In brief
In a joint response to a public forum letter, the Monetary Authority of Singapore (MAS) and the Cyber Security Agency of Singapore (CSA) announced that they are considering requiring vendors to obtain national cybersecurity certifications, namely the Cyber Essentials or Cyber Trust mark, before they can be licensed or bid for government contracts involving access to sensitive data or systems.
This move follows a recent data breach involving a third-party vendor and underscores the growing regulatory focus on third-party cybersecurity risks.
In more detail
The joint statement by the MAS and CSA, published on 21 April 2025, was issued in response to a forum letter in The Straits Times that raised concerns about third-party cybersecurity vulnerabilities.
In their response, the MAS and CSA acknowledged the importance of extending cybersecurity standards beyond an organization’s internal systems to include its third-party service providers. They reiterated that financial institutions are already expected to implement stringent controls over vendors handling customer data and to regularly assess the adequacy of these controls.
More significantly, the agencies revealed that they are assessing the possibility of making the CSA’s Cyber Essentials or Cyber Trust mark a mandatory requirement for vendors seeking to be licensed or to participate in government procurement processes involving sensitive data or systems.
These marks are part of Singapore’s national cybersecurity certification framework:
- Cyber Essentials Mark: Designed primarily for small and medium enterprises (SMEs), this certification outlines baseline cybersecurity measures that organizations should implement to protect against common threats and enhance digital resilience, in the key areas of cloud security, operational technology security and AI security.
- Cyber Trust Mark: Aimed at organizations with more extensive digitalized business operations that are likely to have higher risk levels, this certification involves a more comprehensive assessment of cybersecurity practices, governance and risk management.
Attaining the Cyber Essentials or Cyber Trust mark demonstrates an organization’s commitment to robust cybersecurity practices, enhancing its reputation and trust among customers.
The agencies also highlighted support schemes to help organizations meet these standards. For instance, CSA’s Chief Information Security Officer-as-a-Service program offers up to 70% co-funding for eligible SMEs to implement cybersecurity measures aligned with the Cyber Essentials Mark.
The agencies emphasized that all organizations, including vendors, must take a proactive approach to cybersecurity, especially when entrusted with sensitive data or access to critical systems.
Key takeaways
This initiative is part of a broader effort by the CSA and sectoral regulators like the MAS to raise cybersecurity standards across the ecosystem.
If the MAS and CSA eventually require vendors to obtain the Cyber Essentials or Cyber Trust mark as a condition for licensing or bidding for government contracts involving sensitive data, this would represent a significant shift from voluntary to mandatory certification.
While there have not been any further announcements regarding implementation, interested businesses should begin assessing their readiness to obtain the relevant certifications.
Overall, this announcement is consistent with Singapore’s broader strategy to strengthen digital trust and resilience. It also shows that supply chain cybersecurity is “top of mind” for regulators, and demonstrates their increasing focus on the cybersecurity posture of vendors and service providers.
* * * * *
For further information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.
© 2025 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “principal” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
