ISO 27001 vs CSA Cyber Trust Mark: Which Suits an SME?

ISO 27001 vs Cyber Trust mark: quick comparison

Both certify that you manage cybersecurity risk in a structured way, checked by an independent auditor. They differ in where they are recognised and how much they ask of a small business.

Funding figures are from CSA's Cyber Trust certification page, last updated 7 October 2026. ISO 27001 itself is published by ISO and IEC (ISO/IEC 27001).

What the Cyber Trust mark covers: the five tiers

CSA describes Cyber Trust as a risk-based mark for organisations with more extensive digitalised operations. You complete CSA's risk assessment, which places you in one of five Cybersecurity Preparedness tiers, then certify against that tier's domains. CSA's infographic lists them:

The 22 domains run from governance, policies and risk management through asset management, backups, access control and network security, to incident response and business continuity. Several overlap with Cyber Essentials, so a business that already holds Cyber Essentials has a head start.

The 2025 version of the mark, published as Singapore Standard SS 712:2025, added cloud, operational technology (OT) and AI security as optional pillars. CSA says the older Cyber Trust (2022) is no longer in use from February 2026.

What ISO 27001 asks of a small business

ISO 27001 does not hand you a fixed checklist. It requires you to run an information security management system: define the scope, assess your risks, choose controls (from Annex A and elsewhere), write a statement of which controls apply, and then prove the system keeps working through internal audits and management reviews.

• Scope decision: the whole company, or one service or office. A narrow scope is cheaper but may not satisfy the customer asking.
• Documented ISMS: policies, risk register, statement of applicability, procedures, records.
• Two-stage certification audit: a documentation review, then an audit of how it works in practice.
• Ongoing upkeep: surveillance audits in the years between recertification, plus your own internal audit and management review each year.

The current version is ISO/IEC 27001:2022. Older 2013 certificates had to transition by 31 October 2025. For a 10 to 30 person firm, the work is less about technology and more about someone owning the management system year-round.

Cost components for each certification

Neither CSA nor ISO publishes a fixed certification price; certification bodies quote by scope, headcount and number of sites. What you can plan for is the list of costs.

CSA funding for a first Cyber Trust certification, deducted from the certification body's fee and available only to Singapore-incorporated SMEs and non-profits until 6 February 2028, is S$1,375 for 1 to 20 endpoints, S$1,625 for 21 to 50, S$1,875 for 51 to 100 and S$2,250 for 101 to 200, for classical cybersecurity. Each extra pillar (cloud, OT or AI) adds S$225, or S$450 for 101 to 200 endpoints. For the wider budget, see our cybersecurity cost guide for small businesses.

Recognition: which one will customers ask for?

This should decide it. Ask your three largest customers, or read the security questionnaire they sent you.

CSA says its marks are increasingly recognised outside Singapore and that certified organisations get discounted rates from several cyber insurers. It also publishes a mapping between Cyber Trust (2025) and ISO/IEC 27001:2022, which helps if you start with Cyber Trust and move to ISO later. Some Singapore organisations face deadlines: licensed penetration testing and managed SOC providers must now hold Cyber Trust Promoter (Tier 3) or ISO/IEC 27001, which CSA's licensing office treats as the recognised equivalent. Our guide to the cybersecurity service provider licence changes has the dates.

A practical path: Cyber Essentials, Cyber Trust, then ISO

Few SMEs need to jump straight to ISO 27001. A staged route spreads the cost and builds the habits auditors look for.

1. 1

   Get Cyber Essentials first

   It covers the basics: asset lists, secure settings, updates, MFA, backup, antivirus and incident response. Our Cyber Essentials checklist walks through each area.

2. 2

   Run CSA's Cyber Trust risk assessment

   It tells you which tier fits. Many small firms land in the lower tiers, which is a much smaller job than a full ISMS.

3. 3

   Consider a funded health plan

   CSA's CISO-as-a-Service scheme co-funds a consultant to plan your path to Cyber Essentials or Cyber Trust. See our CISOaaS guide.

4. 4

   Certify Cyber Trust and claim the funding

   Apply through a CSA-appointed certification body, which deducts CSA's funding from its fee for eligible SMEs.

5. 5

   Move to ISO 27001 when a customer requires it

   Use CSA's Cyber Trust to ISO 27001 mapping to see which controls you already meet, then build the remaining management system pieces.

Do it yourself or get help?

The CSA self-assessment templates are free and readable; an owner can work through Cyber Essentials in-house if someone technical handles the settings. Cyber Trust at higher tiers, and ISO 27001, usually need a person who owns policies, risk registers and audits year-round, whether staff or a consultant.

Our CSA Cyber Essentials Readiness package (from S$990) closes the technical gaps and prepares the evidence for Cyber Essentials, the first step toward Cyber Trust. A Security Health Check (S$290) gives you a written gap list to take to a certification body or consultant. Our guide to funding after PSG lists what CSA still pays for.