Cyber Essentials Consultant in Singapore: Do You Need One?

Assessor vs consultant: who does what

CSA says the certification process is carried out by certification bodies it has appointed, and that assessment is a desktop review and verification of your self-assessment by an independent assessor from that body (CSA: Certification for the Cyber Essentials mark). A consultant is anyone you hire to help you get ready.

What Cyber Essentials actually checks

The current standard is the Cyber Essentials mark second edition, published April 2025, which CSA calls Cyber Essentials (2025). It covers classical cybersecurity, with optional pillars for cloud, OT and AI security. The core areas are:

• People: staff trained to spot phishing and report incidents.
• Hardware and software assets: an up-to-date list of what you own and use.
• Data: knowing what data you hold, where it is and how it is protected.
• Virus and malware protection on every device, scanning files on access.
• Access control: accounts, admin rights, MFA and leaver processes.
• Secure configuration: sensible settings, auto-run off, defaults changed.
• Software updates: patches applied on time and unsupported software removed.
• Backups: essential data backed up, stored separately and restore-tested.
• Incident response: a plan to detect, respond to and recover from incidents and data breaches.

Our Cyber Essentials mark checklist goes through each area in detail. One example of the level of detail: the standard expects USB drives to be scanned and auto-run disabled, covered in our removable media policy guide.

What you can prepare yourself

CSA publishes the certification document and a self-assessment template in Excel on its Cyber Essentials page. If you have a small team on Microsoft 365 or Google Workspace with managed laptops, much of the work is gathering proof of what you already do.

A middle path is common: do the inventory and policies yourself, and pay for help only with the technical fixes and a review of the evidence before you submit.

Funding: CSA fee support and CISO-as-a-Service

Two CSA schemes reduce the cost. First, CSA funding is deducted from the certification body's fees for an organisation's first successful Cyber Essentials certification. Only SMEs and non-profits incorporated in Singapore qualify, and CSA says it applies until 6 February 2028.

Second, CSA's CISO-as-a-Service scheme offers eligible SMEs 70% co-funding to engage a CSA-onboarded consultant who checks your set-up, writes a cybersecurity health plan and works with you towards Cyber Essentials. Sign-up with funding is through IMDA's SMEs Go Digital platform. Our guide to CSA's CISO-as-a-Service covers listed prices and how it works.

Certification fees themselves vary by certification body and scope; CSA tells organisations to check each body's website. For the full funding picture after PSG closed, see cybersecurity funding for Singapore SMEs.

The evidence pack: what assessors want to see

Because assessment is a desktop review, your evidence does the talking. Prepare it as you go, organised by the standard's sections.

Keep everything dated and in one shared folder. The same evidence makes the renewal after two years much quicker.

Timeline: how long Cyber Essentials takes

Most of the time goes into fixing gaps, not the assessment. A realistic plan for a small business looks like this:

1. 1

   Gap check (week 1)

   Read the standard, fill in CSA's self-assessment template honestly, and list every "no" or "partly".

2. 2

   Fix the gaps (weeks 2 to 6)

   Typical fixes: MFA everywhere, device management, antivirus on every laptop, backups with a test restore, removing old software, writing missing policies.

3. 3

   Build the evidence pack (alongside)

   Capture screenshots and exports as each fix is done, so nothing needs redoing.

4. 4

   Choose a certification body

   Pick one from CSA's list, compare fees and lead times, and submit the funding application form through them.

5. 5

   Assessment and follow-up

   The assessor reviews your submission and may ask for clarification or extra evidence before deciding.

6. 6

   Maintain for two years

   Certification lasts two years. Keep the asset list, patching and backups up to date so renewal is straightforward.

If a tender needs a higher level, Cyber Trust is the next step up; our comparison of ISO 27001 and the Cyber Trust mark explains the differences.

Do it yourself or get help?

If your set-up is already tidy, start with CSA's template and see how many gaps you find. If most answers are "no", or you have a deadline, getting help is usually cheaper than failing and re-submitting.

Our CSA Cyber Essentials Readiness package (from S$990, up to 15 users) covers the gap check, asset list, fixes from our catalogue, policies and evidence pack, and drafts the self-assessment answers for you to review. We help you choose a certification body and claim the CSA fee support; certification fees are paid directly to the body, and the assessor makes the decision. If you qualify for CISO-as-a-Service co-funding, compare that route too.