CSA Cyber Essentials mark
The CSA Cyber Essentials mark shows that an organisation has basic cyber hygiene controls in place, such as asset management, secure configuration, access control, malware protection and backups. It is valid for two years and is issued by CSA-appointed certification bodies. ICFC prepares you, closes gaps, and trains your staff.
Cybersecurity, IT and Data Protection
- Standard or scheme
- CSA
- Cyber Security Agency of Singapore (CSA)
- Type
- Scheme
- Awarded under the scheme owner's rules
- Funding
- CSA certification funding
- S$250 to S$650 for the classical pillar plus S$50 to S$100 per added pillar, first certification only, until 6 February 2028
What is CSA?
Cyber Essentials recognises organisations that have put basic cyber hygiene in place.
CSA also runs variants for ICT vendors, healthcare (HIA entities) and healthcare system (HIMS) vendors.
Who is CSA for?
SMEs and non-profits starting their cybersecurity journey, and suppliers asked by customers for a recognised baseline.
Key details
What is checked
Assets, secure settings, updates, access controls, malware protection, backups and incident readiness, scaled for smaller organisations. Cloud, OT and AI security can be added as pillars.
CSA certification funding - S$250 to S$650 for the classical pillar plus S$50 to S$100 per added pillar
This mark is funded by CSA rather than EDGE. CSA funds the first successful certification only, for SMEs and non-profit organisations incorporated in Singapore, until 6 February 2028. The amount is deducted from the fee charged by the CSA-appointed certification body. Consultancy fees are not covered by this funding.
Classical pillar
For the classical pillar, CSA's maximum support ranges from S$250 (1 to 5 end-points) to S$650 (101 to 200 end-points).
Added cloud, OT or AI pillars
S$50 to S$100 for each added cloud, OT or AI pillar. Separate amounts apply to HIA entities and HIMS vendors.
Eligibility
First certification only, for Singapore-incorporated SMEs and non-profits, until 6 February 2028. Figures from CSA, checked 11 October 2026.
Impartiality
Impartiality comes first. Every engagement begins with a conflict-of-interest check. We keep consulting and auditing roles separate, and our auditors never audit, on behalf of a certification body, an organisation that ICFC has consulted on the same scope within the period set by that body.
Our certification role
We do not certify organisations ourselves; certificates are issued by accredited certification bodies or scheme owners.
How we help
Third-party assessments
Certification is awarded under the scheme run by the Cyber Security Agency of Singapore (CSA). Where appointed, our auditors carry out assessments on behalf of the certification body; the certificate or mark is never issued by ICFC.
Second-party audits
Supplier and partner checks against the scheme requirements, on behalf of your organisation.
Readiness and internal audits
A pre-assessment that shows exactly what the formal assessment will look for, with a prioritised action list.
Funding
CSA's certification funding is deducted by the certification body from its own fee. Our consultancy is quoted separately and is not covered by that funding.
Non-grant
A fixed-scope engagement: gap assessment, documentation, implementation coaching, internal audit and management review, and support through the formal audit or assessment.
How we work
Practical, proportionate systems that your staff can run after we leave.
Classroom
Public and in-house classroom courses on Cyber Essentials mark: awareness, implementation and internal auditor levels.
Online LMS
Self-paced and live-online courses on the ICFC Digital LMS, with progress tracking and certificates of completion.
Funding
Funding depends on each course's approval status, shown on the course page in the LMS.