Ransomware, phishing and data loss are no longer problems only for large companies. In its Singapore Cyber Landscape 2025/2026 report, the Cyber Security Agency of Singapore (CSA) noted an increase in ransomware attacks, with SMEs the most affected. The Cyber Essentials mark is CSA’s practical baseline to help Singapore SMEs protect themselves, and show customers that they take cybersecurity seriously.
This guide explains what the Cyber Essentials mark is, what it requires, and how to meet two of its most important requirements: endpoint protection and data backup.
Requirements in this article are based on CSA’s Cyber Essentials mark document (second edition, March 2025). Always refer to CSA’s latest documents and your certification body before you apply.
What Is the Cyber Essentials Mark?
The Cyber Essentials mark is a cybersecurity certification from CSA, designed for organisations with limited IT resources, such as SMEs. It sets out the basic cyber hygiene measures every organisation should have in place.
It is one of two tiers in CSA’s certification scheme:
- Cyber Essentials mark: the baseline tier, focused on essential protection
- Cyber Trust mark: a risk-based tier for organisations with higher risk profiles or more resources
A Cyber Essentials certification is valid for two years.
Why the Cyber Essentials Mark Matters for Singapore SMEs
- It reduces your risk. The measures target the attacks SMEs face most often, such as ransomware, malware and stolen passwords.
- It builds customer trust. Certified organisations can show independent proof that they follow good cybersecurity practices.
- It may be required by partners. CSA and IMDA have a version of the scheme for ICT vendors, including pre-approved vendors under the SMEs Go Digital programme.
- It gives you a clear plan. Instead of guessing what to fix first, you work through a defined set of requirements.
The Five Areas of Cyber Essentials
The Cyber Essentials requirements are grouped into five areas:
| Area | What it covers |
|---|---|
| Assets | People, hardware and software, and business-critical data |
| Secure/Protect | Virus and malware protection, access control and secure configuration |
| Update | Software updates |
| Backup | Backing up essential data |
| Respond | Incident response |
Two of these areas, malware protection and backup, are where many SMEs have the biggest gaps. They are also the areas that most directly protect you from ransomware.
Endpoint Protection: What Cyber Essentials Requires
Under the virus and malware protection requirements, your organisation should:
- Install malware protection on endpoints, such as laptops, desktops and servers
- Scan files automatically when they are accessed
- Keep protection up to date, with at least daily updates recommended
- Use firewalls to protect your network, systems and endpoints
Antivirus vs endpoint security
Basic antivirus mainly blocks known threats. Modern endpoint security adds behaviour-based detection, so it can spot suspicious activity, such as ransomware starting to encrypt files, even when the threat is new.
How Acronis Endpoint Security helps
Acronis Endpoint Security provides real-time anti-malware protection, ransomware protection, Endpoint Detection and Response (EDR), behavioural analysis, URL filtering and vulnerability assessment from one console. This helps you meet the malware protection requirements and see which devices are protected. Your network firewall is a separate control that should also be in place.
Data Backup: What Cyber Essentials Requires
The backup requirements focus on making sure you can actually recover your business. Your organisation should:
- Identify and back up business-critical data and systems, such as accounting, customer and operational data
- Back up regularly, at a frequency that matches how much data your business can afford to lose
- Store backups separately, isolated from your normal operating environment, with offsite storage recommended where feasible
- Protect backups from unauthorised access
- Automate backups where feasible
- Test your backups, with restore tests at least twice a year recommended
Why “separate and isolated” matters
Ransomware often targets backups as well as live files. If your only backup is a drive permanently connected to the same computer or network, it can be encrypted in the same attack. Keeping backups separate and protected is what makes recovery possible.
How Acronis Backup helps
Acronis Backup encrypts your data before it leaves your computer, runs on a schedule you set and lets you restore files when you need them. It can protect files, servers and Microsoft 365 data, which supports the backup requirements and makes regular restore testing easier.
The Other Cyber Essentials Requirements at a Glance
Asset inventory
Keep an up-to-date list of your hardware, software and business-critical data. Remove unauthorised or end-of-support assets.
Access control
Give staff access only to what their role needs, remove accounts that are no longer required, change default passwords, lock accounts after repeated failed logins and use multi-factor authentication (MFA) for administrative access to important systems.
Secure configuration
Apply security settings to computers, servers and routers, replace insecure settings and weak protocols, and disable features or services you do not use.
Software updates
Prioritise critical and important updates from official sources, and consider automatic updates for critical patches. Vulnerability assessment tools can help you find devices that are missing updates.
Incident response
Have a basic, up-to-date incident response plan that covers threats such as ransomware, social engineering and data breaches. Make sure staff know it, and review it at least once a year.
How to Get the Cyber Essentials Mark
- Download CSA’s self-assessment template for the Cyber Essentials (2025) scheme.
- Assess your organisation against each requirement and note any gaps.
- Close the gaps, for example by putting endpoint protection, backup, MFA and an incident response plan in place.
- Engage a CSA-appointed certification body. An independent assessor will review and verify your self-assessment.
- Receive your certification, which is valid for two years.
Certification fees and timelines vary by certification body and by the scope of your organisation, such as the number of endpoints, so check with the certification body directly.
Funding Support for Cyber Essentials
CSA certification funding
CSA provides funding support for the first successful Cyber Essentials certification of Singapore-incorporated SMEs and non-profit organisations. The support is deducted from the certification body’s fees and depends on your number of endpoints. For example, it is S$250 for organisations with 1 to 5 endpoints. CSA states this support is available until 6 February 2028.
EDGE grant support for endpoint security and backup
To close the endpoint protection and backup gaps, eligible SMEs can apply for up to 50% support under Enterprise Singapore’s EDGE grant for pre-approved solutions. Ostendo’s Acronis endpoint security and backup packages are supported under EDGE. Read our guide: EDGE Grant for Cybersecurity.
Quick Cyber Essentials Readiness Checklist
- Do we have a current list of our devices, software and critical data?
- Does every laptop, desktop and server have up-to-date malware protection?
- Is a firewall protecting our network?
- Are critical updates installed promptly?
- Have we removed old accounts and changed default passwords?
- Is MFA turned on for admin accounts and important systems?
- Are our business-critical data and systems backed up automatically?
- Are our backups stored separately and protected from unauthorised access?
- Have we tested a restore in the last six months?
- Do we have an incident response plan that staff know about?
If you answered “no” or “not sure” to any of these, that is where to start.
How Ostendo Can Help You Prepare
Ostendo helps Singapore SMEs put practical cybersecurity in place through our IT support services. We can help you:
- Review your current protection against the Cyber Essentials requirements
- Deploy Acronis endpoint security and backup, with EDGE grant support for eligible SMEs
- Set up automated, encrypted backups and test your restores
- Strengthen Microsoft 365 security, including MFA
- Monitor your devices and backups on an ongoing basis
Ostendo is not a certification body. Your certification is assessed independently by a CSA-appointed certification body.
Want to know where you stand? WhatsApp us or contact us to review your endpoint protection and backup.
Cyber Essentials Mark: Frequently Asked Questions
Is the Cyber Essentials mark compulsory?
It is not compulsory for all businesses. However, some programmes and partners may require it. For example, CSA and IMDA have a version of the scheme for ICT vendors, including pre-approved vendors under SMEs Go Digital.
How long is the Cyber Essentials mark valid?
Two years from certification.
What is the difference between Cyber Essentials and Cyber Trust?
Cyber Essentials is the baseline tier for essential cyber hygiene. Cyber Trust is a risk-based tier for organisations with higher risk profiles or more resources.
Is antivirus enough for Cyber Essentials?
You need malware protection on endpoints that scans files on access and stays updated, plus a firewall. Modern endpoint security also adds behaviour-based detection, which gives better protection against ransomware.
How often should we test our backups?
CSA recommends testing backups at least twice a year, or more often if your business needs it.
Is there funding for Cyber Essentials certification?
Yes. CSA provides funding support for the first successful certification of Singapore-incorporated SMEs and non-profit organisations, available until 6 February 2028. Separately, eligible SMEs can apply for EDGE grant support for pre-approved endpoint security and backup solutions.
