Singapore: Cyber Trust Mark deadline for managed SOC providers is 31 December 2026
Singapore requires managed SOC providers, pen testers and CII auditors to hold the Cyber Trust Mark by end-2026, and CII owners by end-2027.
What happened
The Cyber Security Agency of Singapore (CSA) will require three groups to meet its Cyber Trust Mark (CTM) standard, to raise baseline cybersecurity and reduce supply chain risk across Singapore's 11 critical sectors. The requirement was announced at the Ministry of Digital Development and Information's Committee of Supply debates in 2026. The first deadlines fall at the end of this year.
Who is affected and when
- Licensed cybersecurity service providers offering managed security operations centre (SOC) monitoring or penetration testing: certification by 31 December 2026.
- Auditors of critical information infrastructure (CII): certification at organisation level by the end of 2026.
- CII owners: CTM Level 5 for the non-CII systems that support their business operations, by the end of 2027.
Level 5 is the highest tier and covers preparedness across 22 domains, including governance, asset protection and secure access.
What to do now
- Managed SOC providers and CII auditors in Singapore have less than three months left. Confirm your certification body and audit date now.
- CII owners should map their non-CII business systems against the 22 CTM domains and plan remediation for 2027.
Why it matters for SOC teams
The requirement reaches the providers that monitor critical infrastructure, not only the operators. Evidence of continuous monitoring, logging and incident response will be part of what assessors look for.
Sources
Prepared with AI assistance by the Claire Security research team, based on the sources listed.
Catch threats like these around the clock
Claire Security triages every alert with auditable AI, on your own servers.
Request a demo