In this guide · 8 sections
- 01SOC, MDR and EDR: what each means
- 02When 24/7 monitoring makes sense for an SME
- 03Licensing of managed SOC providers in Singapore
- 04What "response" should include in an MDR contract
- 05How MDR costs are built up
- 06A practical path for small businesses
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Most small businesses should first get the basics right (MFA, updates, backups, EDR) and have alerts reviewed on business days. MDR makes sense when you hold sensitive data, cannot afford downtime, or a client or insurer requires 24/7 monitoring. A Singapore managed SOC provider needs a CSRO licence.
SOC, MDR and EDR: what each means
| Term | What it is | Who acts on alerts |
|---|---|---|
| EDR (endpoint detection and response) | Software on each device that records behaviour and can isolate a device | You or your IT provider |
| SOC (security operations centre) | A team and tools that monitor security alerts from your systems | The SOC, usually by escalating to you |
| SOC-as-a-Service | An outsourced SOC you subscribe to | Provider monitors; response depends on contract |
| MDR (managed detection and response) | Outsourced monitoring plus hands-on response on your endpoints and accounts | Provider investigates and contains, within agreed limits |
Our guide to EDR vs antivirus vs MDR explains the technology in more detail. The key point: monitoring is only useful if someone with authority acts on the alert quickly, including at 2am on a Sunday.
When 24/7 monitoring makes sense for an SME
There is no fixed size threshold. Look at what an attack would cost you and how quickly you would notice.
MDR is likely worth it if
- You hold health, financial or large volumes of personal data
- A few hours of downtime stops revenue, such as e-commerce or clinics
- A client, tender or insurer requires 24/7 monitoring
- You have servers, remote access or many devices outside the office
- Nobody internally can respond to a security alert out of hours
Basics first if
- MFA is not yet enforced for every account
- Devices run without EDR or are not kept updated
- Backups have never been restore-tested
- You have under about 10 devices and mostly cloud apps
- Nobody reviews the alerts your tools already send
Licensing of managed SOC providers in Singapore
Under the Cybersecurity Act, managed security operations centre monitoring and penetration testing are licensable services. The Cybersecurity Services Regulation Office (CSRO) FAQ says all providers of these services to the Singapore market must hold a licence.
- Check the list. CSRO publishes the licensed cybersecurity service providers. Confirm the provider holds a licence for managed SOC monitoring, not just penetration testing; they are separate licences.
- New certification requirement. From 16 March 2026, applicants need an active Cyber Trust Mark Promoter (Tier 3) certificate or equivalent for the service, with a grace period to 31 December 2026, per the CSRO FAQ.
- Your position as a buyer. CSRO says using an unlicensed provider is not an offence for you, but warns of the risks given the access these providers have. Providing the service without a licence is an offence for the provider.
Our guide to the cybersecurity service provider licence covers the licensing changes in full.
What "response" should include in an MDR contract
"Response" means very different things between providers. Some only send you an email; others isolate a laptop, disable an account and stay until the threat is gone. Get it in writing.
MDR contract checklist
Ask for the CSRO licence number and current certification in the proposal. Our guide to choosing a cybersecurity company in Singapore lists more questions.
How MDR costs are built up
MDR providers rarely publish prices; most quote per endpoint or per user after a scoping call. Budget for three layers.
- EDR licenceMicrosoft Defender for Business standalone, or included in Microsoft 365 Business Premium (Oct 2026)From US$3/user/mo
- MDR monitoring and response serviceDepends on hours, systems covered and response actionsQuoted per endpoint or user
- Onboarding and tuningInstalling agents, connecting accounts, reducing false alarmsOften a one-off fee
- Incident response beyond the contractFull investigation, recovery, forensicsUsually hourly or retainer
TotalEDR licence + quoted MDR fee + any onboarding
Defender for Business pricing from Microsoft's Defender for Business product page as of October 2026, before GST. Ask every provider to quote the same scope so you can compare.
Microsoft's Defender for Business page lists the price, and its Defender for Business overview says it is designed for businesses up to 300 users and includes EDR, automated investigation and remediation, and attack disruption. Many MDR providers can work with it, which avoids paying for a second EDR tool.
A practical path for small businesses
Fix the basics
MFA everywhere, updates automated, backups tested, admin accounts limited. These stop most attacks before monitoring matters.
Deploy EDR on every device
Use Defender for Business or a comparable EDR, set to block and isolate automatically where possible.
Route alerts to someone who reads them
On business days, an IT provider or a named staff member should review alerts within hours.
Write a short incident plan
Who decides, who calls the bank and insurer, how to isolate a device. Test it once a year.
Add MDR when risk justifies it
When the data you hold, a contract or an insurer calls for 24/7 coverage, buy MDR from a CSRO-licensed provider with clear response terms.
CSA's SG Cyber Safe Programme also offers CISO-as-a-Service with consultants onboarded by CSA to help SMEs build a cybersecurity health plan, with funding support for eligible SMEs.
Do it yourself or get help?
Steps 1 to 4 above are within reach of most small businesses with a part-time IT provider. MDR itself must come from a licensed provider.
IT Sorted does not provide 24/7 SOC monitoring; that needs a CSRO licence. We can help you get ready for it. A Security Health Check (S$290) gives a ranked list of gaps across your domain, email and Microsoft 365 or Google settings. Protect Plus (S$35 per user a month, minimum 3 users) keeps endpoint protection, access reviews, policies and Cyber Essentials evidence current, and replies within 4 business hours.
Frequently asked questions
SOC-as-a-Service usually means an outsourced team monitors security alerts and tells you about problems. MDR goes further: the provider investigates and takes agreed actions, such as isolating a device or disabling an account. In practice the terms overlap, so compare the written list of response actions rather than the label.
Not always. If MFA, updates, backups and EDR are not yet in place, fix those first. MDR becomes worthwhile when you hold sensitive data, downtime is very costly, a client or insurer requires it, or nobody can respond to alerts out of hours.
Yes. Managed security operations centre monitoring is a licensable service under the Cybersecurity Act, and providers serving the Singapore market need a CSRO licence. Check CSRO's published list of licensees. Using an unlicensed provider is not an offence for the customer, but CSRO advises against it.
Most providers quote per endpoint or user after a scoping call, on top of the EDR licence. Microsoft Defender for Business, a common EDR base, is from US$3 per user a month as of October 2026, or included in Microsoft 365 Business Premium. Ask for quotes on the same scope, hours and response actions.
No. Defender for Business is EDR software with automated investigation and remediation, which handles many threats on its own. MDR adds people who watch the alerts around the clock and act on what automation misses. Many small businesses use Defender for Business with a provider reviewing alerts.