CSA's Cyber Trust Rule for CII Owners: What Suppliers Should Know

What CSA announced on 2 March 2026

CSA's press release, CSA to Raise Cybersecurity Standards for Critical Information Infrastructure Owners, dated 2 March 2026, says the requirement was announced at the Ministry of Digital Development and Information's Committee of Supply debates. It gives the purpose as raising baseline national cybersecurity standards and addressing supply chain risks, noting that CII owners "and their vendors that have access to sensitive data or critical systems" should follow a common set of standards.

CII owners are the operators of systems designated under the Cybersecurity Act, such as essential services in energy, water, banking, healthcare and transport. Their CII systems already fall under separate codes of practice; this new rule targets the rest of their IT estate.

Does the Cyber Trust requirement apply to my company as a supplier?

Not directly, unless you are a CII owner, a CII auditor or a licensed provider of penetration testing or managed security operations centre services. Those licensees are defined under section 49 of the Cybersecurity Act, as the press release notes. A cleaning company, a software vendor or a logistics provider that serves a CII owner is not named in the requirement.

The indirect effect is the one to plan for. A CII owner that must certify its own business systems to the highest tier will review who connects to those systems. Expect security questions in tenders and renewals, and possibly a contract clause asking for a recognised certification. CSA has not published a list of supplier requirements, so what you are asked for will depend on the customer.

Cyber Essentials or Cyber Trust: which a small supplier needs

CSA runs two marks. Cyber Essentials is the baseline for smaller organisations. Cyber Trust is risk-based, with five tiers covering 10 to 22 domains, and suits organisations with more extensive digital operations.

Our ISO 27001 vs Cyber Trust guide compares the marks with ISO in more detail. CSA's funding table for Cyber Essentials, for example, offers up to S$250 off certification fees for an SME with 1 to 5 endpoints for the classical cybersecurity scope, deducted by the certification body (as listed on CSA's page in October 2026).

How a supplier prepares evidence before a CII customer asks

Most of the work is the same whichever mark you end up with: know what you have, lock down accounts, and be able to show it. Start with these steps.

1. 1

   Map your access to the customer

   Write down which of the customer's systems, data or networks you touch: a VPN, a shared portal, an API, staff on site. This decides how much they will ask of you.

2. 2

   Build an asset list

   Every laptop, phone, server, cloud service and software title that handles customer work, with owner and version. Both CSA marks start here.

3. 3

   Turn on MFA and remove shared accounts

   Multi-factor authentication on email, admin consoles and remote access, and one named account per person.

4. 4

   Patch and back up on a schedule

   Automatic updates on devices, a monthly check for servers, and a backup you have actually restored.

5. 5

   Write the short policies

   Acceptable use, access control, incident response and supplier management, one or two pages each, signed off and dated.

6. 6

   Keep proof as you go

   Screenshots of settings, exported reports and registers with dates. Assessors and customer questionnaires both ask for evidence, not intentions.

If you are already answering security questionnaires from larger clients, our guide to security questionnaires for enterprise sales shows how to reuse one evidence pack across customers. The Cyber Essentials checklist goes control by control.

What to ask your CII customer

Rather than guessing, ask your contact in procurement or IT security directly. A short email with these questions saves money spent on the wrong certificate:

• Will you require suppliers to hold a CSA mark or ISO/IEC 27001, and from which contract date?
• If a CSA mark, is Cyber Essentials acceptable or do you need a specific Cyber Trust tier?
• Does the requirement apply to all suppliers or only those with access to your systems or data?
• Will you accept a completed security questionnaire with evidence while certification is in progress?

Keep the reply on file. If a tender later asks for a tier you cannot reach in time, a written record of what the customer said earlier helps the conversation.

Do it yourself or get help?

A small supplier with good IT habits can prepare a Cyber Essentials self-assessment in-house using CSA's free template, then approach a CSA-appointed certification body. The difficult parts are usually the asset list, the evidence and closing gaps such as missing MFA or unmanaged devices.

IT Sorted is a Singapore-based team of developers with over 10 years of experience. Our CSA Cyber Essentials Readiness (S$990, up to 15 users) covers the gap check, asset list, fixes from our catalogue, an evidence pack, drafted self-assessment answers and help choosing a certification body and claiming the CSA subsidy. Certification fees are paid to the certification body, which makes the final decision. To see where you stand first, a Security Health Check (S$290) gives a written review and fix list. We are not a CSA-licensed penetration testing provider.