In this guide · 8 sections
- 01Which cybersecurity services need a licence
- 02What changed in 2026
- 03How to check a vendor's licence in 5 minutes
- 04What the law means for you as the buyer
- 05Does a small business need a pentest at all?
- 06Questions to ask before you sign a pentest or SOC quote
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Only penetration testing and managed SOC monitoring need a CSRO licence. Before hiring a vendor for either, check its name on CSRO's published list of licensees. Using an unlicensed provider is not an offence for you, but providing the service unlicensed is.
Which cybersecurity services need a licence
The Cybersecurity Act lists two licensable cybersecurity services. CSRO's licence page repeats them and the fees.
| Service | Licence needed? | What it means |
|---|---|---|
| Penetration testing | Yes | Someone tries to break into your systems, website or network to find weaknesses |
| Managed SOC monitoring | Yes | A provider watches your systems and alerts around the clock for attacks |
| Security health checks and configuration reviews | No | Reviewing settings such as MFA, sharing and admin roles |
| Setting up MFA, backups, antivirus or email filtering | No | Configuration and rollout work |
| Selling security software or tools | No, unless the offer includes a licensable service | Software licences on their own |
The licence applies to anyone selling these services to the Singapore market: companies, freelancers, resellers and overseas providers. Employees working for a licensed provider do not need their own licence, and a company doing the work only for its own group does not need one either.
What changed in 2026
Three changes this year affect who can hold a licence and for how long.
- Cyber Trust Mark requirement (from 16 March 2026). New applicants must hold an active Cyber Trust Mark Promoter (Tier 3) certificate or an accepted equivalent covering the licensed service. CSRO says ISO/IEC 27001 is currently the only recognised equivalent.
- Grace period to 31 December 2026. Existing licensees have until the end of the year to get that certificate. After that, a licensee without one is in breach of its licence conditions, which can lead to suspension or revocation.
- Renewal deadline (from 13 July 2026). The Cybersecurity Service Providers (Amendment) Regulations 2026, published on 10 July 2026, changed the renewal deadline from two months to one day before expiry. A renewal submitted in time keeps the licence in force while it is processed.
- Officer changes (from 16 March 2026). Licensees must tell CSRO within 30 days when key officers join or leave.
For a buyer, the practical effect is simple. From 2027, a licensed pentest or SOC provider should be able to show you both its CSRO licence and a current Cyber Trust Mark or ISO/IEC 27001 certificate for that service.
How to check a vendor's licence in 5 minutes
Do this before you sign a quote for penetration testing or SOC monitoring.
Get the vendor's exact legal name and UEN
Ask for it in writing. Brand names and legal names often differ, and resellers may deliver work through another company.
Download CSRO's list of licensees
CSRO publishes separate PDF lists for business entities and individuals on its Licensed Service Providers page. Search for the legal name or UEN.
Match the licence to the service
Penetration testing and SOC monitoring are separate licences. A provider licensed only for pentesting cannot sell you SOC monitoring.
Ask who actually does the work
If a reseller or overseas partner performs the testing, that business also needs a licence. Ask for its name and check it too.
Ask for the certification
From 1 January 2027, licensees need Cyber Trust Mark Promoter (Tier 3) or ISO/IEC 27001 covering the service. Ask for the certificate and its scope.
Report concerns to CSRO
If a provider is selling a licensable service without a licence, CSRO asks consumers to tell it at contact@csro.gov.sg.
Licensees are not allowed to use the CSA or CSRO logo in their marketing. A vendor showing a CSA logo as a badge of approval is a warning sign, not proof of a licence.
What the law means for you as the buyer
According to the CSRO FAQ, it is not an offence for a business to use an unlicensed provider. The offence sits with the provider: selling a licensable service without a licence can lead to a fine of up to S$50,000, up to two years' imprisonment, or both. An unlicensed provider also cannot sue to recover fees for that work.
The bigger risk for you is practical. A penetration tester gets deep access to your systems and sees your weaknesses before anyone fixes them. CSRO's FAQ makes the same point: misuse of that information could cause severe damage. Choosing a licensed provider gives you a minimum level of vetting on who has that access.
Does a small business need a pentest at all?
Many SMEs are asked for a 'VAPT' (vulnerability assessment and penetration test) by a customer, insurer or tender. Before buying one, check whether the basics are in place, because a pentest on an unpatched system mostly reports what you already know.
A pentest makes sense if
- A customer contract or tender requires it
- You run your own web app, portal or API
- You hold sensitive data such as health or financial records
- You have just made a big change to your systems
Fix the basics first if
- MFA is not on for every account
- You have no tested backups
- Software and devices are not updated
- You cannot list your devices and admin accounts
CSA's Cyber Essentials mark covers those basics and is designed for SMEs. Our Cyber Essentials checklist explains the requirements, and our MFA set-up guide is usually the first fix. If something has already gone wrong, the new Cyber Incident Helpline gives triage and referrals.
Questions to ask before you sign a pentest or SOC quote
Before you sign
Get the scope and rules of engagement in writing, including test dates and an emergency contact, so the test does not take down a live system at a bad moment.
Do it yourself or get help?
Checking a licence is a five-minute job anyone can do with the CSRO list. Deciding whether you need a pentest, and getting ready for one, takes more thought.
IT Sorted does not provide penetration testing or SOC monitoring, because both need a CSRO licence. Our Security Health Check (S$290) is a written review of your domain, email, website and Microsoft 365 or Google Workspace settings, with a fix list. CSA Cyber Essentials Readiness (from S$990) gets the basics in place before you buy a pentest or apply for the mark.
Frequently asked questions
Two: penetration testing and managed security operations centre (SOC) monitoring. Any company, freelancer, reseller or overseas provider selling either service to the Singapore market needs a licence from the Cybersecurity Services Regulation Office (CSRO). Each service needs its own licence.
Download the lists of licensed business entities and individuals from the Licensed Service Providers page on csro.gov.sg and search for the vendor's legal name or UEN. Confirm the licence covers the service you are buying, either penetration testing or SOC monitoring.
No. CSRO says it is not an offence for a customer to use an unlicensed provider. The provider commits the offence, with a fine of up to S$50,000, up to two years' imprisonment, or both. CSRO still encourages buyers to use licensed providers because of the access they get.
From 16 March 2026, licensed pentest and SOC providers must hold an active Cyber Trust Mark Promoter (Tier 3) certificate, or ISO/IEC 27001 as the accepted equivalent, covering the licensed service. Existing licensees have until 31 December 2026 to obtain it.
CSRO lists the licence fee as S$2,500 for a business entity and S$1,250 for an individual, per licence. A licence is valid for five years, and a provider offering both pentesting and SOC monitoring needs two licences. New applications take up to about eight weeks.