Singapore SMEs can get government funding for cybersecurity through the Cyber Security Agency of Singapore (CSA). CISO-as-a-Service gives eligible SMEs up to 70% co-funding for an outsourced cybersecurity consultant who prepares a cybersecurity health plan, with sign-up through IMDA’s SMEs Go Digital platform. CSA also funds an SME’s or non-profit’s first Cyber Essentials certification (up to $650 for classical cybersecurity) or first Cyber Trust certification (up to $3,600), deducted from the certification body’s fee until 6 February 2028.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
For most small companies the path is: get a health check and plan, fix the gaps, then certify. This guide explains each funded step, the exact amounts CSA publishes, how to apply and where companies go wrong.
Why should an SME bother with cybersecurity certification?
Three practical reasons come up most often with clients:
- Customer and tender requirements. Larger customers increasingly ask suppliers to show recognised cybersecurity standards before they share data or system access.
- Personal data obligations. Under the PDPA, organisations must protect personal data in their possession, and a breach can trigger mandatory notification duties. Our guides to PDPA compliance for Singapore companies and mandatory data breach notification explain those duties.
- A structured starting point. CSA’s marks give a small team a defined list of measures, rather than an open-ended security project.
Certification does not make a company immune to attack, and the PDPA duty applies whether or not you are certified. The value is in a recognised, audited baseline.
What cybersecurity funding is available?
| Support | What it pays for | Funding | How to access it |
|---|---|---|---|
| CISO-as-a-Service (Cyber Essentials and/or Cyber Trust) | A CSA-listed consultant acts as your outsourced CISO, runs a health check and writes a cybersecurity health plan | Up to 70% co-funding for eligible SMEs | Sign up through IMDA’s SMEs Go Digital platform |
| CISO-as-a-Service (VAPT) | Vulnerability assessment and penetration testing | Up to 70% co-funding for eligible SMEs | Sign up through SMEs Go Digital |
| Cyber Essentials mark | First certification against the Cyber Essentials standard | $250 to $650 for classical cybersecurity, plus $50 to $100 per cloud, OT or AI pillar | Deducted by a CSA-appointed certification body |
| Cyber Trust mark | First certification against the Cyber Trust standard | $1,375 to $2,250 for classical cybersecurity, plus $225 to $450 per pillar; up to $3,600 in total | Deducted by a CSA-appointed certification body |
| CISO-as-a-Service (incident response) | Help after a cyber incident | No funding currently | Contact a listed provider directly |
How does CISO-as-a-Service work?
CSA describes CISO-as-a-Service as a way for organisations starting their cybersecurity journey to use CSA-onboarded consultants as an outsourced Chief Information Security Officer. The consultant:
- Runs a cyber health check based on the Cyber Essentials and/or Cyber Trust mark.
- Develops a cybersecurity health plan tailored to your organisation.
- Helps you close the gaps identified.
- Prepares you for at least Cyber Essentials certification.
CSA’s programme focuses on the people and process side of security. The technology side, such as buying security software, is covered through IMDA’s SMEs Go Digital programme. Companies that already have good cyber hygiene, or already hold Cyber Essentials, can use the service to work towards Cyber Trust.
Funding is up to 70% co-funding for eligible SMEs. CSA’s page does not publish a dollar cap, an SME definition or a local shareholding condition for this service, so confirm your eligibility and the funded amount when you sign up on SMEs Go Digital. Organisations that do not qualify for funding can still engage a listed consultant directly at their own cost.
CSA also mentions Google Cybersecurity Certificate scholarships for organisations that complete their health plan and appoint a certification body. Ask your consultant or certification body about them.
How much does CSA fund for Cyber Essentials and Cyber Trust?
Funding for both marks applies only until 6 February 2028, only for SMEs and non-profit organisations incorporated in Singapore, and only for the organisation’s first successful certification. The amount is deducted from the fee the certification body charges, so you never claim it back separately. Amounts are set by the number of end-points (devices) in scope.
Cyber Essentials (2025): maximum CSA funding
| End-points | Classical cybersecurity | Each cloud, OT or AI security pillar |
|---|---|---|
| 1 to 10 | $250 | $50 |
| 11 to 20 | $350 | $50 |
| 21 to 50 | $450 | $50 |
| 51 to 100 | $600 | $100 |
| 101 to 200 | $650 | $100 |
Cyber Essentials certification is valid for two years. The assessment is a desktop review and verification of your self-assessment by an independent assessor. CSA publishes separate funding amounts for healthcare HIA entities and HIMS vendors.
Cyber Trust (2025): maximum CSA funding
| End-points | Classical cybersecurity | Each cloud, OT or AI security pillar |
|---|---|---|
| 1 to 10 | $1,375 | $225 |
| 11 to 20 | $1,375 | $225 |
| 21 to 50 | $1,625 | $225 |
| 51 to 100 | $1,875 | $225 |
| 101 to 200 | $2,250 | $450 |
Cyber Trust certification is valid for three years, with an annual audit. The audit covers document review and the implementation and effectiveness of your measures. The 2025 version is published as Singapore Standard SS 712:2025, and the 2022 version has not been used since February 2026.
Example: a 25-person design firm
Example (hypothetical): A 25-person interior design firm has 30 laptops and phones in scope and runs its project files on a cloud platform. It wants Cyber Essentials because a property developer client has asked about its security.
- It engages a CISO-as-a-Service consultant through SMEs Go Digital. If eligible, up to 70% of the consultant’s fee is co-funded.
- The consultant’s health check finds unmanaged admin accounts and no tested backups. The firm fixes these under the health plan.
- It applies to a certification body for Cyber Essentials covering classical and cloud security. With 30 end-points, CSA funding of up to $450 (classical) plus $50 (cloud), so up to $500, is deducted from the certification fee.
The certification body’s fee itself varies; CSA says charges and timing differ by scope and directs organisations to each certification body.
How do you apply?
- Choose a CISO-as-a-Service consultant or package from CSA’s listing.
- Sign up for funded services on SMEs Go Digital. CSA directs eligible SMEs to IMDA’s platform for CISO-as-a-Service (Cyber Essentials, Cyber Trust or VAPT).
- Complete the health check and health plan with the consultant, and close the gaps.
- Choose a CSA-appointed certification body. Contact details are on CSA’s “how to get certified” page.
- For Cyber Essentials: complete the self-assessment template for the relevant scheme and submit it with the application form to the certification body for desktop review.
- For Cyber Trust: submit the application form and go through the certification audit.
- Pay the net fee. CSA funding is deducted from the certification body’s charges.
Documents checklist
- ACRA business profile confirming the organisation is incorporated in Singapore
- Count of end-points in scope (laptops, desktops, servers, mobile devices)
- List of cloud services, operational technology and AI tools in use, to decide which pillars apply
- The consultant’s cybersecurity health plan and evidence that gaps were closed
- Completed self-assessment template (Cyber Essentials) or application form (Cyber Trust)
- Policies and records the assessor will review, such as access control, backup and patching records
What about grants for cybersecurity software?
CSA’s pre-approved cybersecurity solutions page still describes funding under the Productivity Solutions Grant (PSG) when this guide was checked. PSG stopped accepting new applications after 30 September 2026, when Enterprise Singapore’s EDGE Grant took over. Under EDGE, a company can use up to $30,000 of its $100,000 annual cap on single-function digital solutions, integrated enterprise systems and pre-scoped equipment, at a base rate of 50% for SMEs. Our guide to EDGE funding for digital solutions and equipment explains the sub-cap.
Check SMEs Go Digital or Enterprise Singapore for whether a particular cybersecurity product is currently supported under EDGE, and do not pay a deposit or sign a contract before you apply: EDGE does not support retrospective applications. See our note on deposits paid before an EDGE application.
Organisations piloting quantum-safe cryptography can also look at CSA’s new Quantum-Safe Kickstarter Grant, open from 1 November 2026 to 31 October 2027. CSA has not published a funding amount for it.
Common reasons funding is refused or lost
- Not the first certification. CSA funds only an organisation’s first successful Cyber Essentials or Cyber Trust certification.
- Not incorporated in Singapore. A foreign company’s branch or an unincorporated business may not meet the “incorporated in Singapore” condition.
- Wrong end-point count. Funding is banded by end-points. Understating scope can create problems at assessment.
- Using an unlisted consultant. CISO-as-a-Service funding is for CSA-listed consultants signed up through SMEs Go Digital.
- Waiting too long. Certification funding applies only until 6 February 2028.
- Paying before applying for software funding. Retrospective EDGE applications are not supported.
Frequently asked questions
Which should we get first, Cyber Essentials or Cyber Trust?
CSA’s CISO-as-a-Service aims to prepare organisations for at least Cyber Essentials. Cyber Trust suits organisations that already have good cyber hygiene or already hold Cyber Essentials.
Do we claim the certification funding back after paying?
No. CSA’s funding is deducted from the fee charged by the certification body.
Can a non-profit get the funding?
Yes. Both marks’ funding covers SMEs and non-profit organisations incorporated in Singapore. NCSS members are pointed to NCSS’s own schemes for CISO-as-a-Service.
Is there funding if we have already been hacked?
CSA lists an incident response service under CISO-as-a-Service, but no funding is currently available for it.
How long does certification last?
Cyber Essentials is valid for two years. Cyber Trust is valid for three years, with annual audits.
Where are the official terms?
See CSA’s pages on CISO-as-a-Service, Cyber Essentials certification and Cyber Trust certification. For all other schemes, see our directory of Singapore government grants for companies.
Information checked against official sources on 6 November 2026.
Certification also matters to insurers; see what cyber insurance pays, what it excludes and the cost of going without.
Free grant consultation: are CSA cybersecurity grants right for your company?
Raffles Corporate Services has in-house certified grant consultants who are experienced with Singapore grant applications and the full grant process, from checking eligibility and preparing the proposal and supporting documents to submitting claims and meeting the conditions after approval. We can arrange a free consultation to review your company and identify which grants, including CSA cybersecurity grants, may be applicable.
Email [email protected] or WhatsApp +65 8501 7133 to book a time. CSA and IMDA decide every funding application, and no consultant can guarantee approval.
The Editorial Team, Raffles Corporate Services