Since the introduction of Singapore’s licensing framework for cybersecurity service providers in 2022 under the Cybersecurity Act 2018, the cybersecurity landscape has been continually evolving. Cybersecurity service providers play an increasingly important role in the security of organisations and Singapore’s cyber resilience, and must thus be held to appropriate standards of competence and reliability.
The Cyber Security Agency of Singapore (“CSA“) is thus seeking industry feedback on proposed changes to the existing licensing framework for cybersecurity service providers. The changes seek to: (i) raise baseline cybersecurity standards; and (ii) enhance clarity on the licensing requirements.
The key proposed changes include the following:
- Introduction of cyber and data hygiene requirements: CSA is proposing for cybersecurity service provider licensees to demonstrate their commitment to good cyber and data hygiene measures by obtaining mandatory hygiene certifications.
- Mandatory certification requirements: Licensees will need to obtain and maintain the following certifications for the duration of their licence: (i) minimum Cyber Trust Mark (“CTM“) Promoter (Tier 3) or its equivalent; and (ii) Data Protection Trust Mark (“DPTM“) SS 714:2025 or its equivalent.
- Changes to licensing timeframes: CSA is proposing to introduce other changes to the licensing conditions to reduce regulatory friction and improve operational clarity for licensees. These include: (i) an extension of licence validity from two years to five years; (ii) an extension of licence renewal timeframes; (iii) simplified notification obligations; and (iv) a revision to information required in a licence application.
- Implementation timeline: CSA intends to implement the changes to the licensing framework progressively from January 2026. The cyber and data hygiene requirements will be implemented in phases.
- A grace period to obtain the required CTM certification will be in effect until 31 December 2026 for new licensees and for those who renewed their licences in 2026.
- A grace period for licensees to obtain the required DPTM SS 714:2025 certification will be in effect until 31 December 2027 for all licensees.
The consultation period ends on 21 October 2025.
Click on the following link for more information:
- Consultation Paper on the Licensing Framework for Cybersecurity Service Providers (available on the REACH website at reach.gov.sg)
Disclaimer
Rajah & Tann Asia is a network of member firms with local legal practices in Cambodia, Indonesia, Lao PDR, Malaysia, Myanmar, the Philippines, Singapore, Thailand and Vietnam. Our Asian network also includes our regional office in China as well as regional desks focused on Brunei, Japan and South Asia. Member firms are independently constituted and regulated in accordance with relevant local requirements.
The contents of this publication are owned by Rajah & Tann Asia together with each of its member firms and are subject to all relevant protection (including but not limited to copyright protection) under the laws of each of the countries where the member firm operates and, through international treaties, other countries. No part of this publication may be reproduced, licensed, sold, published, transmitted, modified, adapted, publicly displayed, broadcast (including storage in any medium by electronic means whether or not transiently for any purpose save as permitted herein) without the prior written permission of Rajah & Tann Asia or its respective member firms.
Please note also that whilst the information in this publication is correct to the best of our knowledge and belief at the time of writing, it is only intended to provide a general guide to the subject matter and should not be treated as legal advice or a substitute for specific professional advice for any particular course of action as such information may not suit your specific business and operational requirements. You should seek legal advice for your specific situation. In addition, the information in this publication does not create any relationship, whether legally binding or otherwise. Rajah & Tann Asia and its member firms do not accept, and fully disclaim, responsibility for any loss or damage which may result from accessing or relying on the information in this publication.
