In this guide · 8 sections
- 01What CSA's CISO-as-a-Service scheme is
- 02How much it costs and how much CSA funds
- 03How to sign up for a funded health plan
- 04What to fix yourself before the consultant arrives
- 05Other CISOaaS services: VAPT, incident response and DPO
- 06Is CISOaaS right for your business?
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Eligible SMEs can get up to 70% co-funding from CSA to engage an onboarded consultant who does a cyber health check, writes a cybersecurity health plan and prepares you for Cyber Essentials. In CSA's September 2026 listing, the median fee for 1 to 10 endpoints was S$4,000 before funding and S$1,200 after.
What CSA's CISO-as-a-Service scheme is
Most small businesses cannot hire a Chief Information Security Officer. CSA's scheme, announced in its February 2023 press release and launched in May 2023, lets SMEs rent that role from a consultant that CSA has evaluated and onboarded.
According to CSA's CISO-as-a-Service page (last updated 4 October 2026), an onboarded consultant will:
- perform a cyber health 'checkup' based on CSA's Cyber Essentials and/or Cyber Trust measures;
- develop a cybersecurity health plan tailored to your organisation;
- help you close the cyber hygiene gaps identified; and
- prepare you for, at minimum, Cyber Essentials certification.
CSA describes CISOaaS as covering the 'people' and 'process' side of cybersecurity. The 'technology' side, such as antivirus or backup products, is handled separately through pre-approved solutions on IMDA's SMEs Go Digital platform.
How much it costs and how much CSA funds
CSA states that eligible SMEs can get up to 70% co-funding when they sign up with an onboarded CISOaaS consultant. Providers publish their fees in CSA's provider listing spreadsheet. We summarised the Cyber Essentials sheet, dated 30 September 2026, which lists 31 providers' one-time fees for classical cybersecurity:
| Endpoints | Median before funding | Median after funding | Range before funding |
|---|---|---|---|
| 1 to 10 | S$4,000 | S$1,200 | S$1,400 to S$18,000 |
| 11 to 20 | S$5,700 | S$1,710 | S$2,100 to S$20,000 |
| 21 to 50 | S$8,800 | S$2,640 | S$3,100 to S$22,000 |
| 51 to 100 | S$13,900 | S$4,612 | S$6,000 to S$25,000 |
Providers also list optional add-ons for cloud security, OT security and AI security, charged on top. Prices vary widely, so compare what each package includes, how many site visits or hours you get, and whether help closing the gaps is included or quoted separately.
How to sign up for a funded health plan
Count your endpoints
List laptops, desktops, servers and phones that access company data. Packages are priced by endpoint tier.
Shortlist providers from CSA's listing
Download the current provider listing from CSA's page, filter by your endpoint tier and compare packages and prices.
Sign up through SMEs Go Digital
CSA directs eligible SMEs to choose a CISOaaS (Cyber Essentials) or (Cyber Trust) package on IMDA's SMEs Go Digital platform, where funding is applied. Check the eligibility conditions shown there.
Complete the health check
The consultant reviews your assets, accounts, devices, backups and processes against the Cyber Essentials measures.
Receive and act on the health plan
You get a prioritised plan. Some fixes you do yourself; others the consultant helps with or you buy as separate solutions.
Appoint a certification body
When ready, choose a CSA-appointed certification body for Cyber Essentials. Our Cyber Essentials checklist covers the assessment and CSA's certification subsidy.
Organisations that are not eligible for funding can still approach a listed consultant directly at the full price. CSA also says organisations that complete a health plan and appoint a certification body may be offered scholarships for the Google Cybersecurity Certificate.
What to fix yourself before the consultant arrives
A consultant's time is the expensive part. If the basics are already in place, the health check finds the harder gaps instead of spending hours on things you could switch on in an afternoon.
Quick wins before your health check
If you use Microsoft 365, our Microsoft 365 security checklist covers the tenant settings in priority order, and our MFA set-up guide walks through the most important step.
Other CISOaaS services: VAPT, incident response and DPO
CSA's page lists related services under the same programme, with different funding rules as of October 2026:
| Service | What it is | CSA funding |
|---|---|---|
| CISOaaS (Cyber Essentials / Cyber Trust) | Health check, health plan, gap closure, certification preparation | Up to 70% for eligible SMEs |
| CISOaaS (VAPT Service) | Vulnerability assessment and penetration testing | Up to 70% for eligible SMEs |
| CISOaaS (Incident Response Service) | Help after a cyber incident | Not currently available |
| DPOaaS | Data protection officer support for social service agencies under NCSS | To be updated, per CSA |
| CISOaaS for HIA entities | Help meeting Health Information Act cybersecurity and data security requirements | Through SMEs Go Digital for eligible SMEs |
For incident response, consider having a provider and plan lined up before anything happens, since funding does not apply after the fact. For other government support available to SMEs this year, see our round-up of IMDA's AI support for SMEs.
Is CISOaaS right for your business?
A good fit if
- Clients or tenders ask for Cyber Essentials
- Nobody in the business owns cybersecurity
- You hold customer personal data or payment details
- You want a written plan rather than ad-hoc fixes
Maybe not yet if
- You have one or two staff and only cloud apps (start with the quick wins)
- You need hands-on fixes now rather than a plan
- You are not eligible for funding and the full fee is out of budget
For very small offices, a self-guided route can reach Cyber Essentials too: follow the checklist, fix the gaps, then go to a certification body. CISOaaS is most valuable when you have more devices, more data or no one with the time to drive it.
Do it yourself or get help?
IT Sorted is not a CSA-onboarded CISOaaS provider, so we cannot deliver the funded health plan itself. What we do is the hands-on work around it.
A Security Health Check (S$290) gives you a plain-English fix list for your domain, email and Microsoft 365 or Google Workspace before you engage a consultant. CSA Cyber Essentials Readiness (from S$990) does the gap check, applies fixes, builds the evidence pack and drafts your self-assessment answers, and helps you choose a certification body and claim the CSA subsidy.
Frequently asked questions
It is a CSA scheme that lets SMEs engage a CSA-onboarded cybersecurity consultant to act as their Chief Information Security Officer. The consultant checks the business against Cyber Essentials or Cyber Trust measures, writes a cybersecurity health plan, helps close gaps and prepares the business for certification, with up to 70% co-funding for eligible SMEs.
It depends on the provider and number of endpoints. In CSA's provider listing dated 30 September 2026, the median one-time fee for 1 to 10 endpoints was S$4,000 before funding and S$1,200 after funding, with prices ranging from S$1,400 to S$18,000 before funding. Check the latest listing on CSA's website.
Choose a CISOaaS consultant and package from CSA's provider listing, then sign up on IMDA's SMEs Go Digital platform, where funding for eligible SMEs is applied. Organisations that are not eligible can approach a listed consultant directly at the full price. Check the eligibility criteria on the platform before you commit.
It prepares you for certification but the certification itself is done separately by a CSA-appointed certification body. Once your health plan gaps are closed, you appoint a certification body, which assesses you against Cyber Essentials. CSA offers separate funding for first-time Cyber Essentials certification, deducted from the certification fee.
Not at the moment. CSA's page lists a CISOaaS incident response service with onboarded providers, but states that funding support is currently not available for it. Vulnerability assessment and penetration testing services, by contrast, can receive up to 70% co-funding for eligible SMEs.