Apply for Licence

Under the Cybersecurity Act and Cybersecurity (Cybersecurity Service Providers) Regulations, the following groups of persons are required to obtain a cybersecurity service provider’s (“CSP”) licence:

• those who engages in the business of providing any of the following licensable cybersecurity service (“LCS”) to other person is required to obtain a cybersecurity service provider’s (“CSP”) licence.

• those who is in the business of providing a LCS, is required to obtain a licence before advertising their LCS.

At A Glance

Note:

• All providers of LCS, regardless of whether they are companies or individuals who are engaged for such services, are required to obtain a licence, except for companies that provide LCS solely to their related companies or in-house consumers of LCS.

• Providers who offer or intend to offer both LCS are required to submit separate licence applications and obtain a licence for each LCS.

Criteria for Grant of a Licence

To be eligible for a licence, applicant is required to:

1. Be fit and proper; and

2. With effect from 16 March 2026, hold an active Cyber Trust Mark (“CTM”) Promoter (Tier 3) or equivalent certification.

Note:

• A grace period until 31 December 2026 will be given for licensees to obtain the required CTM Promoter (Tier 3) certification.

Fit and Proper Criteria

As stipulated in section 26(8) of the Cybersecurity Act, in deciding whether an individual or a business entity is a fit and proper person to hold or continue to hold a licence, the licensing officer may take into account any matter the licensing officer considers relevant, including any of the following:

1. In the case of an individual —

   1. that the individual has been convicted in Singapore or elsewhere of any offence involving fraud, dishonesty or moral turpitude;

   2. that the individual has had a judgment entered against the individual in civil proceedings that involves a finding of fraud, dishonesty or breach of fiduciary duty on the part of the individual;

   3. that the individual is or was suffering from a mental health condition (for example, psychotic disorder, psychosis, schizophrenia, schizoaffective disorder, delusional disorder, bipolar disorder, psychotic depression, or personality disorder, etc.)^[1]

   4. that the individual is an undischarged bankrupt or has entered into a composition with the creditors of the individual; or

   5. that the individual has had a licence revoked by the licensing officer previously.
      
      ^[1]If the mental health condition is properly managed and certified by a qualified physician or healthcare professional, the presence of a mental health condition will not affect a person’s eligibility to be licensed.

2. In the case of a business entity —

   1. that the business entity has been convicted in Singapore or elsewhere of any offence involving fraud, dishonesty or moral turpitude;

   2. that the business entity has had a judgment entered against the business entity in civil proceedings that involves a finding of fraud, dishonesty or breach of fiduciary duty on the part of the business entity;

   3. that any officer of the business entity is not a fit and proper person to be an officer of a business entity holding the licence;

   4. that the business entity is in liquidation or is the subject of a winding up order, or there is a receiver appointed in relation to the business entity, or the business entity has entered into a composition or scheme of arrangement with the creditors of the business entity; or

   5. that the business entity has had a licence revoked by the licensing officer previously.

Note:

• Business entity applicant should ensure the following officers are included as officers of the business entity in the licence application:

  • 1. Any director, partner or any other person listed in the business entity’s business profile e.g. ACRA BizFile, with the exception of shareholders (who are not directors or partners) and company secretary; and

  • 2. Any other person who is responsible for the management of the business entity.

• Business entity applicant should specify one Key Executive Officer, which refers to the person who is responsible for the proper administration and overall management of the business entity and supervision of its employees. The remaining officers of the business entity would be termed as Key Officers in the licence application.

Requirement for Cyber Trust Mark Promoter (Tier 3) certification

With effect from 16 March 2026, applicants are required to hold an active certificate for CTM Promoter (Tier 3) or equivalent for the required scope of certification at the point of application. Upon issuance of the licence, licensees are also required to maintain an active certificate for the duration of the Licence.

CTM Promoter (Tier 3) or equivalent certification are required to fulfil the following:

• Certification bodies must be accredited by SAC or equivalent national accreditation bodies; and

• Certification must cover the environment (people, processes, and technology) supporting the delivery of licensed cybersecurity service(s). Example of acceptable scope of certification includes:

  • [For providers of one LCS] Provision of licensed cybersecurity services - Penetration testing or Provision of licensed cybersecurity services - Managed security operations centre (SOC) monitoring;

  • [For providers of both LCS] Provision of licensed cybersecurity services – Penetration testing and Managed security operations centre monitoring.

Note:

• A grace period until 31 December 2026 will be given for licensees to obtain the required CTM Promoter (Tier 3) certification. Licensees are encouraged to begin certification processes early to avoid bottlenecks.

Applicant may refer to Certification for the Cyber Trust mark for more information on CTM certification.

Submit New Application

Application for licence is to be submitted online via GoBusiness Licensing. Do note that CorpPass or SingPass credential is required to access the system. For more information on CorpPass or SingPass, please visit www.corppass.gov.sg or www.singpass.gov.sg.

Supporting Documents Required

Applicant is required to submit the following supporting documents for each licence application via GoBusiness Licensing “Upload Supporting Documents” function (please refer to our step-by-step guide for more details).

For Business Entity:

A copy of each document is required for every officer of the business entity:

1. Photocopy of both sides of NRIC/Work Pass, or photocopy of Passport showing the personal particulars and official descriptions (for overseas applicants).

2. Latest ACRA Business Profile or equivalent. The Business Profile is an electronic report that provides information such as registration number, entity name, business activities, registration date, owners and officers of a business entity, that can be obtained via the Accounting & Corporate Regulatory Authority ("ACRA") BizFile+ Portal. The Business Profile report shall not be obtained earlier than one week before the application is submitted to CSRO.

3. (For overseas applicants only) Certificate of Clearance or documentation from the relevant authorities in the home country certifying that the officer does not have any record of criminal conviction in the home country. The Certificate of Clearance or documentation shall not be obtained earlier than three months before it is submitted to CSRO.

For Individual:

1. Photocopy of both sides of NRIC/Work Pass, or photocopy of Passport showing the personal particulars and official descriptions (for overseas applicants).

2. (For overseas applicants only) Certificate of Clearance or documentation from the relevant authorities in the home country certifying that the individual does not have any record of criminal conviction in the home country. The Certificate of Clearance or documentation shall not be obtained earlier than three months before it is submitted to CSRO.

Note:

• Supporting documents not in the English language must be submitted together with an accurate translation in the English language. The translation must be certified by the person making it to be a correct translation. The certificate must contain a statement of that person’s full name, of his address and of his qualifications for making the translation.

Guide to New Licence Application

Applicant may refer to the step-by-step guide which serves to guide cybersecurity service providers on the application submission process in GoBusiness Licensing.