Cyber Trust is CSA's risk-based cybersecurity certification for Singapore organisations with meaningful digital operations. Tiered by risk, assessed by a CSA-appointed CB, valid 3 years with annual audits. CSA co-funds first certifications.
LowerPlane serves startups in the United States, Singapore, India and worldwide.
Entry-level cyber hygiene for small operations.
Expanded controls across identity, access, and backups.
Risk-based control sets with governance oversight.
Formalised risk programme with measurable outcomes.
Enterprise-grade governance and continuous improvement.
Your CB confirms tier placement during scoping. The 2025 scheme adds optional Cloud, OT and AI security pillars that extend the audit scope.
Five steps from scoping to the Cyber Trust mark.
Teams already running SOC 2 or ISO 27001 share identity, access, logging, incident response, vendor risk, encryption and change-management controls with Cyber Trust. LowerPlane maps SOC 2 TSC and ISO 27001 Annex A against Cyber Trust tiers so you re-use the evidence pack and add only scheme-specific documentation. The CSA-appointed CB still performs the audit itself.
Three years. CSA requires annual audits during that period and recertification at the end of year three.
First-certification funding is available for Singapore-incorporated SMEs and NPOs. The published support reaches up to S$3,600; eligibility rules and current amounts should be reconfirmed at the CSA page before applying.
No. Cyber Trust is voluntary. It can become effectively required when a customer contract, government procurement tender, or licensing regime names it specifically, but the base scheme is opt-in.
The scheme is designed for organisations operating in Singapore. Foreign-incorporated vendors with a Singapore entity typically pursue it; vendors with no SG footprint should check with CSA before engaging a certification body.
Tiers rise with the organisation's risk level. Supporter / Practitioner are closer to foundational controls for simpler estates. Promoter / Performer / Advocate reflect progressively deeper governance maturity, formal risk programmes, and continuous improvement. Your CSA-appointed CB confirms tier placement during scoping.
No — only CSA-appointed certification bodies can issue the Cyber Trust mark. CSA maintains the list of appointed CBs. Many SAC-accredited ISO 27001 CBs are also CSA-appointed, so running both audits with the same firm is common.
The 2025 scheme does not strictly mandate a pen test, but CBs typically expect evidence of regular technical testing at higher tiers (Performer / Advocate). An annual internal + external pen test satisfies most CBs across Cyber Trust, ISO 27001 and SOC 2 at once.
Cyber Trust is risk-based and typically shorter on documentation requirements than ISO 27001. ISO 27001 requires a formal ISMS, Statement of Applicability, internal audit and management review. For teams that already run ISO 27001, adding Cyber Trust is incremental.
One evidence pack, two or three certifications. LowerPlane maps the overlap and your advisor runs the audit calendar.