Services
From Cyber Essentials to ISO/IEC 27001, without starting again
Cyber Essentials sets the baseline. Cyber Trust adds risk-based controls. ISO/IEC 27001 adds the management system that certifies them. Each stage reuses the last, so you pay for the gap, not the whole programme.
When customers ask for more
A tender asks for ISO/IEC 27001. A larger customer's vendor questionnaire goes past the Cyber Essentials baseline. A critical-infrastructure client expects Cyber Trust from its suppliers from 2027. The request usually arrives mid-contract, with a short deadline.
Most of what you built for your CSA mark carries over: policies, asset inventories, training records and evidence. What changes is the risk assessment and the management system around them.
The path
| Stage | What it certifies | What carries forward |
|---|---|---|
| Cyber Essentials | The technical baseline, including the AI tools staff use (since April 2025) | Starting point |
| Cyber Trust | Risk-based controls by tier, including cloud, OT and AI risks such as prompt injection | Cyber Essentials policies, inventories and evidence |
| ISO/IEC 27001 | A managed information security system, audited every year | Everything above, plus the Cyber Trust risk work |
You start at the stage your customers ask for, and move on when the next requirement arrives.
What ISO/IEC 27001 adds
- A risk assessment, risk register and Statement of Applicability covering all 93 Annex A controls
- Internal audit and management review, completed before the certification audit
- Secure development controls for anyone building software (8.25–8.33)
- Supplier and cloud governance (5.19–5.23)
- Logging, monitoring, configuration and vulnerability management as a managed process
How certification differs
| Item | Cyber Essentials | ISO/IEC 27001 |
|---|---|---|
| Certifier | CSA-appointed certification body | Certification body accredited by the Singapore Accreditation Council |
| Assessment | Desktop review of evidence | Stage 1 document review, then Stage 2 audit with interviews and sampling |
| Cycle | 2 years | 3 years, with annual surveillance audits |
Pricing
| Stage | Price (S$) |
|---|---|
| Cyber Essentials readiness | 2,000 / 3,000 / 4,500 (1–10 / 11–20 / 21–50 endpoints) |
| Cyber Trust readiness (Supporter or Practitioner) | 9,800 / 13,800 / 19,800 / 25,800 (1–20 / 21–50 / 51–100 / 101–200 endpoints) |
| ISO/IEC 27001, starting from Cyber Trust | 18,000 (up to 50 staff) / 24,000 (51–100) / 32,000 (101–200) |
Launch promotion: Cyber Trust readiness at 50% of list for our launch clients.
Certification-body fees are billed at cost. Promoter, Performer and Advocate tiers are quoted on scope. Starting ISO/IEC 27001 from Cyber Essentials adds S$5,000.
Questions
We only need Cyber Essentials.
That is the right start. Everything built for it is reused if a customer later asks for Cyber Trust or ISO/IEC 27001.
Isn't ISO/IEC 27001 for large companies?
The standard scales to the organisation. A small company has a small scope, few assets and short records; the clauses are the same.
Can we do it ourselves?
The documents are the easy part. Certification needs the risk process, internal audit and management review running before the audit; that is where self-run projects stall.
We already have a quote.
Ask what it reuses from your existing mark. We price only the gap.
We have no security staff.
We run the programme; your team approves the decisions.
Other services
- MAS AI risk advisoryThe AI inventory, risk materiality rating and gap closure against the MAS Guidelines on AI Risk Management.Read more
- AI security testingRed-teaming and testing of AI systems against the OWASP Top 10 for LLM Applications, with Monarch.Read more
- EU AI Act and ISO/IEC 42001 readinessReadiness and gap assessments for the EU AI Act and the ISO/IEC 42001 AI management system standard.Read more
Map your current mark against ISO/IEC 27001
A 30-minute call. We show what carries over, what is new, and a fixed price for the next stage.