The Cyber Essentials mark: what it takes to pass
CSA's baseline certification, in plain terms. Five control areas, most of them configuration rather than purchase, and subsidy available for Singapore SMEs.
The question that usually starts this conversation is not about security. It is that a larger client has sent through a vendor questionnaire, or a government tender asks for it, and somebody needs to work out how much effort is involved.
Short answer: less than most people expect, if your Microsoft 365 tenant is configured sensibly. More than they expect if it is not, and the gap between those two positions is mostly documentation.
What it is
The Cyber Essentials mark is the Cyber Security Agency of Singapore's baseline certification, aimed squarely at organizations without a dedicated security team. It sits below the Cyber Trust mark, which is the risk-based tier for larger or more heavily regulated organizations. For most SMEs, Cyber Essentials is the right target and Cyber Trust is not.
It is voluntary. It is also increasingly asked for in procurement and supplier vetting, and CSA has said it is looking at whether organizations handling sensitive data should hold one of the marks before bidding for government work. Voluntary in law, then, and steadily less optional in practice.
You cannot self-certify. A CSA-appointed certification body assesses you, and the mark is valid for two years.
Know what hardware, software, data and cloud services you have, and who is responsible for each. The inventory is the part most organizations do not have.
Anti-malware, access control including multi-factor authentication, secure configuration, and basic staff awareness.
Patching, on a defined schedule, covering applications and not only the operating system.
Essential data backed up, kept separate, and restored as a test rather than assumed to work.
A written incident response plan naming who does what, and evidence that someone has thought about it before an incident.
Cloud, AI and OT are now in scope
CSA expanded both marks to cover cloud security, AI security and operational technology. For an office-based business the cloud portion is the one that bites, because it means your Microsoft 365 or Google Workspace configuration is assessed rather than treated as somebody else's problem.
The AI section matters if staff use AI tools with company data, which at this point is most organizations whether or not anyone has approved it.
What you probably already have
If you are on Microsoft 365 Business Premium, a large share of the technical requirements is already licensed. Multi-factor authentication, Defender for Endpoint, Intune for patching and device configuration, and conditional access are all included. The work is switching them on properly and being able to show that you did.
Two gaps come up repeatedly. Backup is the first, because Microsoft 365 retention is not backup and the assessor will ask. The second is the asset inventory, which nobody maintains voluntarily and which underpins three of the five control areas.
Cost and funding
Certification bodies set their own fees, so get two quotes. CSA funding is available to Singapore-incorporated SMEs and non-profits, deducted directly from the certification fee, and it applies to your first successful certification only. There is also the CISO-as-a-Service scheme, with up to 70 percent co-funding for eligible SMEs engaging a consultant to get them ready.
Certified organizations are eligible for discounted rates from several cyber insurers, which is a genuine offset that rarely gets factored in.
An honest word on whether it is worth it
If a client or a tender is asking, the decision is made for you. If nobody is asking, the certificate itself is worth less than the work of preparing for it, and you can capture most of the value by running the gap assessment and fixing what it finds without ever paying a certification body.
That is a slightly awkward thing for an IT provider to say. It is also true, and we would rather tell you now than after an invoice.
Either way the first step is the same: work through the five areas against what you actually have, and write down the gaps. We do that as a fixed-scope exercise and it takes about a week.