Last updated 21 October 2026 — by Adrian Tan, SDM. Marketing guidance, not legal advice. References are to the Cybersecurity Act 2018 (as amended by the Cybersecurity (Amendment) Act 2024) and the Cybersecurity (Cybersecurity Service Providers) Regulations 2022 on Singapore Statutes Online as at 21 October 2026, read with CSA and CSRO guidance. Where we infer how a rule applies, we say so.
Security sells. A managed-services provider puts “VAPT” on its service menu, a SaaS start-up adds a Cyber Trust badge to its pricing page, an online store lists a router with a CSA label, and every one of them hopes the word “secure” will tip a cautious buyer over the line.
In Singapore, each of those moves sits under a specific rule that most marketing teams have never read. Advertising certain cybersecurity services without a licence is a criminal offence in its own right, separate from actually providing them. The Cyber Security Agency’s (CSA) logo is now protected by statute. The Cybersecurity Labelling Scheme dictates exactly how a label may appear in an ad. And a Cyber Trust mark certifies an organisation, not the product you are trying to sell with it.
This guide is for anyone who writes the copy: in-house marketers at security and IT firms, agencies running their campaigns, SaaS founders, and e-commerce sellers of connected devices. It sets out what each scheme allows you to say, the penalties, the gaps where no rule exists yet, and five worked examples.
Three credentials, three rulebooks
Most confusion starts with treating three different things as one. They cover different subjects, last for different periods and come with different marketing rules.
Part 1: selling cybersecurity services
The advertising offence most firms miss
Part 5 of the Cybersecurity Act 2018 licenses cybersecurity service providers. Section 24(1) contains two separate prohibitions. Paragraph (a) bans carrying on the business of providing a licensable cybersecurity service without a licence. Paragraph (b) bans a person in that business from advertising, or in any way holding out, that it provides the service without a licence under section 26.
That second limb is the one marketers need. The offence is committed by the ad itself: a service page, a Google Ads campaign, a LinkedIn post, a capability deck or a tender response that offers the service. You do not need to have delivered a single engagement. The penalty under section 24(2) is a fine of up to $50,000, imprisonment of up to two years, or both. Section 31 adds a commercial sting: an unlicensed provider cannot sue to recover its fees.
Only two services are licensable
The Second Schedule to the Act lists exactly two licensable services:
- Managed security operations centre (SOC) monitoring, meaning monitoring a client’s systems to identify cybersecurity threats; and
- Penetration testing, which the Act defines broadly to include demonstrating vulnerabilities, simulating attacks in the manner of a red team, quantifying vulnerabilities and social engineering.
The 2024 amendments added “virtual computer” and “virtual system” to the definitions, so testing or monitoring cloud and virtual environments is in scope too. The point for copywriters: do not assume an acronym is safe. “VAPT”, “red teaming”, “ethical hacking”, “phishing simulation” and “24/7 threat monitoring” can each describe a licensable service depending on what is actually delivered. Services outside the two categories, such as general IT support or security awareness training that involves no testing, are not licensable under the Act. Do not stretch that to services the Act does not mention. Check with the regulator if your service sits near the line.
Who needs the licence
The Cybersecurity Services Regulation Office (CSRO) FAQ fills in the practical detail:
- Overseas firms that advertise these services to Singapore are in scope.
- Resellers need their own licence, even if the work is done by a licensed partner. White-labelling a partner’s SOC does not borrow the partner’s licence.
- Each entity in a group, and each service type, is licensed separately, and licences cannot be transferred. Section 24(3)-(4) exempts services provided to a related company.
- Employees working for their employer do not need a personal licence.
Licences now run for up to five years (section 28). Under regulation 3 of the 2022 Regulations, the fee after the initial period is $250 a year for individuals and $500 a year for businesses, so a five-year licence costs $1,250 or $2,500, as the CSRO FAQ confirms. Applications go through GoBusiness. Note that the GoBusiness listing still showed the older two-year figures when we checked, so rely on the Regulations and the CSRO.
How you may describe your licence, and the logo you may not use
Neither the Act nor the Regulations require a licensee to display its licence. CSRO’s FAQ says licensees may describe their licensed status in words or point readers to the public CSRO register, but may not use the CSA or CSRO logo for publicity.
Since 31 October 2025 there is a statutory reason to take that seriously. New section 6A(3) makes it an offence to use CSA’s gazetted symbol, or one so similar that it is likely to deceive, without written permission. The maximum penalty is a $5,000 fine, six months’ imprisonment, or both. A designer who drops the CSA crest into a “licensed provider” banner is putting your business on the wrong side of a criminal provision.
A clean form of words: “Licensed by the Cybersecurity Services Regulation Office to provide penetration testing services in Singapore (licence no. [X]). Verify on the CSRO register.”
Licence conditions reach your marketing
CSA’s closing note to its 2026 consultation on the licensing framework sets out updated conditions that bite on marketing directly. Condition 3.1(a) prohibits false representations “in the course of advertising or providing the Service”. Condition 6.1 requires licensees to hold a Cyber Trust mark at Promoter tier (Tier 3) or an equivalent; ISO/IEC 27001 is the only recognised equivalent, and SOC 2 Type II is not. The closing note gives a grace period to 31 December 2026, while the CSRO FAQ refers to the requirement applying to applicants from 16 March 2026. Those two dates do not obviously sit together, so if you are applying or renewing, confirm the date that applies to you with CSRO. Section 32 allows financial penalties of up to $10,000 per breach of a condition, and section 30 allows suspension or revocation.
A licence condition against false advertising matters because the Consumer Protection (Fair Trading) Act protects consumers, not business buyers. Most security services are sold B2B, so for a licensee the licence condition is a more direct check on overclaiming than consumer law.
Part 2: Cyber Essentials and Cyber Trust marks
CSA’s two organisational certifications are now both based on SS 712:2025. Cyber Essentials is for organisations starting out. It lasts two years and is certified by a desktop review of a self-assessment. Cyber Trust is risk-based, lasts three years with yearly surveillance audits, and comes in five tiers: Supporter, Practitioner, Promoter, Performer and Advocate. Certification is done by CSA-appointed certification bodies, and CSA publishes directories of certified organisations that anyone can search.
Two rules shape what you can say:
- It is an organisation mark, not a product mark. Both standards state that the mark is not intended for product certification. “Our app is Cyber Trust certified” says something the certificate does not.
- The scope can be partial. The certified scope can be a single business unit, process or location (Cyber Essentials clause 4.3). A certificate covering the Singapore head office does not cover the overseas development team that builds the product.
So the honest formula is: “[Company] holds the Cyber Trust mark (Promoter tier) under SS 712:2025 for [scope], valid to [date].” We could not find published terms of use for the mark logos themselves on CSA’s pages or in the standards; those appear to be set by the certification bodies’ contracts, so ask yours before placing the logo on product pages, packaging or ads. The general principles in our guide to advertising ISO certifications and credentials in Singapore apply here too: name the standard, the scope and the expiry, and never imply the regulator certified your product.
Part 3: CLS labels on connected devices
The Cybersecurity Labelling Scheme (CLS) rates consumer smart devices at four levels, each label carrying an ID in the form CSA/IOTxxxxx and a QR code. It is voluntary for most products, but residential Wi-Fi routers sold in Singapore must meet Level 1. CSA announced on 2 March 2026 that this will rise to Level 2, expected by the end of 2027, and that around 870 products held a label by mid-February 2026. Our guide to selling telecom equipment online in Singapore covers the IMDA side of router listings.
The scheme’s publication CLS(IoT) SP-151-1 (v1.4) is unusually specific about marketing:
- Display: the label goes on the product or its packaging within six months, and must be prominent at every point of sale, physical or online. Online, it belongs in the product page’s description, images or specifications, tied to the specific model.
- Advertising (section 14.1): the label may be used in ads, but the listed product name and model number must appear with it. Where space is too small for the label, the rating must still be shown prominently. The label may not be altered except to resize it or use a monochrome version, and all promotional wording must include the URL go.gov.sg/csa-cls.
- Banned wording: you may not say CSA has endorsed, recommended, approved or guaranteed the product.
- CSA’s own examples of misleading use: saying “all models labelled” when only one is, or claiming a higher level than the one issued.
- Validity: the label lasts as long as the manufacturer supports the device with security updates, up to three years (section 13.2). A product that has fallen out of support should not still be advertised as labelled.
- Enforcement (sections 14.2 and 15.1): CSA can order corrections, delist the product, publish a notice of misuse and revoke the label, after which the maker must stop holding the product out as labelled.
Part 4: “unhackable”, “bank-grade” and other security claims
Outside the three schemes, ordinary claims about security are judged under the general rules. For consumer products, the Consumer Protection (Fair Trading) Act 2003 Second Schedule lists, among unfair practices: claiming qualities or performance characteristics a product does not have (item 1); claiming an approval or affiliation the supplier does not have (item 2, which fits a false “CSA-approved”); and claiming a standard or grade the product does not meet (item 4). The Singapore Code of Advertising Practice requires factual claims to be substantiated and not exaggerated.
We found no Singapore ruling by ASAS, CCCS or the PDPC on specific phrases such as “unhackable”, “bank-grade encryption” or “100% secure”, and no reported prosecution under section 24. That is not permission. It means the test is the ordinary one: can you prove what a reasonable reader will understand the words to mean? “Unhackable” and “100% secure” are absolute claims no security professional would sign. “Bank-grade” invites the question of which bank and which control.
| Risky claim | Why it is risky | A provable alternative |
|---|---|---|
| “Unhackable” / “100% secure” | Absolute; cannot be substantiated | “Encrypted in transit (TLS 1.2+) and at rest (AES-256); independently penetration-tested [month year]” |
| “Bank-grade security” | Undefined comparison | Name the actual controls and the standard you are certified to |
| “CSA-approved app” | CSA does not approve apps; false affiliation | “[Company] holds the Cyber Trust mark (Promoter tier) for [scope]” |
| “Cyber Trust certified product” | The mark certifies organisations, not products | “Built and operated by a Cyber Trust-certified organisation (scope: [X])” |
| “VAPT services” (unlicensed) | Holding out a licensable service: s 24(1)(b) | Get licensed first, or describe only non-licensable services |
| CSA crest on a “licensed” banner | s 6A(3) offence and against CSRO guidance | Licence wording plus a link to the CSRO register |
If your business handles personal data, remember that the PDPC judges the protection you actually provide under section 24 of the Personal Data Protection Act, whatever the marketing says. A bold security claim followed by a breach is the worst combination for trust. Our guide to marketing after a data breach in Singapore covers that scenario, and our PDPA guide for marketing and tracking covers the data you collect through the campaigns themselves.
Five worked examples
1. The web agency that added “VAPT”
A web-design agency adds “Website VAPT from $1,500” to its services page and a Google Ads campaign, planning to subcontract the testing. If the work includes penetration testing as the Act defines it, the agency is holding out a licensable service. On CSRO’s reading resellers need their own licence, so the subcontractor’s licence does not cover it. Until the agency is licensed, the safe options are to remove the offer, or to refer clients directly to a licensed provider without selling the service as its own.
2. The MSP reselling a SOC
A managed-services provider white-labels a partner’s 24/7 SOC as “OurBrand Shield”. Managed SOC monitoring is licensable, and the MSP is the one advertising and selling it. It needs its own licence for that service type, and every group entity that sells it needs one too.
3. The SaaS firm with a Cyber Trust badge
A Singapore SaaS company achieves the Cyber Trust mark at Promoter tier for its Singapore operations and puts the badge beside each pricing plan with the words “Cyber Trust certified platform”. The certificate covers the organisation within its scope, not the platform as a product, and the engineering team overseas may sit outside the scope. The fix is to move the badge to the trust or about page with the scope, tier and validity spelled out, and to describe the product in terms of its actual controls.
4. The marketplace router listing
An online seller lists three router models under one product page, with a CLS Level 2 label image that belongs to only one of them, and the headline “CSA-approved routers”. That is both of CSA’s named misleading-use examples (all models implied, and possibly the wrong level) plus the banned “approved” wording. The fix is separate listings per model, each label shown with its own name and model number, the rating stated, and the go.gov.sg/csa-cls URL in the description.
5. The fintech “bank-grade” headline
A fintech app’s Meta ads say “Bank-grade security. Unhackable.” Neither phrase can be substantiated as written. A stronger and provable version: “Your data is encrypted in transit and at rest, and our systems are tested by an independent CSRO-licensed penetration tester every year.” That sentence also quietly shows the reader you understand the local rules, which is itself a trust signal in a B2B sale. Our B2B digital marketing guide for Singapore covers how to build that kind of proof into the funnel.
A pre-launch checklist for security marketing
- List every service you advertise and mark any that involve penetration testing or managed SOC monitoring. Confirm a current CSRO licence for each, for each entity that sells it.
- Describe licences in words with the licence number and a link to the CSRO register. Remove any CSA or CSRO logo.
- State Cyber Essentials or Cyber Trust as an organisational credential, with tier, scope and expiry, and keep it off product claims.
- For CLS devices: one label per model, name and model number beside it, rating shown, go.gov.sg/csa-cls in the copy, and no “approved” or “endorsed”.
- Replace absolute claims (“unhackable”, “100% secure”) with specific, testable controls.
- Keep evidence for each claim (licence, certificate, test report) in one folder, and diarise every expiry date.
Where this leaves you
Singapore has turned cybersecurity marketing into a regulated activity in three different ways. Advertising pentesting or SOC monitoring without a licence is an offence under section 24(1)(b). CSA’s logo is protected by section 6A. The CLS publication prescribes how a label appears in ads and listings. And the Cyber Trust and Cyber Essentials marks certify organisations, not products. Precise, provable claims are both the compliant choice and the persuasive one, because the people buying security are the most sceptical readers you will ever write for.
If you sell security or IT services and want campaigns that win trust without overclaiming, our performance marketing team in Singapore can plan and run them with you, and you can see how we work in our client case studies. For the measurement side, start with our complete guide to performance marketing in Singapore.
The same evidence discipline applies when a product is sold as “AI-powered” or “smarter” than a rival. Our guide to AI claims and AI washing in Singapore advertising sets out what to keep on file.
Frequently asked questions
Do I need a licence to advertise penetration testing in Singapore?
Yes. Section 24(1)(b) of the Cybersecurity Act 2018 makes it an offence for a person in the business to advertise or hold out a licensable cybersecurity service without a licence. Penetration testing and managed SOC monitoring are licensable. The maximum penalty is $50,000, two years’ jail, or both.
Do resellers of cybersecurity services need their own licence?
Yes, according to the Cybersecurity Services Regulation Office. Resellers need their own licence even if a licensed partner delivers the work, each group entity and service type is licensed separately, and licences cannot be transferred. Overseas firms advertising to Singapore are also in scope.
Can I use the CSA logo to show my company is licensed?
No. CSRO guidance says licensees may describe their licensed status in words or link to the public register but may not use the CSA or CSRO logo for publicity. Since 31 October 2025, using CSA’s symbol without permission is an offence under section 6A(3).
Can I say my app is Cyber Trust certified?
Not as a product claim. Cyber Essentials and Cyber Trust certify an organisation, or a defined part of it, under SS 712:2025, and the standards say the mark is not for product certification. State the tier, scope and validity of your organisation’s certification instead.
How should a CLS label appear in an online listing?
On the product page for that specific model, in its description, images or specifications, prominently. In ads, the product name and model number must appear with the label, the label must not be altered except to resize it or use a monochrome version, and promotional wording must include go.gov.sg/csa-cls.
Is it illegal to call a product “unhackable” in Singapore?
There is no specific ban and we found no ruling on that word, but consumer protection law prohibits claiming qualities a product does not have, and the advertising code requires factual claims to be substantiated. An absolute security claim is very hard to prove, so specific controls are safer.
