In this guide · 8 sections
Short answer
Budget roughly S$15 to S$40 per user per month (our estimate) for security licences (endpoint, password manager, backup, plan upgrades), plus one-off set-up of about S$1,500 to S$3,000 for a 10-person office if you hire help. Start with free controls: MFA, updates and secure sharing settings.
Start with the controls, not a number
There is no official 'right' percentage of revenue to spend on security. A better approach is to price the controls that CSA expects of a small business. Its Cyber Essentials mark groups them into five areas: Assets, Secure/Protect, Update, Backup and Respond. Our Cyber Essentials checklist lists every requirement.
Before spending anything, take CSA's free Cybersecurity Health Check. CSA says it takes about ten minutes, is based on Cyber Essentials, and gives you a report with recommendations.
| Control (Cyber Essentials area) | Licence cost | Notes |
|---|---|---|
| MFA on every account (Secure/Protect) | S$0 | Built into Microsoft 365 and Google Workspace |
| Automatic updates (Update) | S$0 | Windows, macOS and app settings; time to check |
| Secure sharing and admin settings (Secure/Protect) | S$0 | Settings in your existing plan |
| Endpoint protection on laptops (Secure/Protect) | About S$4 to S$8 per device/month, or included in Business Premium | Defender for Business, Bitdefender, ESET and similar |
| Password manager (Secure/Protect) | US$4 to US$8.99 per user/month | Bitwarden Teams or 1Password Business, annual billing |
| Backup of email and files (Backup) | Varies by vendor and storage | Microsoft and Google do not keep everything forever |
| Staff awareness training (Assets) | Low; free CSA toolkits exist | Short lessons beat one long annual session |
| Incident response plan (Respond) | S$0 in licences | A few hours to write and test |
Licence prices are approximate, as of October 2026, before GST. Sources: Bitwarden business pricing, 1Password business pricing. The endpoint range is our typical estimate across common products.
Microsoft 365 and Google Workspace upgrades
For many small businesses, the biggest security line item is upgrading the email and office plan, because it bundles several controls at once.
- Microsoft 365 Business Premium is listed at US$22 per user per month on an annual subscription, against US$14 for Business Standard, excluding GST (Microsoft Singapore). The extra US$8 adds stronger threat protection, Intune device management and advanced identity and access controls. Our guide on whether Business Premium is worth it works through when it pays off.
- Defender for Business alone is listed at US$3 per user per month on an annual plan if you want endpoint protection without the full Premium upgrade.
- Google Workspace Business Plus (S$29.40 per user per month on the flexible plan) adds more security and management controls than Business Standard (S$18.80), per Google's Singapore pricing page.
One-off set-up vs ongoing costs
Security spending splits into three buckets. Keep them separate when you compare quotes, because providers often bundle them in different ways.
| Bucket | What it covers | Typical form of charge |
|---|---|---|
| Licences | Endpoint protection, password manager, backup, plan upgrades | Per user or per device, monthly or yearly, paid to the vendor |
| Set-up labour | Turning on MFA, policies, installing protection, first backup, writing the response plan | One-off project fee, or your own staff time |
| Ongoing upkeep | Joiners and leavers, checking settings stay on, restore tests, training | Monthly per-user fee, or a few hours of your time each month |
Two services cost more and need a licensed provider: penetration testing and managed security operations centre (SOC) monitoring. In Singapore, firms selling those must hold a CSA licence; see our guide to the cybersecurity service provider licence. Most small offices do not need either to start with.
Example budget: a 10-person office
A worked example for a 10-person Singapore office on Microsoft 365, using published prices as of October 2026 and IT Sorted's own fixed prices for labour. Your numbers will differ.
- Business Premium upgrade (US$8 x 10 users x 12)Includes endpoint protection and device managementUS$960/year
- Bitwarden Teams (US$4 x 10 x 12)Or 1Password Business at US$8.99US$480/year
- Microsoft 365 backup serviceBilled by the backup vendorVaries
- One-off set-up (health check, lockdown, endpoint, password manager, backup, response plan)S$290 + S$590 + S$390 + S$290 + S$290 + S$390S$2,240
- Ongoing upkeep: Protect Standard (S$19 x 10 x 12)Optional; or do it in-houseS$2,280/year
Estimated totalAbout US$1,440 in licences + S$4,520 in services in year one
Excludes GST, card FX fees and backup service fees. From year two, the set-up line drops away. Doing the work yourself removes most of the services line.
Per user, the licences come to about US$12 a month, and IT Sorted's upkeep adds S$19 a month. A business with sensitive client data, tenders to win or regulated customers will usually spend more; a two-person business on Google Workspace with MFA and a password manager can spend far less.
CSA funding that lowers the cost
As of October 2026, CSA lists these support schemes for SMEs:
- Cyber Essentials certification funding: deducted from the certification body's fee for successfully certified organisations. For Cyber Essentials (2025), up to S$250 for 1 to 10 endpoints, S$350 for 11 to 20 and S$450 for 21 to 50.
- CISO-as-a-Service health plan: eligible SMEs can get up to 70% co-funding to have a CSA-onboarded consultant build a cybersecurity health plan (CSA CISOaaS page). Our CISO-as-a-Service guide explains who qualifies.
- Pre-approved solutions: CSA notes funding for pre-approved cybersecurity solutions under IMDA's SMEs Go Digital programme.
Where to spend first if budget is tight
Turn on MFA everywhere
Email first, then banking, accounting, domain registrar and social media. Cost: S$0.
Switch on automatic updates
On every laptop, phone and the website. Replace devices that no longer get security updates.
Roll out a password manager
Stops password reuse and makes it easy to remove access when someone leaves. From about US$4 per user per month.
Back up email, files and the website
And test a restore. Ransomware recovery depends on a backup the attacker cannot reach.
Protect every laptop
Business-grade endpoint protection with central alerts, or Defender for Business through Business Premium.
Write a one-page incident plan
Who to call, how to restore, and how to report a data breach to PDPC if needed.
Do it yourself or get help?
A confident owner or office manager can do much of this using vendor guides and the CSA toolkits, at the cost of a few days. Get help if you have no one with the time, handle customer data that would hurt to lose, or need Cyber Essentials for a tender.
A Security Health Check (S$290) gives you a ranked fix list for your domain, email and Microsoft 365 or Google Workspace. To keep everything switched on afterwards, Protect Essentials (S$9 per user a month) checks settings and handles joiners and leavers, and Protect Standard (S$19 per user a month) adds endpoint, password manager, training and backup upkeep. Vendor licences are paid by you, in your name.
Frequently asked questions
For basic protection, expect roughly S$15 to S$40 per user per month in licences such as endpoint protection, a password manager, backup and an upgraded email plan, plus a one-off set-up if you hire help. Many important controls, such as MFA and automatic updates, cost nothing extra. Prices are approximate as of October 2026.
Turn on multi-factor authentication for every account, starting with email and banking, enable automatic updates on all devices, and restrict file sharing in Microsoft 365 or Google Workspace. These use settings you already pay for. Then add a password manager and tested backups, which cost a few dollars per user per month.
Often, for businesses with laptops holding client data. As of October 2026 it costs US$22 per user per month on annual billing, US$8 more than Business Standard, and adds stronger threat protection, Intune device management and advanced identity controls. Smaller teams can add Defender for Business alone at US$3 per user per month instead.
Yes. CSA lists funding of up to S$250 for first-time Cyber Essentials certification of 1 to 10 endpoints, deducted from the certification fee, and up to 70% co-funding for eligible SMEs that engage a CSA-onboarded CISO-as-a-Service consultant to build a cybersecurity health plan. Check eligibility on CSA's site before applying.
Most small offices do not need either to start with; basic controls such as MFA, updates, endpoint protection and backups address more common risks. If a client or tender requires penetration testing or managed SOC monitoring, use a provider holding the CSA licence that Singapore requires for those two services.