The Infocomm Media Development Authority (IMDA) has mandated that all Participating Licensees under the Singapore SMS Sender ID Registry (SSIR) Regime are to implement the newly-established Cybersecurity Standards by 1 October 2025. As part of this directive, companies are required to undergo an independent cybersecurity audit to ensure adherence to these standards. This is important in minimising the risk of malicious actors exploiting the SMS service.
At Crowe Singapore, we understand the complexities of cybersecurity compliance and the critical importance of safeguarding digital infrastructure. Based on IMDA’s external audit firm requirements, our team is eligible to perform both the mandatory and optional requirements set out by the Cybersecurity Standards:
IMDA's Mandatory Cybersecurity Standards for Participating Licensees
Incident Response and Reporting
Incident Response and Reporting
Offers organisations expert support in detecting, analysing, and responding to cybersecurity incidents. This service ensures rapid containment, thorough investigation, and detailed reporting of threats or breaches, helping businesses minimise damage, meet compliance requirements, and strengthen their overall security posture through continuous improvement.
Access Controls and Network Security
Access Controls and Network Security
Providing organisations with robust mechanisms to regulate user access and protect network infrastructure. It ensures only authorised individuals can access sensitive systems, while defending against unauthorised intrusion, malware, and data breaches. This is part of a concerted effort in safeguarding digital assets and maintaining the integrity, confidentiality, and availability of information systems.
Independent Audit Services
Independent Audit Services
Provides objective assessments of an organisation's systems, processes, and controls. This helps identify compliance gaps, inefficiencies, and risks, ensuring alignment with regulatory standards and best practices. It enhances transparency, accountability, and trust, supporting informed decision-making and continuous improvement across financial, operational, and cybersecurity domains.
Cybersecurity Vulnerability and Patch Management
Cybersecurity Vulnerability and Patch Management
Identifies, evaluates, and addresses security weaknesses across systems and applications using Next-Generation Anti-Virus (NGAV). It ensures timely deployment of patches and updates to mitigate risks, prevent exploitation, and maintain system integrity. This proactive approach strengthens an organisation’s security posture and supports regulatory compliance and operational resilience.
Security Governance
Security Governance
Establishes and maintains a framework of policies, procedures, and controls to guide an organisation’s cybersecurity strategy and aligned with ISO standards. It ensures alignment with business objectives, regulatory requirements, and industry best practices, promoting accountability, risk management, and informed decision-making to protect critical assets and support long-term security maturity.
Cybersecurity Incident Management
Cybersecurity Incident Management
Providing structured processes to detect, respond to, and recover from security incidents. It minimises disruption by ensuring timely containment, investigation, and resolution of threats. This in turn enhances organisational resilience, supports regulatory compliance, and helps prevent future incidents through lessons learned and continuous improvement.
Configuration and Administration
Configuration and Administration
Ensuring systems, networks, and applications are securely set up and efficiently managed. This includes applying best practices for system settings, user permissions, and ongoing maintenance. This supports operational stability, reduces vulnerabilities, and ensures alignment with security policies and compliance requirements.
Backup and Restoration
Backup and Restoration
Provides secure, reliable data protection by regularly creating copies of critical information and systems. In the event of data loss, corruption, or cyber incidents, it enables swift recovery to minimise downtime and disruption, ensuring business continuity and supporting compliance with data protection standards.
Securing Infrastructure and Service
Securing Infrastructure and Service
Focuses on protecting an organisation’s core IT environment, including servers, networks, and applications. It involves implementing security controls, monitoring, and threat prevention measures to defend against attacks, ensuring system integrity, availability, and resilience, supporting secure and uninterrupted business operations.
Supply Chain Risk Management
Supply Chain Risk Management
Identifies, assesses, and mitigates cybersecurity risks across an organisation’s third-party vendors and supply chain. It ensures that partners meet security standards, reducing exposure to threats like data breaches or service disruptions, and strengthens overall security posture and supports regulatory and contractual compliance.
Optional - Recommended but not Mandatory
Securing API Access
Securing API Access
Securing API access through IP whitelisting enhances cybersecurity by allowing only trusted IP addresses to interact with the API. This restricts unauthorised access, reduces attack surfaces, and strengthens data protection by ensuring only pre-approved systems can communicate with critical services, mitigating risks from external threats and malicious actors.
Defence-by-Diversity
Defence-by-Diversity
A cybersecurity strategy that enhances system resilience by using diverse technologies, configurations, or approaches. By avoiding uniformity, it reduces the risk that a single vulnerability or exploit can compromise an entire system. This layered and varied defense makes it harder for attackers to succeed across multiple components.
Cybersecurity Awareness and Training
Cybersecurity Awareness and Training
Educating employees about cyber threats, safe online practices, and organisational security policies. It strengthens the human layer of defense by reducing risks from phishing, social engineering, and user error. Regular training empowers staff to identify threats and respond appropriately, fostering a security-conscious workplace culture.
Cybersecurity Design Principles
Cybersecurity Design Principles
Foundational guidelines used to build secure systems and applications. Key principles include:
Least Privilege – Granting users and systems only the access they need.
Defense in Depth – Layering multiple security measures.
Fail-Safe Defaults – Genying access by default.
Separation of Duties – Dividing responsibilities to prevent misuse.
Minimize Attack Surface – Reducing entry points for attackers.
Secure by Design – Integrating security from the start of development.
Open Design – Relying on transparency, not secrecy, for security.
These principles help ensure systems remain resilient against threats throughout their lifecycle.
Cybersecurity Incident Response Plan and Mechanisms
Cybersecurity Incident Response Plan and Mechanisms
Providing a structured approach for detecting, responding to, and recovering from security incidents. The plan outlines roles, communication protocols, containment strategies, and post-incident analysis. Effective mechanisms, such as monitoring tools, alert systems, and response playbooks, ensure swift action, minimising damage, downtime, and data loss during cyberattacks.
Correlation and Analysis of Security Events
Correlation and Analysis of Security Events
Aggregating and examining data from various sources (e.g., logs, network traffic, endpoint activity) to identify patterns, anomalies, or threats. By correlating events across systems, our security team can detect complex attacks, reduce false positives, and gain deeper insights for timely and accurate incident response.
Work with an accredited cybersecurity service provider.
We bring deep expertise in security governance, compliance frameworks, and risk management. We have successfully guided numerous organisations through stringent regulatory requirements and enhanced their security postures against evolving threats.
Cyber Essentials Mark Certified Organisation
Licensed Penetration Testing Service Provider
