Most cybersecurity advice is written for organisations with an IT department. Most small businesses in Singapore do not have one. They have an owner who handles the laptops, a shared login for the booking system, and a vague sense that something ought to be done.
The Cyber Essentials mark, run by the Cyber Security Agency of Singapore (CSA), is one of the few frameworks written for exactly that situation. It is aimed at organisations that are starting out on cybersecurity, and it describes a baseline rather than a programme.
This post covers what it asks for, in plain terms, and how to decide whether certifying is worth it for you. For fees, the current list of assessment bodies and any support schemes, check CSA's own pages, because those details change and we would rather send you to the source than quote something stale.
Two marks, and which one is meant for you
CSA runs two marks. Cyber Trust is for organisations with more mature practices and more digital exposure, and it scales with risk. Cyber Essentials is the entry point: a fixed set of basic measures that any organisation, however small, should have in place.
If you are reading a blog post to find out what the difference is, Cyber Essentials is almost certainly the one that applies to you.
Assets: know what you have
You cannot protect what you have not listed. The first area asks you to know your devices, your software and accounts, and your important data, and to make sure the people using them know the basics.
For a small business this is a one-page inventory: the laptops and phones used for work, who uses each one, the online services the business depends on, and where customer information actually lives. Most owners discover at least one account nobody remembers creating, or a former staff member's device that still has access.
Secure: protect what is on the list
This covers malware protection, access control and secure configuration. In practice: protection switched on and current on every work device, each person with their own login rather than a shared one, administrator rights limited to the people who need them, and default passwords changed on anything that shipped with one.
Shared logins are the common gap. They are convenient until someone leaves and nobody can say what they still have access to. Two-step verification on email and on anything that holds customer data is the single most useful change most small teams can make here.
Update: keep it supported
Software updates fix known weaknesses, and attackers rely on the ones nobody applied. This area asks for updates to be applied in good time, and for software that no longer receives updates to be replaced rather than kept running.
Turning on automatic updates covers most of it. The harder part is the old machine in the corner running something that cannot be updated because a single piece of software depends on it. That is worth a decision, written down, rather than a shrug.
Backup: and try the restore
Essential data should be backed up, and the backup should be separate enough that whatever damages the original does not damage the copy too. Ransomware that encrypts a laptop will happily encrypt a backup drive that is plugged into it.
The step people skip is the restore. A backup nobody has tried to recover from is a hope, not a backup. Pick one important file, restore it to a different place, and confirm it opens. Then put a date in the calendar to do it again.
Respond: decide before it happens
The last area asks you to be ready to detect, respond to and recover from an incident. For a small business, that means a short written plan: who to call, which accounts to lock first, how to reach customers if the usual channel is compromised, and who needs to be told.
If the business holds personal data, that last point overlaps with the PDPA's breach notification duties, which we covered in our PDPA checklist. Working out the order of steps in advance is what turns a bad afternoon into a manageable one.
Is certifying worth it?
That depends on who is asking.
If a client, a larger partner or a tender asks for the mark, the answer is straightforward: it is a cost of winning that work, and the preparation will improve your security as a side effect.
If nobody is asking, the certification is optional, but the five areas are not. Working through them honestly is the cheapest meaningful security improvement most small teams can make, and it costs an afternoon and some follow-up rather than a consultant.
Either way, start with the inventory. Every other step depends on it.
When we build software for a client, the same baseline applies to what we hand over: individual accounts, access the client controls, and documentation that says where the data lives. If you want a second opinion on how one of your current tools measures up, we are happy to look at it with you.
