Cyber Essentials for clinics: what the CSA mark is, and how it fits the Health Information Act

What Cyber Essentials is

The Cyber Essentials mark is a certification run by the Cyber Security Agency of Singapore (CSA). It recognises organisations that have basic cyber hygiene in place. CSA launched it in 2022 and revised it in 2025, adding optional pillars for cloud, operational technology and AI security; a clinic normally needs only the classical cybersecurity scope.

It is not an on-site penetration test. You complete a self-assessment against the requirements and gather evidence; an independent assessor from a CSA-appointed certification body then carries out a desktop review and verification. A successful certification is valid for two years.

Since March 2026 there has also been a healthcare edition, Cyber Essentials for HIA entities: a sub-scheme of Cyber Essentials (2025) co-developed by MOH and CSA for organisations covered by the Health Information Act (HIA). Its scope is at least the clinic’s computers and systems that connect to NEHR or hold health information, and its paper records. A companion edition, Cyber Essentials for HIMS vendors, applies to clinic system suppliers.

The five categories, and what they mean in a clinic

CSA organises Cyber Essentials into five categories: Assets, Secure/Protect, Update, Backup and Respond. The HIA edition keeps that structure and adds a block of data security requirements taken from MOH’s CS/DS Essentials. Of its 85 clauses, 56 are mandatory requirements; the rest are recommendations.

Two areas take most of the effort. Access control carries 13 mandatory clauses and is where clinics tend to fall short: a shared front-desk login, a former locum still enabled, no record of who approved what. Hardware is the other, because an unsupported operating system must be removed or formally accepted as a risk by management. Windows 10 reached the end of Microsoft’s support in October 2025, so for many clinics that clause reaches straight into the consult room.

How it fits with MOH’s rules under the HIA and HCSA

Clinics were already required to protect patient information under the Personal Data Protection Act and the Healthcare Services Act (HCSA). The HIA, passed in January 2026, consolidates and raises those duties into one set of controls: the CS/DS Essentials, published by MOH in March 2026 after consultation with CSA, IMDA and PDPC. They apply to every HCSA licensee and every NEHR contributor and user, including licensees that will never contribute to NEHR.

The Essentials cover 13 areas in three groups: cybersecurity (updates, protection, backup, assets), data security (secure handling, identifying health information, restricting access), and common practices (training, vendor management, security reviews, disposal, business continuity, incident response). The Cyber Essentials for HIA entities requirements cite a CS/DS Essentials reference against each clause, which is why the mark is the natural way to evidence compliance.

The CS/DS deadline follows the NEHR batches: September 2027 for GP clinics, September 2028 for private specialist clinics, March 2030 for dental clinics. HCSA licensees that do not contribute to NEHR have until September 2028. MOH has said it may conduct thematic audits. Our NEHR contribution guide covers the rest of the timeline.

Incident reporting

Once in force, the HIA adds a reporting duty. A notifiable cybersecurity incident or data breach must be reported to MOH within 2 hours of your assessing it as notifiable, followed by a full report within 14 days. A data breach is notifiable if it is likely to cause significant harm or affects 500 or more people, and affected individuals must be told at the same time or as soon as practicable where significant harm is likely. MOH said in August 2026 that it will announce when mandatory reporting begins.

What your clinic system covers, and what it does not

HIA-compliant clinic systems must hold the Cyber Essentials for HIMS vendors certification. MOH says those vendors build in timely software updates, two-factor authentication for configuration changes, secure configuration and protected backups. That narrows your work, but only for the system itself. MOH’s FAQ is explicit that clinics must still align their own processes and staff workflows, and the same measures apply to other devices and applications that hold health information. Your PDPA obligations continue alongside.

Cyber Essentials or Cyber Trust?

CSA runs a second, more demanding mark. Cyber Trust is meant for organisations with more extensive digital operations and higher risk. It is risk-based: you assess your risk profile, which places you in one of five cybersecurity preparedness tiers, each with 10 to 22 domains.

For a GP or specialist practice, the relevant mark is Cyber Essentials for HIA entities, the scheme MOH and CSA built on the CS/DS Essentials. A large group running its own servers may later want Cyber Trust too, but that is a separate decision from meeting the HIA.

Process and cost, in general terms

1. Scope. Decide which devices, systems and paper records are in scope. For the HIA edition that is at least everything connected to NEHR or holding health information.
2. Self-assess. Work through CSA’s guided self-assessment template for HIA entities, clause by clause.
3. Close the gaps. Write the missing policies, reconfigure devices and accounts, replace or formally accept unsupported hardware, and train staff.
4. Collect evidence. Screenshots, registers, signed acknowledgements, the incident response plan.
5. Get assessed. Engage any CSA-appointed certification body for the independent assessment.
6. Maintain. Review periodically, fix lapses promptly, and recertify before the two years run out.

Certification bodies set their own fees, which vary with scope. CSA offers funding support, deducted from the fee, for an organisation’s first successful certification. It is open to SMEs and non-profits incorporated in Singapore until 6 February 2028; for an HIA entity with one to five endpoints the maximum is S$250. The larger costs usually sit elsewhere:

• Hardware and software: replacing unsupported PCs, disk encryption, anti-malware and firewall. The Productivity Solutions Grant can co-fund up to 50% of eligible cybersecurity solutions for SMEs.
• Outside help, if you want it: MOH and CSA have developed basic CISO-as-a-Service packages for healthcare providers with transparent pricing, and SMEs can receive up to 70% co-funding through IMDA’s CTOaaS portal. MOH stresses that engaging a consultant is optional.

A practical plan for a small clinic

For a practice of one to three doctors using a cloud clinic system, a realistic sequence looks like this:

1. List what you have. Every PC, laptop, tablet, router and printer that touches patient data, with its operating system and who uses it. Mark anything unsupported.
2. Clean up accounts. One named login per person in every system, including Windows. Remove leavers and shared logins, keep admin accounts for admin work, and turn on MFA wherever it is offered.
3. Protect devices. Built-in tools can be enough: MOH’s FAQ says Microsoft Defender may provide sufficient firewall and antivirus protection for simple setups. Make sure files and USB drives are scanned automatically when opened, and turn on full-disk encryption.
4. Fix everyday handling. Password-protect emailed files and send the password by a different channel. MOH’s view is that WhatsApp is fine for appointment logistics but not for medical information.
5. Back up, and test a restore. Know how you would run tomorrow’s clinic if the front-desk PC died tonight.
6. Write the short documents. Staff hygiene rules, an incident response plan with names and phone numbers, a business continuity note, and confidentiality clauses for staff and vendors. MOH’s Implementation Guide v2.0 includes templates and sample clauses.
7. Train everyone at least once a year, and keep the attendance record.
8. Then decide on certification. Run the self-assessment honestly. When every mandatory clause is a genuine yes, approach a certification body.

Frequently asked questions