Cyber Trust mark readiness
Prepare for Singapore’s Cyber Trust mark (2025).
CSA certifies five tiers across 22 domains. We are not a certification body. We prepare 10 delivery areas with Microsoft 365, ARGIS, SOC, your existing firewall, twice-yearly testing and Kynet.
About the Cyber Trust mark
CSA Cyber Trust (2025). A different scheme from Japan’s SCS.
Published as SS 712:2025
The 2025 edition can include classical security plus cloud, OT and AI. Cyber Trust (2022) is no longer in use from February 2026.
Five tiers, 22 domains
Supporter, Practitioner, Promoter, Performer and Advocate — 10, 13, 19, 21 and 22 domains. The tier comes from the risk assessment. We do not award it.
How certification works
Before a certification body is engaged, the organisation completes a two-part self-assessment of inherent risk and preparedness. A CSA-appointed body then checks documents and whether the controls work. The mark lasts three years, with a yearly audit.
Cyber Essentials is a separate baseline mark. Its measures map to the Supporter and Practitioner tiers. Source: CSA, “Certification for the Cyber Trust mark” (updated October 2026) and the Cyber Trust mark document (April 2025).
The 22 domains CSA assesses
Higher tiers are assessed on more domains
Cyber governance and oversight
Governance, policies and procedures, risk management, cyber strategy, compliance and audit.
Cyber education
Training and awareness.
Information asset protection
Asset management, data protection and privacy, backups, BYOD, system security, anti-malware and secure development.
Secure access and environment
Access control, cyber threat management, third-party risk, vulnerability assessment, physical and environmental security, and network security.
Cybersecurity resilience
Incident response, and business continuity and disaster recovery.
Domain names follow the Cyber Trust mark (2025). The requirement statements stay in the standard. They are not reproduced here.
How we prepare you
Ten delivery areas, before a certification body is engaged
These 10 areas are our delivery baseline. They do not replace CSA’s 22 domains. ARGIS is installed on your own servers.
Protect
Entra ID, Defender and Purview for identity, endpoints and data.
- Identity
- Endpoint security
- Data security
Watch and respond
Third-party logs, vulnerability follow-through, unified logging and incident response on ARGIS and the SOC.
- Third-party and SaaS
- Vulnerability management
- Logging, monitoring and response
Test and train
Tune the firewall you already run, test twice a year, and train with Kynet twice a year.
- Network
- Security testing
- Security awareness
Delivery baseline
The 10 areas Flyingnets puts in place
Focus, product and remote work for each area. Scope and effort are quoted for each site.
Third-party / SaaS security
SaaS apps, shadow IT and third-party systems.
- ARGIS AI SIEM, ingesting third-party logs
- SOC: monitoring, analysis and response guidance
Identity
MFA, admin rights, account lifecycle and least privilege.
- Microsoft 365 Business Premium — Entra ID
- MFA, Conditional Access and permission policies
Endpoint security
EDR, anti-malware, device compliance, unified management and patching.
- Microsoft 365 Business Premium — Defender
- EDR rollout and endpoint hardening
Network
Firewall rules, network segmentation and VPN.
- The firewall you already run
- Rule tuning and remote operations. A new firewall is not part of this baseline.
Vulnerability management
Finding vulnerabilities, ranking them, and tracking fixes to closure.
- ARGIS AI SIEM
- SOC: monitoring, analysis and response guidance
Data security
Classification, information protection, DLP, encryption and sensitive-data handling.
- Microsoft 365 Business Premium — Purview
- Classification, DLP and data-protection configuration
Logging and security monitoring
Firewall, server, endpoint and cloud logs in one place, with alert correlation.
- ARGIS AI SIEM for unified log management
- SOC: monitoring, analysis and response guidance
Incident response
Alert analysis, investigation, response and automated handling.
- ARGIS AI SIEM for alert analysis and handling
- SOC: monitoring, analysis and response guidance
Security testing
Vulnerability scanning and penetration testing.
- Our testing toolkit
- Twice a year, with a written report
Security awareness
Staff training, phishing risk and attack simulation.
- Kynet
- Phishing exercises twice a year, with a written report
How it works
From a readiness check to a file a certification body can review
- 01
Fix the scope
Business, data, suppliers, and whether cloud, OT or AI are in scope.
- 02
Check the 10 areas
Find gaps against our delivery baseline. This step does not assign a CSA tier.
- 03
Put the controls in
Microsoft 365, ARGIS, SOC, your existing firewall, testing and Kynet.
- 04
Keep the records
Policies, configuration, monitoring records, and the twice-yearly test and training reports.
- 05
Go to a certification body
A CSA-appointed certification body assesses you. The mark lasts three years, with a yearly audit.
Readiness check
See which of the 10 areas already have controls and records
This is not CSA’s official self-assessment, and it does not produce a tier. The result is shown on the page.
FAQ
Q.Which tier should we aim for?
The tier is the result of the risk assessment in CSA’s process. We do not award a tier or choose one for you. We help you sort which domains apply, from your business, data and suppliers.
Q.Do we need to buy more Microsoft licenses?
Not necessarily. Identity, endpoint and data controls in this baseline use Microsoft 365 Business Premium (Entra ID, Defender and Purview). We check what you already have before recommending anything else.
Q.Do you certify us?
No. CSA-appointed certification bodies assess you. We prepare the 10 delivery areas, the operations and the records.
Q.Is this the same as Japan’s SCS?
No. Japan’s SCS is a different scheme, with its own seven-area self-check. Singapore’s Cyber Trust mark has five tiers and 22 domains.
Start with a free readiness check.
We will propose a configuration that fits your size, licenses and goals.