs and uses a risk-based approach. The 2025 Cyber Trust specification is published as Singapore Standard SS 712:2025.

Start with the real scope

List the cloud platforms, software services, AI tools and OT systems that support the business. Include unsanctioned services where they create genuine exposure. A narrow scope may be easier to assess, but it gives management and customers less confidence if important risks sit outside it.

Choose the mark that fits your risk and customer expectations

Cyber Essentials is a practical entry point for baseline controls. Cyber Trust suits organisations that need a broader, risk-based programme and stronger assurance for customers, partners or tenders. Organisations planning ISO/IEC 27001 can use CSA's published cross-mapping to reduce duplicated work.

Turn controls into evidence

Policies alone do not show that a control operates. Build an evidence list early. Useful evidence includes approved inventories, access reviews, configuration records, vulnerability results, recovery tests, training records, incident exercises and management review decisions.

Plan remediation before the assessment

A readiness review should identify gaps, assign owners and agree realistic completion dates. Fix high-risk and foundational gaps first. For example, weak asset visibility will affect vulnerability management, access control, incident response and the accuracy of the final assessment.

Check current support before budgeting

CSA states that eligible SMEs can receive support through the CISO-as-a-Service scheme, including co-funding of up to 70 percent for eligible cybersecurity consultancy services and solutions. Eligibility and programme terms can change, so confirm the current conditions directly with CSA.