🏅 Why Singapore organisations must act now — 2026 CTM enforcement is accelerating
Audit · Consultation · Training
Five tiers · Cloud · OT · AI Security · ESG/EDG grant managed
Audits
Baseline gap assessment · Cloud Security audit · OT/ICS audit · AI Security audit · Pre-certification readiness audit.
Explore audit →Consulting
Full certification · Cloud track · OT/ICS track · AI Security + ISO 42001 · Tier upgrade · Integrated CTM+ISO27001.
Explore consulting →Training
Awareness (EN/中文) · Cloud & OT technical workshop · Board governance · AI Security domain training.
Explore training →Framework — Five Preparedness Tiers
CSA Cyber Trust Mark: five tiers, 10–22 domains. Each tier adds domain coverage, control depth, and assessment rigour.
Essential Cyber Hygiene (10 Domains)
Self-Assessment Questionnaire · Foundation level · Builds on Cyber Essentials Mark. Suitable for SMEs, ICT vendors.
- 📦 Asset Management
- 🔐 Secure Configuration
- 🔄 Software Security
- 🔑 Access Control
- 🛡️ Malware Protection
- 🌐 Network Security
- 📋 Security Policies
- 👥 Staff Awareness
- 🚨 Incident Response
- 💾 Backup & Recovery
Managed Controls (13 Domains)
Third-party assessment · SMEs to mid-size enterprises · Procurement-grade certification.
- + Asset Management (Enhanced)
- + Identity & Access Mgmt
- + Network Security (Enhanced)
- + Vulnerability Management
- + Change Management
- + Supplier Risk Management
- + Incident Management (CSIRT)
- + Data Protection (PDPA)
- + Business Continuity
- + Security Governance
- + Compliance Management
- + Security Training (Role-based)
- + Security Monitoring (Basic)
Advanced Cyber Risk Mgmt (16 Domains)
Independent assessment · Cloud/OT tracks unlock. Large enterprises, FinTech, Telecom.
- + Penetration Testing
- + Application Security (SAST/DAST)
- + Threat Intelligence
- ☁️ Cloud Security (Track A)
- ⚙️ OT Security (Track B)
- + Security Monitoring (Advanced/SIEM)
Proactive & Resilient (19 Domains)
Rigorous independent assessment · AI Security track unlocks. Large CII, data centres.
- + Red Team / Purple Team Exercises
- + Zero Trust Architecture
- + Supply Chain Security (Advanced)
- 🤖 AI Security (Track C)
- + Cyber Crisis Management
- + Digital Forensics & IR
Excellence in Cyber Governance (22 Domains)
Full independent + regulator-informed · CII operators target by end-2027.
- + Cloud Security (Full Track)
- + OT Security (Full Track / IEC 62443)
- + AI Security (Full Track / SS 712:2025)
- + Board-Level Cyber Governance
- + Cyber Threat Intelligence (Advanced)
- + Cross-Sector Risk Management
Three Specialisation Tracks
Cloud Security · OT Security · AI Security — unlocked at Tier 3 and above
Cloud Security
Cloud governance framework, configuration security, IAM/PAM, data encryption & sovereignty, cloud network security, cloud SIEM, cloud IR, container security. IMDA cloud guidelines & MAS TRM aligned.
Explore Cloud Security →OT Security
OT asset inventory, Purdue model network segmentation, OT patch management, OT access control, OT-native SIEM/IDS, OT incident response, IEC 62443 alignment. EMA Cybersecurity Code & NEA mapped.
Explore OT Security →AI Security
AI asset inventory, AI risk assessment, model security controls, adversarial ML testing, AI supply chain security, AI monitoring & logging, AI incident response. SS 712:2025 + ISO 42001 integrated.
Explore AI Security →50% ESG / EDG grant co-funding — up to 50% of CTM consultation costs
Enterprise Singapore's EDG covers up to 50% of qualifying cybersecurity consultancy fees for eligible Singapore SMEs. ICFC manages your grant application before project commencement. Combined CTM + Cyber Essentials + ISO 27001 engagements maximise total co-funding. Transparent fixed pricing.
Check grant eligibility →
CSA Cyber Trust Mark — tier comparison at a glance
| Criteria | Tier 1 | Tier 2 | Tier 3 | Tier 4 | Tier 5 |
|---|---|---|---|---|---|
| Domains covered | 10 | 13 | 16 | 19 | 22 |
| Assessment method | SAQ + assessor | 3rd-party | Independent | Rigorous independent | Regulator-informed |
| Cloud Security track | – | – | ✓ | ✓ | ✓ |
| OT Security track | – | – | ✓ | ✓ | ✓ |
| AI Security track | – | – | – | ✓ | ✓ |
| Typical ICFC timeline | 4–8 wks | 6–10 wks | 3–5 mo | 4–7 mo | 6–12 mo |
Head of Technology
Colocation Data Centre
“ICFC guided our data centre through CTM Tier 4 including Cloud Security and AI Security tracks in under 5 months. Their depth across all 22 domains is exceptional. Best CTM consultant in Singapore.”
Group CISO
Energy CII Operator
“CTM Tier 5 with OT Security was non-negotiable. ICFC delivered OT domain alongside EMA Cybersecurity Code in a single engagement — no duplicated effort, one grant claim. Outstanding value.”
FAQs — CSA Cyber Trust Mark
Start your Cyber Trust Mark journey today
Free 30-minute CTM readiness assessment. Tier selection guidance. Cloud, OT & AI Security track scoping. ESG/EDG grant eligibility check included. CII, FinTech, Data Centre specialists.