Services
From Cyber Essentials to ISO/IEC 27001, without starting again
Cyber Essentials sets the baseline. Cyber Trust adds risk-based controls. ISO/IEC 27001 adds the management system that certifies them. Each stage reuses the last, so you pay for the gap, not the whole programme.
Security advisory · 22 October 2026
PHP2Shell: patch and mitigate now
Unauthenticated remote code execution in PHP (CVE-2026-109618, CVE-2026-109619). CISA has listed both as exploited since 26 October. Free 6-page mitigation guide.
Free workshop for business owners
Cyber Essentials, Cyber Trust and the AI check
A half-day workshop on what customers, banks and assessors now ask of small firms. Next session: Monday, 23 November 2026, online.
When customers ask for more
A tender asks for ISO/IEC 27001. A larger customer's vendor questionnaire goes past the Cyber Essentials baseline. A critical-infrastructure client expects Cyber Trust from its suppliers from 2027. The request usually arrives mid-contract, with a short deadline.
Most of what you built for your CSA mark carries over: policies, asset inventories, training records and evidence. What changes is the risk assessment and the management system around them.
The path
| Stage | What it certifies | What carries forward |
|---|---|---|
| Cyber Essentials | The technical baseline, including the AI tools staff use (since April 2025) | Starting point |
| Cyber Trust | Risk-based controls by tier, including cloud, OT and AI risks such as prompt injection | Cyber Essentials policies, inventories and evidence |
| ISO/IEC 27001 | A managed information security system, audited every year | Everything above, plus the Cyber Trust risk work |
You start at the stage your customers ask for, and move on when the next requirement arrives.
What ISO/IEC 27001 adds
- A risk assessment, risk register and Statement of Applicability covering all 93 Annex A controls
- Internal audit and management review, completed before the certification audit
- Secure development controls for anyone building software (8.25–8.33)
- Supplier and cloud governance (5.19–5.23)
- Logging, monitoring, configuration and vulnerability management as a managed process
How certification differs
| Item | Cyber Essentials | ISO/IEC 27001 |
|---|---|---|
| Certifier | CSA-appointed certification body | Certification body accredited by the Singapore Accreditation Council |
| Assessment | Desktop review of evidence | Stage 1 document review, then Stage 2 audit with interviews and sampling |
| Cycle | 2 years | 3 years, with annual surveillance audits |
Pricing
| Stage | Price (S$) |
|---|---|
| Cyber Essentials readiness | 2,000 / 3,000 / 4,500 (1–10 / 11–20 / 21–50 endpoints) |
| Cyber Trust readiness (Supporter or Practitioner) | 9,800 / 13,800 / 19,800 / 25,800 (1–20 / 21–50 / 51–100 / 101–200 endpoints) |
| ISO/IEC 27001, starting from Cyber Trust | 18,000 (up to 50 staff) / 24,000 (51–100) / 32,000 (101–200) |
Launch promotion: Cyber Trust readiness at 50% of list for our launch clients.
Certification-body fees are billed at cost. Promoter, Performer and Advocate tiers are quoted on scope. Starting ISO/IEC 27001 from Cyber Essentials adds S$5,000.
Questions
We only need Cyber Essentials.
That is the right start. Everything built for it is reused if a customer later asks for Cyber Trust or ISO/IEC 27001.
Isn't ISO/IEC 27001 for large companies?
The standard scales to the organisation. A small company has a small scope, few assets and short records; the clauses are the same.
Can we do it ourselves?
The documents are the easy part. Certification needs the risk process, internal audit and management review running before the audit; that is where self-run projects stall.
We already have a quote.
Ask what it reuses from your existing mark. We price only the gap.
We have no security staff.
We run the programme; your team approves the decisions.
Other services
- MAS AI risk advisoryThe AI inventory, risk materiality rating and gap closure against the MAS Guidelines on AI Risk Management.See the Inventory Sprint and prices
- AI security testingRed-teaming and testing of AI systems against the OWASP Top 10 for LLM Applications, with Monarch.See red-team scope and prices
- EU AI Act and ISO/IEC 42001 readinessA gap report against the EU AI Act obligations that apply to your AI, and against all 38 Annex A controls of ISO/IEC 42001.See the EU AI Act dates
- Automotive cybersecurity trainingUN R155 and R156 training for regulators, manufacturers and suppliers, as private cohorts from one day to a 13-day assessor track.See the training tracks
Map your current mark against ISO/IEC 27001
A 30-minute call. We show what carries over, what is new, and a fixed price for the next stage.