Cyber Trust mark certification: readiness for every tier
Cyber Trust mark certification shows that your cyber security matches the risks your organisation actually carries. The mark has five tiers, so a small firm and a large, data-heavy business can each be certified at the right level. We help you pick the tier and prepare; an independent assessor audits and certifies you.
Who asks for it, and what it shows them
One certificate. Many audiences read it.
- Board and shareholders“Is cyber security led from the top, in proportion to our risk?”The mark is risk-based, and the Cyber Security Agency lists establishing cybersecurity leadership as a benefit.CSA, read 12 Oct 2026
- Regulators“Does this provider meet the standard we now require?”The Cyber Security Agency now requires Cyber Trust for critical infrastructure auditors, licensed cybersecurity service providers and the other systems of critical infrastructure owners.CSA, read 12 Oct 2026
- Partners and multinational clients“You will touch our sensitive data or critical systems. What standard do you meet?”The Cyber Security Agency wants critical infrastructure owners and their vendors to follow a common standard to cut supply-chain risk.CSA, read 12 Oct 2026
- Customers“Is this a supplier with a serious security programme?”The Cyber Security Agency says the mark helps build trust and market reputation with customers and partners.CSA, read 12 Oct 2026
- Competitors“How rare is this?”The Cyber Security Agency reported a little over 60 certified organisations as at March 2024.CSA, read 12 Oct 2026
Licensed penetration-testing and managed security operations centre providers must hold an active Cyber Trust mark at Promoter (Tier 3) by 31 December 2026 as a licence condition.
CSA, read 12 Oct 2026The five Cyber Trust mark tiers
- SupporterEntry tier, 10 domains. Usually suits organisations whose risk assessment shows lower cyber risk.
- Practitioner13 domains. Usually suits organisations whose risk assessment shows low to moderate cyber risk.
- Promoter19 domains. Usually suits organisations whose risk assessment shows moderate cyber risk.
- Performer21 domains. Usually suits organisations whose risk assessment shows higher cyber risk.
- AdvocateMost advanced tier, 22 domains. Usually suits organisations with the highest risk and digital maturity.
Your tier comes from CSA’s Cyber Trust mark risk assessment. Source: CSA, cybersecurity preparedness tiers (2025).
Who it is for
Organisations that hold more data or run more complex systems than the basics cover, or whose clients, regulators or tenders ask for the mark. Security leads get a risk-based programme mapped to the domains their tier requires.
Who does what
- You
You name a project lead, agree the tier with us and put the agreed controls to work.
- Us: we prepare you
We prepare you: risk assessment, tier choice, policies, controls, evidence pack and a pre-audit readiness review.
- Independent body: audits and certifies
An independent assessor audits you at the chosen tier and, if you meet it, certifies you.
What you get
Deliverables mapped to what the assessor tests.
- Your risk profile, and the Cyber Trust tier it points to
- A gap report against the domains of that tier
- Policies and controls, each mapped to the domain it meets
- An evidence pack, and support through the assessment
What drives the time and the effort
- The tier you aim for, from Supporter to Advocate
- Staff, devices, sites and cloud services in scope
- How much risk and data your business carries
- Existing policies, controls and evidence you can reuse
- The assessor’s audit fee, charged by the assessor
In a 2025 decision, the PDPC directed one breached firm to obtain the Cyber Trust mark within 9 months.
Common questions
What is the Cyber Trust mark?
The Cyber Essentials mark and the Cyber Trust mark are national certification marks owned by the Cyber Security Agency of Singapore (CSA). The Cyber Trust mark is the risk-based one, in five tiers, for organisations that need more than the basics.
What are the Cyber Trust mark tiers?
Five tiers, from entry level to most advanced: Supporter, Practitioner, Promoter, Performer and Advocate. Each adds requirements. We help you choose the tier that matches your risk and what your clients expect.
Is the Cyber Trust mark worth it?
The Cyber Trust mark answers client and tender security questions with independent proof at the right level. In one 2025 case, the Personal Data Protection Commission (PDPC) directed a breached firm to obtain the mark within 9 months.
How much does Cyber Trust mark certification cost?
The fee depends mostly on the tier and the scope: staff, devices, sites and systems. You get a fixed-fee proposal after a short scoping call; the assessor charges its own audit fee. Government grants may cover part of the cost. We check at your first call. Tell us your scope in 5 minutes and you get a fixed-fee proposal within 2 working days: Scope your project
Latest PDPC case on this topic · 2026-01-08 · HR, recruitment and payroll · Financial penalty (S$17,500)
PDPC fined People Central S$17,500 and gave directions for lacking reasonable security arrangements, in a case tagged access control; review who can reach personal data.
Read the PDPC decision of 8 January 2026, on pdpc.gov.sg (opens in a new tab)Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)