ISO 27001 vs Cyber Trust Mark in Singapore

If your customer, tender, contract or questionnaire names ISO/IEC 27001, you need ISO/IEC 27001 certification. If it names a Cyber Trust mark or Cyber Essentials mark, that mark is a separate certification route. Read the exact wording before you plan the work.

Talk to a consultant

On this page

Customer requirement
What each is
Cyber Trust tiers
ISO 27001 mapping
Audits and validity
How ZES helps
Common questions

Three women work at an office table with printed documents and a tablet, with binders and plants on shelves behind them.

Key takeaways

ISO/IEC 27001 and the CSA marks are separate certifications.
Cyber Essentials and Cyber Trust form one tiered framework under SS 712:2025.
Cyber Trust has five tiers and does not mandate one tier for every business.
EDGE can support eligible ISO/IEC 27001 first-year costs if approved.

The customer requirement decides the certificate

A Cyber Trust mark does not replace ISO/IEC 27001 certification. ISO/IEC 27001 certification does not give your business a Cyber Trust mark. A customer may name either one.

CSA's Cybersecurity Certification for Organisations page, last updated 9 May 2025, says Cyber Essentials is for a small organisation establishing foundational cybersecurity measures. It says Cyber Trust is for a larger organisation taking a risk-based approach to implementing cybersecurity. That profile guidance helps when the customer has not named a certificate.

The other decision is whether your business needs an international standard for an information security management system. ISO/IEC 27001 certification with ZES prepares your ISMS for the accredited certification body's audit. Some businesses hold an ISO/IEC 27001 certificate and a CSA mark because different customers or business needs point to different requirements.

Use the wording in the tender, contract or security questionnaire as the first decision rule.
Use CSA's published profile guidance if the customer has not named a certificate.
Consider ISO/IEC 27001 when you also need an international ISMS standard.

ISO/IEC 27001 and the CSA marks have different purposes

CSA's cross-mapping document, published 15 April 2025, says ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining and continually improving an information security management system within the context of an organisation. The ISMS includes the scope, risk work, controls and records your business uses.

CSA's Cyber Trust page, last updated 16 April 2025, says the Cyber Trust mark certifies advanced organisations' security readiness through a risk-based approach that matches protection with digital exposure levels. Cyber Essentials and Cyber Trust form one tiered cybersecurity risk management framework under SS 712. The current Cyber Trust (2025) mark is published as SS 712:2025. It includes classical cybersecurity, cloud security, OT security and AI security.

CSA's Certification for the Cyber Trust mark page, last updated 1 October 2026, says Cyber Trust (2022) has not been in use since February 2026. Use the current Cyber Trust (2025) documents when checking a customer requirement or certification scope.

The three certification routes have different owners and assessments
	Cyber Essentials mark	Cyber Trust mark	ISO/IEC 27001
Owner or standard	CSA mark, published as SS 712:2025	CSA mark, published as SS 712:2025	International standard for an ISMS
Approach	Baseline measures against common attacks	Risk-based, five tiers	Risk-based management system with a Statement of Applicability
Who CSA says it suits	Small organisations establishing foundational measures	Larger organisations taking a risk-based approach	Any organisation, regardless of type, size or nature, per Enterprise Singapore
Who certifies	CSA-appointed certification body	CSA-appointed certification body	Accredited certification body, SAC or IAF MRA
Assessment	Desktop review and verification of self-assessment	stage 1 documents, stage 2 implementation and effectiveness, typically on-site	Stage 1 reviews the ISMS, Stage 2 audits how it is used
Support	CSA funding support for first certification, eligible SMEs and NPOs	CSA funding support for first certification, eligible SMEs and NPOs	EDGE up to 50% for SMEs, if approved

The customer requirement determines which route applies.

Cyber Essentials covers baseline measures and Cyber Trust has five tiers

CSA's Cyber Essentials mark certification document, published April 2025, describes Cyber Essentials as baseline controls against the most common cyberattacks. It groups nine measures into Assets, Secure/Protect, Update, Backup and Respond. The measures cover people, hardware and software, data, malware protection, access control, secure configuration, software updates, essential-data backups and incident response.

CSA's Cyber Trust mark certification document, published April 2025, sets out five tiers. Its profiles are indicative. Supporter suits starter digital maturity, including small and some micro enterprises. Practitioner suits starter medium and small businesses. Promoter suits literate medium and some large businesses. Performer suits performer large and some medium businesses. Advocate suits leading digital maturity, including large businesses or those operating in or providing to regulated sectors.

The number of cybersecurity preparedness domains increases by tier. CSA's cross-mapping document, published 15 April 2025, says a higher tier also includes the clauses in lower tiers. The mark does not mandate a tier. Its scope may cover all IT or OT infrastructure, or a business unit, process or location.

Cyber Trust domains increase by tierEach higher tier includes the lower-tier clauses

SupporterPractitionerPromoterPerformerAdvocate

CSA Cyber Trust mark certification document, April 2025

Cyber Trust domains by tier
Cyber Trust tier	Domains
Supporter	10
Practitioner	13
Promoter	19
Performer	21
Advocate	22

Cyber Trust maps partly to ISO/IEC 27001:2022

CSA's cross-mapping between Cyber Trust (2025) and ISO/IEC 27001:2022, published 15 April 2025, maps the Cyber Trust tiers to parts of ISO/IEC 27001:2022. The mapping covers classical cybersecurity only. It is cumulative by tier.

At Advocate, the mapping covers 114 of 146 mandatory ISO/IEC 27001:2022 requirements, or 78.1%. It maps 84 of 93 Annex A reference controls, or 90.3%. This is why the Cyber Trust mark and ISO/IEC 27001 remain separate certifications.

Cyber Trust mapping increases by tierClassical cybersecurity; share of ISO/IEC 27001:2022 mapped at each tier

Clauses 4-10Annex A

255075100Clauses 4-10 78.1Annex A 90.3

SupporterPractitionerPromoterPerformerAdvocate

Cyber Trust tier

CSA cross-mapping, 15 April 2025

Mapped ISO/IEC 27001:2022 coverage by Cyber Trust tier
Cyber Trust tier	Mandatory clauses	Annex A reference controls
Supporter	6.8	46.2
Practitioner	17.1	71
Promoter	31.5	83.9
Performer	54.8	89.3
Advocate	78.1	90.3

CSA describes Cyber Trust as a pathway for organisations to adopt international standards such as ISO/IEC 27001:2022. If your business already runs an ISMS, the mapping can help you identify areas of overlap. It does not make either certificate equivalent to the other.

Certification, validity and audits differ

CSA's Certification for the Cyber Trust mark page, last updated 1 October 2026, says certification is done by certification bodies appointed by CSA. Cyber Trust assessment includes document review and verification, plus implementation and effectiveness by an independent assessor. Its April 2025 certification document sets out stage 1 for documentation and design, and stage 2 for implementation and effectiveness, typically on-site.

CSA's Certification for the Cyber Essentials mark page, last updated 1 October 2026, says assessment is a desktop review and verification of the organisation's self-assessment by an independent assessor from an appointed certification body. An ISO/IEC 27001 certificate is issued by an accredited certification body recognised by SAC or an IAF MRA.

The validity periods below show the certificate cycle. Cyber Trust has annual surveillance audit assessments. An ISO certificate has surveillance audits in years 2 and 3. CSA says assessors typically allow time, for example six months, between Cyber Trust stage 1 and stage 2 corrective actions, and stage 2 needs about three months of implementation data or logs.

Certificate validity periods differValidity before renewal or recertification

Cyber Essentials mark2 years

Cyber Trust mark3 years

ISO/IEC 27001 certificate3 years

CSA certification pages, 1 October 2026; ISO/IEC 17021-1:2015, three-year certification cycle

CSA lists funding support for an organisation's first successful certification of either mark. It is for SMEs and non-profit organisations incorporated in Singapore, is deducted from the certification body's fee, and is available until 6 February 2028. The amount depends on the number of end-points.

Enterprise Singapore's EDGE ISO/IEC 27001 activity page says support can be up to 50% for SMEs and up to 30% for non-SMEs, if approved. Eligible costs include consultant fees and first-year certification. Surveillance, renewal, GST and software are not supported. Apply before work or payment, and Enterprise Singapore assesses every application. Our EDGE grant overview and ISO 27001 certification cost guide explain the ISO route in more detail.

ZES prepares your business for an ISO/IEC 27001 audit

When the requirement points to ISO/IEC 27001, we define the scope with you. We support risk work, the Statement of Applicability, ISMS documents, internal audit, management review and preparation for Stage 1 and Stage 2. An ISO gap assessment is the first step. Stage 1 and Stage 2 audit preparation explains what the certification body reviews.

We do not certify. The accredited certification body audits and issues the ISO/IEC 27001 certificate. For Cyber Trust or Cyber Essentials, CSA's How to Get Certified page, last updated 4 October 2026, lists its appointed certification bodies. ZES is not a CSA-appointed certification body or a CSA-onboarded CISOaaS provider.

For a typical SME, plan around 3 to 6 months from gap analysis to the certification audit. Send us the exact customer requirement or questionnaire, systems and locations in scope, approximate headcount and target date. You can also book a free 15-minute EDGE pre-check. We reply within one working day, then arrange a short call or site visit and provide a written quote.

The ISO/IEC 27001 service page sets out the ISMS preparation work we support with your team.

Common questions

Is the Cyber Trust mark the same as ISO 27001?

No. They are separate certifications. CSA's mapping shows areas of coverage between Cyber Trust and ISO/IEC 27001:2022, but it does not make either certificate equivalent to the other.

Does ISO 27001 certification give us a Cyber Trust mark?

No. An ISO/IEC 27001 certificate does not automatically give your business a Cyber Trust mark. Cyber Trust certification is undertaken by a certification body appointed by CSA.

Which Cyber Trust tier does an SME need?

CSA does not mandate one tier for every business. The tier depends on your risk profile, digital maturity and the scope that needs certification, as well as any customer requirement.

Can a company hold both an ISO 27001 certificate and a CSA mark?

Yes. They are separate certifications and some businesses may need both for different customer requirements or business needs. The exact tender, contract or questionnaire wording remains the first decision rule.

Who issues the Cyber Trust mark?

CSA says Cyber Trust certification is undertaken by certification bodies appointed by CSA. CSA lists the appointed certification bodies on its How to Get Certified page.

Does ZES issue the Cyber Trust mark or ISO 27001 certificates?

No. ZES prepares businesses for an ISO/IEC 27001 certification body audit. We do not issue ISO certificates or CSA marks.

Sources

About the author

Nachi Leong

Principal Consultant, ZES Consulting · PSCMC, TÜV SÜD

One consultant. From start to finish. The consultant you meet is the consultant who stays with your project.

About Nachi

ISO 27001 vs Cyber Trust mark: which one does a Singapore company need?