If you run a company or work in IT in Singapore, the announcements from this year’s Cyber Week come with dates, a phone number, and money attached. Several of them open within the next few weeks or months, and some reward the organisations that move first.
In this article we will discuss the quantum-safe grant and its deadlines, the new Cyber Incident Helpline, the planned accreditation route for security professionals, the regional fund, and the June statistics that show where the risks sit.
Announcements Worth Putting in a Diary
Cyber Week produced a long list of announcements, but only a handful carry practical dates for businesses and professionals. The wider national strategy was launched at the same event, and our separate explainer covers the threats and pillars behind it, so this article sticks to the tools. Everything below comes from reports on the 2026 conference and from the Cyber Security Agency of Singapore (CSA), and details can shift as agencies publish fuller guidance. Treat the table as a map and confirm specifics with the agency before you commit money or staff time.
| Item | Who it is for | Key date or detail |
| Quantum Safe Kickstarter Grant | CII owners first, other organisations with quantum-vulnerable systems | Open 1 November 2026 to 31 October 2027 |
| Quantum Readiness Index, advisory and handbook | Organisations planning their migration | Co-developed by CSA, IMDA and GovTech |
| Cyber Incident Helpline | Businesses of all sizes | 6890 9555 |
| National accreditation framework | Cybersecurity professionals and their employers | Process details from March 2027, voluntary pilot from the second quarter of 2027 |
| ASEAN Cybersecurity Centre of Excellence funding | Regional agencies and programmes | S$30 million over five years, released in stages |
| Router labelling and Cyber Trust mark | Router sellers and CII operators | End-2027, per CSA’s June release |
Notice also what is missing: none of these items is a new legal duty on ordinary small firms, apart from the end-2027 labelling and certification deadlines, which fall on specific groups. The rest is support that you can choose to use. That makes the take-up decision yours, and it is why a calm look at your own exposure beats a rush to sign up for everything.
The pattern is worth noticing. Some items are money (the grant and the regional fund), some are help in a crisis (the helpline), some are rules with deadlines (labelling and certification), and one is a career structure (accreditation). Different readers will care about different rows, so pick the ones that apply to you and skip the rest.
A quick way to sort yourself: if you hold data that must stay confidential for a decade or more, start with the quantum rows. If you have no IT department, start with the helpline. If you manage or hire security staff, the accreditation row is yours. If you sell routers or operate designated systems, the end-2027 deadlines are the ones that bind you. Most small firms will find that the helpline and the co-funded advisory scheme in the June release are the two items that change their position fastest.
Quantum-Safe Migration, the Grant and the Target Years
The government wants organisations with long-lived sensitive data to start moving to quantum-safe methods, and it has put a grant behind the request. Our companion explainer covers why the threat exists. Here the focus is on what you can apply for and how the timetable works.
The Quantum Safe Kickstarter Grant
The grant opens on 1 November 2026 and runs to 31 October 2027, giving organisations a full year to apply. Its purpose is to fund pilots of quantum-safe solutions. The word pilot matters: this is money to test and learn in a controlled setting, not a subsidy for a whole-company rollout. Owners of Critical Information Infrastructure, the designated operators of essential systems, are given priority. Other organisations with quantum-vulnerable systems are also in scope, but if your demand is competing with a major utility or bank, expect the priority group to be served first.
The practical advice is to prepare before the window opens. A good pilot proposal usually names a specific system, explains why its data needs long-term protection, describes what will be tested and sets out how success will be judged. Agencies tend to favour proposals that produce lessons other organisations can reuse. Eligibility rules, funding levels and application steps will be published by the agency, and I have not seen those details, so do not assume a percentage or a cap until you read them.
The Advisory, Handbook and Readiness Tool
Three supporting resources were announced alongside the grant. There is a new advisory, a quantum-safe handbook and a Quantum Readiness Index, which is a self-assessment tool. They were co-developed by CSA, the Infocomm Media Development Authority (IMDA) and GovTech. If you cannot yet say where your organisation uses encryption, start with the self-assessment, because most migration work begins with an inventory: which systems encrypt data, with what methods, supplied by which vendors, and how long the data must stay secret.
That inventory is often the slowest step. Encryption hides in places such as VPNs, database connections, payment terminals, backup tapes, smart cards, and the firmware of devices nobody has looked at for years. A readiness index helps you see which parts to look at first, and the handbook is a sensible guide to sequencing. Suppliers also matter. Ask your main software and cloud vendors when they will support quantum-safe methods, and make the answer a factor in contract renewals.
The 2031 and 2035 Targets
GovInsider reported that CII owners and other quantum-vulnerable organisations should complete the move by 2031 and 2035. The report, as I have it, does not make clear which group is tied to which year, so check CSA’s guidance before you assume one for your organisation. CSA’s June 2026 guidance sets milestones that organisations are expected to reach before 2031. That suggests a staged path, with early steps such as inventory, risk assessment and planning coming first, followed by pilots, then rollout.
Arithmetic helps here. Suppose, as an illustration with invented numbers, that your firm has 200 systems and can migrate 25 a year after a first year spent on inventory and pilots. That is eight years of rollout after year one, which would run past 2031 on its own. The point is not the figures but the shape: the target years sound distant, while the preparation time is short. Starting the inventory this financial year is what keeps later years manageable.
Cyber Incident Helpline for Firms of Every Size
Many small businesses have no security staff and no plan for the first hour after a suspected attack. The Cyber Incident Helpline (CIH) is aimed at that gap. The number is 6890 9555, and it can also be reached through the Cyber Resilience Centre site. The centre is operated by the Singapore Business Federation together with trade associations, and CSA supports it.
What the Helpline Covers
The helpline gives first-response and containment guidance to businesses of all sizes. The incident types named in the announcement are phishing, social engineering, business email compromise, malware, ransomware and suspected data breaches. If a case needs specialist help, the helpline refers the business to pre-approved cybersecurity partners. That last feature deserves attention, because the hardest part of a crisis is often not knowing whom to trust. Pre-approved referrals reduce the risk of a panicked company hiring the first advertiser it finds.
The helpline is not described as a free incident-response team that will come to your office and do the work, so set expectations accordingly. Think of it as a triage desk. It can tell you what to do now, what to leave alone, and what kind of expert to call next. Paid specialist work after referral will have its own costs, and it is sensible to ask about those at the outset.
What to Do Before You Call
A short, calm call goes better with preparation. Have the following ready in your mind or on paper: what you noticed and when, which systems or accounts are involved, whether money has moved, and whether customer or employee data may be affected. Do not delete anything, because logs and affected files are evidence. Disconnect the affected machine from the network if you can, but avoid switching it off unless advised, since volatile memory can hold clues. Change passwords for accounts that may be compromised from a different, clean device.
Three further steps sit outside the helpline. If money has been transferred to a fraudster, contact your bank immediately and make a police report, since speed affects whether funds can be held. If personal data may have been exposed, your organisation may have duties under the Personal Data Protection Act to assess the breach and notify the Personal Data Protection Commission and affected individuals in some cases. Check the commission’s current guidance for the thresholds. If you hold cyber insurance, read the policy for notification windows, because late notice can jeopardise a claim.
Roles During an Incident
Decide in advance who does what. One person should lead and make decisions, another should keep a written timeline of what was seen and done, and a third should handle communication with staff, customers and, if needed, regulators. In a very small firm these may all be the owner, which is exactly why a written one-page plan helps: it stops the owner from improvising under stress. Avoid discussing the incident over the email or chat system you suspect is compromised, and use a phone call or a separate clean channel instead.
Practising Before You Need It
A helpline number in a drawer is only useful if people know it exists. Print it on the incident card by the front desk, save it in the phones of the owner and the person who handles IT, and rehearse a simple scenario once a year. A thirty-minute walk-through of what happens if the finance clerk receives a fake supplier invoice will expose gaps in your approval process far more cheaply than the real thing.
A National Accreditation Route for Professionals
For individuals in the security field and the firms that employ them, the biggest structural announcement is a national accreditation framework for cybersecurity professionals. It addresses a familiar frustration: the market is full of certifications, and few buyers can tell which ones mean something.
Why the Framework Is Needed
CSA commissioned a study that found many overlapping certifications. The same study reported that about 67 percent of the stakeholders surveyed were ready for an accreditation framework. That is a majority but not an overwhelming one, and the remaining third deserves a hearing. Professionals who have paid for several international credentials may worry about yet another layer, and employers worry about cost. The success of the framework will depend on whether it simplifies the landscape or merely adds to it.
How the Framework Is Built and Timed
The framework rests on a competency framework developed with IMDA and SWDA, which covers technical knowledge, practical experience and professional ethics. The three-part structure matters. Exams alone can be crammed, and years in a job alone do not guarantee current skills. Ethics is included because security staff routinely hold privileged access to confidential information.
The timetable is staged. By the end of 2026, CSA plans to set up a Cyber Security Professional Office, working with the Association of Information Security Professionals, along with a Cyber Security Professional Panel and accreditation committees. Process details will appear on CSA’s website from March 2027. A voluntary pilot begins in the second quarter of 2027, with professionals from selected government agencies and service providers. Because it is voluntary and begins with a limited group, nobody will be forced to hold accreditation in 2027, and the pilot may well shape the final design.
What Professionals and Employers Should Do
If you work in security, keep your records tidy. Document your projects, the roles you held, the tools you used and any training, because practical experience is one of the three pillars of the framework. Do not rush to buy new certificates in anticipation. Wait for the March 2027 details and see how existing credentials are recognised, which is a question the framework will have to answer.
There is a strategic choice for firms of mid-size too. Some will want to put staff through the pilot early to gain recognition, while others will prefer to wait and see whether clients ask for it. Early movers get influence over how the process works, but they also bear the effort of a first run. A reasonable rule is to join early if your business sells security services and a badge helps you win work, and to wait if you only employ security staff internally.
Employers who contract security services should watch the pilot closely. If accreditation catches on, it could become a quick way to test a provider’s staff, and tender documents may eventually ask for it. For now, keep asking for references and sample reports, which tell you more than a badge ever will.
The S$30 Million Regional Fund
At the 11th ASEAN Ministerial Conference on Cybersecurity, held during Cyber Week, Singapore announced S$30 million over five years through the ASEAN Cybersecurity Centre of Excellence. The centre was set up in 2019, and the money will be released in stages. It is earmarked for four areas: incident response, CII protection, AI-related cyber risks and cyber diplomacy.
Most readers will not apply for this fund, since it supports regional capacity building and not individual companies. It still matters for business, for a plain reason. Singapore firms operate across Southeast Asia through suppliers, subsidiaries and customers, and an attack that starts in a weakly defended neighbouring network can reach a Singapore firm through email, a shared platform or a supply chain. Better incident response in the region lowers that risk, and training programmes funded this way can become a source of recruits and partners.
The mention of cyber diplomacy is a reminder that not every dollar goes to technical defence. Agreeing norms, sharing threat information and building trust between agencies are slower, less visible activities, and they often decide how quickly a cross-border incident can be contained. The mention of AI-related cyber risks suggests the fund will also support work on how the technology is misused and how regional agencies can prepare.
Two cautions apply. A staged release means the early programmes will take time to appear, and a five-year pledge says nothing yet about how any single country will benefit. If you operate in the region, ask your industry association whether it plans to take part, since trade bodies are often the easiest way into such programmes.
June Figures That Show Where the Risks Sit
The numbers in this section come from CSA’s Singapore Cyber Landscape release, dated 30 June 2026, which covers 2025. They are June figures and predate the Cyber Week announcements, so treat them as the background to the new measures and not as news from this month.
Scams, Infections and Ransomware
CSA reported about 4,800 phishing attempts to it in 2025, down 21 percent from about 6,100 in 2024. Before reading too much into any single number, remember that these are counts of what was reported or detected, not a census of everything that happened. Detection methods improve, reporting habits change, and one large campaign can swing a total. A fall in reports can mean fewer attacks, but it can also mean people have stopped reporting, or that scammers are moving to channels where CSA sees less. The better reading is cautious: the direction is welcome and not a reason to relax.
The harder number is infected infrastructure. CSA’s release said 284,300 instances of infected infrastructure were detected in Singapore in 2025, up 142 percent. That is a sharp rise, and it is a warning about devices such as routers, servers and cameras that have been quietly taken over and may be used to attack others. Ransomware cases reported to CSA were 165 in 2025, against 159 in 2024, a small increase that says ransomware has not gone away.
| June 2026 release, 2025 figure | Number | Change |
| Phishing attempts reported to CSA | About 4,800 | Down 21 percent from about 6,100 in 2024 |
| Infected infrastructure detected in Singapore | 284,300 | Up 142 percent |
| Ransomware cases reported | 165 | Up from 159 in 2024 |
Deadlines and Support Schemes in the Same Release
The same release set two deadlines for the end of 2027. All residential routers sold in Singapore must meet Level 2 of the Cybersecurity Labelling Scheme, and all CII operators must obtain Cyber Trust mark certification. If you sell or supply home routers, such as a telecom operator or retailer, check your product range now, because stock ordered in 2027 will need to comply. CII operators should plan certification audits early, since assessors’ calendars fill up as deadlines approach.
For smaller firms, the release highlighted the CISO-as-a-Service programme, which offers eligible SMEs up to 70 percent co-funding for advisory services. A chief information security officer is the executive who sets security policy, and few small firms can afford a full-time one, so renting that expertise is a practical compromise. Eligibility criteria apply, so confirm them with the programme before budgeting. The release also noted that more than 800 organisations held at least one Cyber Essentials certification by early 2026, which is a modest base given how many firms operate in Singapore.
CSA’s 2025 survey, cited in the release, found that SMEs lacked both capacity and awareness. That finding explains the design of the new measures: a helpline for those without staff, co-funded advisory for those without a chief, and a grant that begins with priority groups and pilots. It also means the SME owner who thinks cybersecurity is for large companies is the person the programmes are trying to reach.
Final Thoughts: Planning the Year Ahead, Month by Month
Start with this month. Save the helpline number where several people can find it, and nominate who calls and who decides if an incident happens. This costs nothing and may be the most valuable step on the whole list.
Before 1 November, if you hold sensitive data for many years or sit in a regulated sector, begin an encryption inventory and try the Quantum Readiness Index. When the grant opens, decide within a few weeks whether a pilot makes sense, as there is a full year to apply, but the priority group will not wait. Ask your main vendors about their quantum-safe plans at your next review meeting.
By the end of 2026, review your insurance and your breach response procedure, and if you are an SME, look at CISO-as-a-Service co-funding. Early in 2027, when CSA publishes accreditation process details in March, security professionals should read them and decide whether to join the pilot that begins in the second quarter. During 2027, check your router supply chain or your Cyber Trust mark timetable against the end-of-2027 deadline.
One more habit is worth building into the calendar: a short quarterly review in which someone checks the agency websites for new guidance, grant updates and alerts. Schemes of this kind are often adjusted after launch, and a firm that checks four times a year will rarely miss a window.
Beyond that, the 2031 and 2035 targets sit further out, but the milestones CSA has set for before 2031 mean planning should be underway well before then. Revisit your plan each year and adjust it, because agencies will release more detail as programmes mature. If you are unsure which scheme fits, ask your trade association, your auditor or CSA directly.
Frequently Asked Questions
1. When does the Quantum Safe Kickstarter Grant open?
It opens on 1 November 2026 and closes on 31 October 2027. It funds pilots of quantum-safe solutions, and owners of Critical Information Infrastructure are given priority.
2. Which number do I call for the Cyber Incident Helpline?
The number is 6890 9555, and the helpline can also be reached through the Cyber Resilience Centre site. It gives first-response guidance to businesses of all sizes and refers those needing specialist help to pre-approved partners.
3. Do cybersecurity professionals in Singapore have to be accredited?
Not at this stage. The national framework starts with a voluntary pilot in the second quarter of 2027, and process details are due on CSA’s website from March 2027.
4. What are the quantum-safe migration deadlines for Singapore companies?
GovInsider reported that CII owners and other quantum-vulnerable organisations should complete the move by 2031 and 2035. CSA’s June 2026 guidance sets milestones to reach before 2031, so check the guidance to see which target applies to you.
5. Can small businesses get funding for cybersecurity advice?
CSA’s June 2026 release said the CISO-as-a-Service programme offers eligible SMEs up to 70 percent co-funding for advisory. Check eligibility with the programme before you plan around it.
6. Are the June 2026 cyber statistics the latest figures?
They are the figures CSA published on 30 June 2026 for the year 2025. Newer data may appear later, so check CSA for updates.
