CISO-as-a-Service (Cybersecurity Health Plan) (CISOaaS)
· Last verified 23 Oct 2026CSA-onboarded consultants act as an outsourced Chief Information Security Officer, run a cyber health check and build a cybersecurity health plan to help SMEs reach Cyber Essentials or Cyber Trust.
- Support
- Up to 70% co-funding for eligible SMEs on CISOaaS (Cyber Essentials), CISOaaS (Cyber Trust) and VAPT service packages. No funding for Incident Response service; DPOaaS funding 'to be updated'.
- Maximum funding
- No fixed cap published
- How to apply
- IMDA SMEs Go Digital platform (CISOaaS packages); provider list at go.gov.sg/csa-cisoaas-listing
- Apply before starting?
- Yes, before any commitment or payment
Recent changes
CSA page last updated 4 Oct 2026. New SBF-led Cyber Resilience Centre (with CSA support) expected to start operations in 2026.
Who is eligible
- Registered and operating in Singapore
- Eligible SMEs (CSA page does not define further; sign-up via IMDA SMEs Go Digital which uses SME criteria)
- Non-eligible organisations can engage providers directly without funding
Quick eligibility check
- 1. Is your business an SME registered in Singapore?
- 2. Do you lack in-house cybersecurity staff?
- 3. Do you plan to get the Cyber Essentials or Cyber Trust mark?
- 4. Will you use a CSA-onboarded CISOaaS consultant?
- 5. Have you not yet signed the consultancy package?
0 of 5 answered.
What it covers
- CISOaaS consultancy packages (Cyber Essentials, Cyber Trust)
- Vulnerability assessment and penetration testing (VAPT) package
- HIA CS/DS Essentials package for healthcare entities
How to apply
- Choose a CSA-onboarded CISOaaS consultant and package
- Sign up for the package with funding via SMEs Go Digital
- Consultant performs health check and builds the cybersecurity health plan
- Implement measures and proceed to Cyber Essentials / Cyber Trust certification
Documents you need
- ACRA business profile
- Consultant package quotation
- IT asset/endpoint inventory
- Existing IT and security policies (if any)
Frequently asked questions
What is the CISO-as-a-Service (Cybersecurity Health Plan)?
CSA-onboarded consultants act as an outsourced Chief Information Security Officer, run a cyber health check and build a cybersecurity health plan to help SMEs reach Cyber Essentials or Cyber Trust.
How much funding does CISOaaS give?
Up to 70% co-funding for eligible SMEs on CISOaaS (Cyber Essentials), CISOaaS (Cyber Trust) and VAPT service packages. No funding for Incident Response service; DPOaaS funding 'to be updated'.
Who is eligible for CISOaaS?
Applicants must be registered and operating in Singapore. Eligible SMEs (CSA page does not define further; sign-up via IMDA SMEs Go Digital which uses SME criteria) Non-eligible organisations can engage providers directly without funding
How do I apply for CISOaaS?
Apply through IMDA SMEs Go Digital platform (CISOaaS packages); provider list at go.gov.sg/csa-cisoaas-listing. You must apply before the project starts or any payment is made.
What documents do I need for CISOaaS?
ACRA business profile; Consultant package quotation; IT asset/endpoint inventory; Existing IT and security policies (if any).
Sources
Information last verified on 23 Oct 2026. Grant rules change often. Always confirm with Cyber Security Agency of Singapore (CSA) before you apply.
