In this guide · 8 sections
- 01What kind of cybersecurity help does an SME need?
- 02Licensed services: penetration testing and SOC monitoring
- 03Certifications and credentials worth asking about
- 04CSA funding: CISO-as-a-Service and Cyber Essentials
- 05Questions that expose a shallow offering
- 06What a good engagement should deliver
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Start with what you need: a health check and fixes, a Cyber Essentials push, or ongoing monitoring. For penetration testing or managed SOC monitoring, the provider must hold a CSRO licence, so check the public list. For everything else, ask for written deliverables, named people and a fixed scope.
What kind of cybersecurity help does an SME need?
"Cybersecurity company" covers very different services. Matching the service to your size saves money and avoids buying a product you cannot use.
| Service | What you get | Typical fit |
|---|---|---|
| Health check or audit | A review of settings and exposure with a fix list | Any SME, as a first step |
| Hardening and set-up | MFA, email protection, device encryption, backups configured | SMEs on Microsoft 365 or Google Workspace |
| Cyber Essentials readiness | Gap check, fixes and evidence pack for CSA's mark | SMEs bidding for tenders or larger clients |
| Managed security (monthly) | Settings kept on, joiners and leavers, reports, alerts handled | Teams with no in-house IT |
| Penetration testing (VAPT) | Authorised attack on a system to find weaknesses | Firms with a customer-facing app or portal |
| Managed SOC monitoring | 24/7 log monitoring and alert response | Larger firms or regulated sectors |
For a 5 to 30 person business, the first three rows usually deliver the most protection per dollar. Our cybersecurity cost guide shows what each layer costs.
Licensed services: penetration testing and SOC monitoring
Under the Cybersecurity Act, two services are licensable: penetration testing and managed security operations centre (SOC) monitoring. The CSRO FAQ states that all providers of these services to the Singapore market must hold a cybersecurity service provider's licence, whether they are companies, individuals or third-party providers.
CSRO also requires licensees to hold Cyber Trust Mark Promoter (Tier 3) or an equivalent such as ISO/IEC 27001. Existing licensees have a grace period until 31 December 2026 to get it. Our guide to the cybersecurity service provider licence covers fees and the 2026 changes.
Advice, audits, hardening, training and managed IT security are not licensable services. Plenty of good providers in those areas have no CSRO licence, because they do not need one. A licence also tells you the provider is allowed to do the work, not that it is good at it.
Certifications and credentials worth asking about
Certifications help you shortlist. They do not replace looking at real deliverables. Ask about two levels:
- Company level: Cyber Trust mark or ISO/IEC 27001 shows the provider runs its own security properly. For a firm that will hold admin access to your systems, that matters.
- CSA programmes: whether the provider is onboarded for CSA's CISO-as-a-Service scheme, if you want funding for a health plan.
- People level: recognised certifications for the individuals doing the work, such as offensive security certifications for testers, or management certifications for consultants. Ask for the name of the person, not just the company's badges.
- Platform level: if they will manage Microsoft 365 or Google Workspace security, ask what they have configured before and how they document it.
If a provider cannot tell you who will do the work and what they have done before, the certifications on its website are doing all the selling.
CSA funding: CISO-as-a-Service and Cyber Essentials
CSA runs several schemes under its SG Cyber Safe Programme. Two matter most for SMEs choosing a provider.
The CISO-as-a-Service scheme lets eligible SMEs engage an onboarded consultant to assess their set-up and write a cybersecurity health plan, with up to 70% co-funding. Our CISO-as-a-Service guide explains eligibility and typical fees from CSA's listing. If funding matters to you, choose from the onboarded list, because funding only applies to those providers.
The Cyber Essentials mark is CSA's baseline certification. It covers assets, secure configuration, updates, backups, access control, malware protection and incident response. Many SMEs use a provider to get ready and then apply to a CSA-appointed certification body. The Cyber Essentials checklist lists what assessors look for.
Questions that expose a shallow offering
A short call with these questions tells you more than any brochure. Good providers answer plainly and in writing.
Questions to ask a cybersecurity provider
Red flags include a quote with no scope, a report that is just a scanner export with your logo, pressure to buy a three-year contract on the first call, and any arrangement where the provider owns your Microsoft 365 tenant or domain.
What a good engagement should deliver
Whatever you buy, you should end up with things you can use without the provider. Ask for these deliverables up front.
A good provider hands over
- A plain-English report ranked by risk
- A fix list with who does what and by when
- Before and after evidence of changes made
- An asset list and admin account register
- Documentation you can give the next provider
Red flags
- Generic scan output with no explanation
- Findings with no fixes or priorities
- Accounts and licences in the provider's name
- No written scope or exit terms
- Long lock-in contracts on day one
Do it yourself or get help?
A sensible path for most SMEs: get an independent check, fix the basics, then decide if you need ongoing help or a funded health plan. You do not need a SOC to turn on MFA, encrypt laptops and test your backups.
Our Security Health Check (S$290) gives you a written review of your domain, website, email and workspace settings with a ranked fix list you can do yourself or hand to anyone. If you are aiming for the CSA mark, Cyber Essentials Readiness (from S$990) covers the gap check, fixes and evidence pack. For ongoing upkeep, Protect Standard (S$19 per user a month) keeps your settings, devices and training on track. Everything stays in your company's name.
Frequently asked questions
Only for two services. Providers of penetration testing and managed security operations centre monitoring to the Singapore market must hold a licence from the Cybersecurity Services Regulation Office. Other services, such as audits, hardening, advice, training and managed IT security, do not need a licence. Check the CSRO licensee list if you are buying a licensable service.
Under the licensing framework, the offence is providing a licensable service without a licence. The buyer is not the one committing it. Still, hiring an unlicensed tester carries risk: no regulator oversight, possibly weaker practices, and a report that clients or auditors may question. Checking the CSRO list takes a minute.
Most small businesses do not. A SOC watches logs around the clock and responds to alerts, which helps only if the basics are already in place. For most SMEs, MFA everywhere, email protection, endpoint protection, updates, backups and staff training reduce more risk for far less money. Consider a SOC once you have those and handle sensitive data at scale.
Yes, through CSA's CISO-as-a-Service scheme, eligible SMEs can get up to 70% co-funding to engage an onboarded consultant who assesses their set-up and writes a cybersecurity health plan. Funding applies only to providers on CSA's list, so confirm a provider is onboarded before signing. VAPT services may also be co-funded.
At minimum: an external look at your domain, website and email security, a review of Microsoft 365 or Google Workspace settings such as MFA and sharing, a breach exposure check, and a written report ranked by risk with a practical fix list. Avoid reports that are only automated scan output without explanation or priorities.