Cyber Essentials mark: get the basics in place
The Cyber Essentials mark shows customers that your business has the basic cyber protections in place: up-to-date devices, strong passwords, malware protection, backups and trained staff. The mark suits small and mid-sized firms, and suppliers whose clients ask for proof. We prepare you; an independent assessor audits and certifies you.
Who asks for it, and what it shows them
One certificate. Many audiences read it.
- Board and shareholders“How likely is it that a cyber incident hurts this business?”The basics are in place. the Cyber Security Agency’s 2023 survey found more than 8 in 10 organisations had a cyber incident in a year.CSA, read 12 Oct 2026
- Management“Have we actually done the basics, or do we only think we have?”An independent body has checked the basic controls. the Cyber Security Agency found only 1 in 3 organisations had fully put in place at least three of the five Cyber Essentials categories.CSA, read 12 Oct 2026
- Customers“Is my data safe with this small supplier?”The Cyber Security Agency says the mark helps organisations gain customer and partner confidence.CSA, read 12 Oct 2026
- Tender panels and procurement“Do you still meet our vendor requirements this year?”IMDA requires its pre-approved vendors to hold the Cyber Essentials mark, or an equivalent, at Annual Review, phased from 2026.IMDA, read 12 Oct 2026
- Insurers“Do you back up data, train staff, run anti-malware and have an incident plan?”These are the controls insurer proposal forms ask about, and the mark checks them.MSIG Insurance (Singapore), read 12 Oct 2026
IMDA pre-approved vendors that do not submit the Cyber Essentials mark, or an equivalent, at Annual Review may have their solution status suspended or terminated.
IMDA, read 12 Oct 2026Who it is for
Small and mid-sized organisations that want simple, recognised proof of good cyber hygiene, often because a client, tender or insurer asks. IT leads get a clear baseline of controls across assets, access, updates, backups and incident response.
Who does what
- You
You name a project lead, list your devices and accounts, and make the agreed changes.
- Us: we prepare you
We prepare you: gap check, fix plan, policies, evidence pack and a readiness review before the audit.
- Independent body: audits and certifies
An independent assessor audits your evidence and, if you meet the requirements, certifies you.
What you get
Deliverables mapped to what the assessor tests.
- A gap report against each Cyber Essentials measure
- Controls set up and evidenced: assets, updates, access, backup, malware protection, secure set-up and incident response
- An evidence pack mapped to what the assessor tests
- Support through the certification body’s assessment
What drives the time and the effort
- How many staff, devices and cloud services are in scope
- How many offices or sites you run
- How current your updates, backups and passwords are today
- How much is already written down as policy or evidence
- The assessor’s audit fee, charged by the assessor
1 in 3 organisations had at least 3 of the 5 Cyber Essentials categories fully in place (2023 survey).
Common questions
What is the Cyber Essentials mark?
The Cyber Essentials mark and the Cyber Trust mark are national certification marks owned by the Cyber Security Agency of Singapore (CSA). Cyber Essentials covers the basics every organisation should have, checked by an independent assessor.
Is Cyber Essentials hard to get?
Not if the basics are in place. Most of the work is fixing gaps such as missing updates, shared passwords or untested backups, then collecting evidence. We tell you at the start which gaps stand between you and the audit.
Cyber Essentials or Cyber Trust mark?
Cyber Essentials proves the basics. The Cyber Trust mark is risk-based, in five tiers, for organisations with more data or more complex systems. Choose by who is asking and what they need; we compare them side by side.
How much does Cyber Essentials cost?
Two parts: our preparation, for which you get a fixed-fee proposal after a short scoping call, and the assessor’s own audit fee. Scope drives both. Government grants may cover part of the cost. We check at your first call. Tell us your scope in 5 minutes and you get a fixed-fee proposal within 2 working days: Scope your project
Is Cyber Essentials certification worth it?
If clients, tenders or insurers ask for the mark, yes: the certificate answers their security questions in one line. The preparation also closes common gaps such as missing updates and weak passwords.
Latest PDPC case on this topic · 2026-09-21 · Education and childcare · Voluntary undertaking
A critical firmware flaw on a perimeter firewall gave attackers administrator access and a path to files holding student and staff data; apply firmware fixes promptly.
Read the PDPC decision of 21 September 2026, on pdpc.gov.sg (opens in a new tab)Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)