CSA Cyber Essentials Mark: Checklist, Cost and Self-Assessment for SMEs

Quick answer: Cyber Essentials in a nutshell

Sources: CSA's Certification for the Cyber Essentials mark page and the Cyber Essentials (2025) certification document linked from it.

What the mark is and who asks for it

CSA describes the Cyber Essentials mark as a way to help resource-constrained organisations prioritise the essential measures that protect against common, non-targeted attacks. It is also a recognisable badge you can show customers.

In practice, SMEs usually look at it for one of these reasons:

• A larger customer, government agency or tender asks suppliers to show baseline cybersecurity.
• A cyber insurer asks about your controls. CSA lists insurers that offer discounted rates to Cyber Essentials certified organisations.
• You handle customer data and want an external check that the basics are really in place.
• You are an IT vendor under IMDA's SMEs Go Digital programme, which has its own sub-scheme, Cyber Essentials for ICT Vendors.

There are also sector sub-schemes for healthcare: Cyber Essentials for HIA entities and for HIMS vendors. Check the CSA page if you are in healthcare, because the template is different.

Cyber Essentials mark checklist: requirements by area

The Cyber Essentials (2025) document groups its measures into five categories. CSA's self-assessment template contains the detailed requirements and recommendations for each; to be certified you must meet all of the requirements. Here is what each area means for a typical small office, in plain English.

1. Assets: people, hardware and software, data

• Staff know how to spot phishing and scams, and know who to tell if something looks wrong.
• You keep an up-to-date list of every laptop, desktop, phone, server, network device and software or cloud service the business uses, with an owner for each.
• Unsupported or unauthorised devices and software are removed or replaced.
• You know what business-critical and personal data you hold and where it is stored, and you protect and dispose of it properly.

2. Secure/Protect: malware protection, access control, secure configuration

• Anti-malware protection is installed and kept up to date on all devices.
• Each person has their own account; access is limited to what their job needs and removed when they leave.
• Admin accounts are separate from day-to-day accounts and used only for admin work.
• Default passwords are changed, strong passwords or passphrases are used, and multi-factor authentication (MFA) protects admin access and systems holding sensitive or business-critical data.
• Devices, routers and cloud services use secure settings, with unnecessary features and accounts turned off.

3. Update: software updates

• Operating systems, applications and firmware are updated regularly, with automatic updates on where possible.
• Security updates are applied promptly, and software that no longer receives updates is replaced.

4. Backup: back up essential data

• Essential data is backed up regularly.
• Backups are stored separately and securely, not connected to the operational network, so ransomware cannot reach them.
• You test that backups can actually be restored.

5. Respond: incident response

• You have a written plan for detecting, responding to and recovering from incidents such as ransomware, a hacked email account or a lost laptop.
• Staff know who to report to, and you have contact details for your IT support, bank, insurer and SingCERT.

The 2025 version also lets you extend the scope to cloud security, OT security and AI security if those apply to your business. Most office-based SMEs start with classical cybersecurity and add cloud if they rely heavily on cloud services.

Self-assessment vs certification body: how the process works

Cyber Essentials is not a pure self-declaration. The process has two parts:

1. Self-assessment. Before engaging a certification body, you complete CSA's guided self-assessment template, marking which requirements and recommendations you have implemented, and gather evidence such as screenshots, policies and your asset list.
2. Independent assessment. You choose any CSA-appointed certification body from the How to Get Certified list. Their assessor does a desktop review and verifies your self-assessment. Assessors may inspect documents and apply professional judgement based on your business context.

If you meet all the requirements, the certification body issues the mark, valid for two years. After that, you can re-apply, or move up to the Cyber Trust mark if your risk profile has changed.

Cyber Essentials cost and current CSA funding

There are two kinds of cost: fixing the gaps, and paying the certification body.

Certification fees

Certification bodies set their own fees, and CSA notes that charges and timelines vary with the scope of certification. CSA does not publish a standard price, so ask two or three certification bodies on CSA's list for a written quote for your number of endpoints and scope.

CSA funding support (until 6 February 2028)

CSA funding is deducted from the certification fee by the certification body. The maximum support for classical cybersecurity under Cyber Essentials (2025), as shown on CSA's page in October 2026:

Conditions listed by CSA: funding applies only to an organisation's first successful Cyber Essentials certification; only SMEs and non-profit organisations incorporated in Singapore are eligible; and you submit the application form to your chosen certification body. Additional, smaller amounts apply for each extra pillar such as cloud, OT or AI security. Check the CSA page for the current table before you budget.

Help with fixing the gaps

CSA's CISO-as-a-Service scheme lets eligible SMEs engage a CSA-onboarded consultant to assess their cyber health and build a plan towards certification, with up to 70% co-funding. Applications go through IMDA's SMEs Go Digital platform. NCSS members may also have subsidies under the Tech-and-GO! programme.

The cost of the fixes themselves depends on where you start. If MFA, antivirus, updates and backups are already in place, the work is mostly documentation. If not, budget for licences as well as setup.

Cyber Essentials vs Cyber Trust mark

See CSA's Cyber Trust page for details. For most small offices, Cyber Essentials is the right starting point.

A realistic timeline

How long it takes depends almost entirely on how much is already in place. A typical sequence:

1. Gap check: download the self-assessment template and go through it honestly. Allow a few days for a small team.
2. Fixes: turn on MFA, roll out or check antivirus, switch on automatic updates, set up separate backups and write the missing policies. This can take from a week to several weeks.
3. Evidence pack: collect screenshots, settings exports, the asset register and signed policies.
4. Choose a certification body: get quotes, agree scope and submit the funding application form with them.
5. Assessment: the assessor reviews your submission and may ask follow-up questions. Timing depends on the certification body.

If a tender deadline is driving this, ask the certification body about their current lead time before you start, and leave a buffer.

Do it yourself or get help?

A small team with a tidy Microsoft 365 or Google Workspace setup can prepare for Cyber Essentials on its own. Use the CSA template as your checklist, fix the gaps, and keep evidence as you go. CSA's free cybersecurity toolkits, linked from the certification page, include guiding questions and templates.

Help is worth considering if no one in the business owns IT, if you have a tender deadline, or if you want someone to apply the technical fixes and assemble the evidence. Our CSA Cyber Essentials Readiness package (from S$990, up to 15 users) covers the gap check, asset list, policies, evidence pack and draft self-assessment answers, and helps you choose a certification body and claim the CSA funding. Certification body fees are paid directly to them, and the assessor decides the outcome. We are not a CSA-licensed provider, so we do not offer penetration testing or VAPT.

To keep the evidence current for your renewal two years later, Protect Plus (S$35 per user a month) includes quarterly access reviews and keeps the Cyber Essentials evidence pack up to date. If you just want to know where you stand first, our free domain and email check is a quick start.