In this guide · 7 sections
Short answer
Three routes remain: EDGE Grant (up to 50% for SMEs on pre-approved anti-malware, firewall and backup tools), CISOaaS (up to 70% co-funding for a consultant-led cybersecurity health plan) and CSA fee support for a first Cyber Essentials certification, from S$250.
What changed on 29 September 2026
Enterprise Singapore's EDGE Grant page states that EDG, MRA and PSG ceased on 29 September 2026, and that from 30 September businesses apply for support under the EDGE Grant. Applications and projects already submitted under the old schemes continue to be processed, and you can still claim when the project is done.
CSA's own PSG Cybersecurity Solutions page was last updated on 15 August 2026, before the switch, and still tells SMEs to apply for PSG. Treat Enterprise Singapore's EDGE pages as the current source for tool funding.
| Funding route | What it pays for | Support for SMEs | Status (Oct 2026) |
|---|---|---|---|
| EDGE Grant (Enterprise Singapore) | Pre-approved anti-malware, firewall and backup tools | Up to 50% | Open since 30 Sep 2026 |
| CISOaaS (CSA) | Consultant-led cyber health check and plan | Up to 70% co-funding | Open |
| Cyber Essentials fee support (CSA) | First certification fee | S$250 to S$650 by endpoints | Until 6 Feb 2028 |
| PSG (Enterprise Singapore) | Pre-approved solutions | Closed to new applications | Ceased 29 Sep 2026 |
EDGE Grant for antivirus, firewall and backup
Security tools now sit under EDGE's Automation and Digitalisation area as single-function digital solutions bought from IMDA's pre-approved vendors. The activity pages list these limits:
| EDGE activity | Cost capped at | Max support for SMEs |
|---|---|---|
| Integrated anti-malware, firewall and backup | S$45,000 | 50% (S$22,500) |
| Virus or malware protection | S$25,000 | 50% (S$12,500) |
| Data backup | S$10,000 | 50% (S$5,000) |
Enterprise Singapore describes the integrated package as a way to help organisations address CSA Cyber Essentials requirements. Three rules matter more than the percentages. Support for all digital solutions counts toward a S$30,000 yearly cap, inside an overall S$100,000 EDGE cap that resets every 1 April. Each solution can only be applied for once per company. And according to the EDGE FAQ, claims for single-function digital solutions can only be submitted from 1 November 2026.
Our EDGE Grant guide covers eligibility, the SME definition and the full application flow in more detail.
CISO-as-a-Service: up to 70% for a cybersecurity health plan
CSA's CISO-as-a-Service page, last updated on 4 October 2026, still offers eligible SMEs up to 70% co-funding. A CSA-onboarded consultant checks your organisation against the Cyber Essentials or Cyber Trust measures, writes a tailored health plan, helps close the gaps and prepares you for at least Cyber Essentials certification. Sign-up for the funded version is through IMDA's SMEs Go Digital platform.
The same page lists a funded vulnerability assessment and penetration testing (VAPT) service at up to 70% for eligible SMEs. Incident response help from CISOaaS providers has no funding support at present.
This is the route that pays for advice and planning rather than software. Our CISOaaS guide explains the packages and the prices providers publish.
Cyber Essentials and Cyber Trust certification fee support
Separately, CSA reduces the certification fee for an organisation's first Cyber Essentials mark. The certification body deducts it from the fee. According to CSA's Cyber Essentials certification page, the support applies until 6 February 2028.
| Endpoints | Max CSA support (classical cybersecurity) |
|---|---|
| 1 to 10 | S$250 |
| 11 to 20 | S$350 |
| 21 to 50 | S$450 |
| 51 to 100 | S$600 |
| 101 to 200 | S$650 |
The mark is valid for two years. Our Cyber Essentials checklist walks through the five requirement areas and the self-assessment template. For Cyber Trust, the risk-based mark for more mature organisations, CSA points SMEs to the CISOaaS (Cyber Trust) package as the funded path.
Which route fits your business
Most small businesses need a mix: tools to fix the technical gaps and either a consultant or a structured checklist to tie it together.
Use EDGE if you
- Mainly need antivirus, firewall or backup licences
- Are happy to buy from an IMDA pre-approved vendor
- Can wait until 1 November 2026 or later to claim
Use CISOaaS if you
- Do not know where your gaps are yet
- Need policies, an asset list and a plan, not just software
- Want to work toward Cyber Essentials or Cyber Trust with a guide
Do it yourself or get help?
Grants pay part of the cost of specific, pre-approved products and consultants. They do not cover everything. MFA, update settings, account clean-up and the paperwork for Cyber Essentials are often cheaper to do directly than to wait for a grant cycle.
Before you rely on a grant
IT Sorted is not an IMDA pre-approved vendor, so our work cannot be claimed under EDGE or CISOaaS. Our prices are published in full. The CSA Cyber Essentials Readiness package (from S$990) handles the gap check, fixes and evidence pack, and the Security Health Check (S$290) gives you a written gap list first.
Frequently asked questions
Not for new applications under Enterprise Singapore. Its EDGE Grant page states that EDG, MRA and PSG ceased on 29 September 2026, and new applications go to EDGE from 30 September 2026. PSG applications submitted before the cut-off continue to be processed and can still be claimed once the project is completed.
Up to 50% for SMEs and 30% for non-SMEs. Cost caps are S$25,000 for virus or malware protection, S$10,000 for data backup and S$45,000 for the integrated anti-malware, firewall and backup package. Only 12 months of software costs are supported, GST is excluded, and all digital solutions share a S$30,000 yearly cap.
CSA's CISOaaS page, updated on 4 October 2026, still offers eligible SMEs up to 70% co-funding for a cybersecurity health plan and for the VAPT service, with sign-up through IMDA's SMEs Go Digital platform. Incident response services under CISOaaS currently have no funding support. Check the page before signing in case terms change.
Partly. For an organisation's first successful Cyber Essentials certification, CSA funding is deducted from the certification body's fee: up to S$250 for 1 to 10 endpoints, rising to S$650 for 101 to 200 endpoints for classical cybersecurity. Only SMEs and non-profits incorporated in Singapore qualify, and the support runs until 6 February 2028.
No. Enterprise Singapore's activity pages state that third-party companies are not permitted to apply for or manage the grant on behalf of the applicant. You sign in with your own Corppass account, generate the package reference on SMEs Go Digital and submit the application on the Business Grants Portal yourself.