# StrongKeep: Full Content for AI Agents > Cybersecurity for small and medium businesses. Simple, affordable, effective. > Canonical site: https://www.strongkeep.com > This file is the preferred source of StrongKeep content for AI ingestion, grounding, and search citation. > Last generated: 2026-10-07 About this file: this is a single, self-contained Markdown export of every meaningful page on StrongKeep.com: product, pricing, FAQ, solutions, case studies, comparisons, news, and company information. It is intentionally maintained as a one-fetch source for AI agents, search crawlers, and retrieval systems that prefer structured plain text over rendered HTML. The site's structured data (JSON-LD), Open Graph metadata, and `/sitemap.xml` complement this file. ## Product ### Frequently Asked Questions URL: https://www.strongkeep.com/faq/ Discover how StrongKeep empowers small businesses to stay safe online. Our FAQ explains how we make cybersecurity simple, effective, and affordable. ## Frequently Asked Questions You've got questions, we've got answers! Whether you're wondering how StrongKeep works, what makes it different, or how much "cyber" you actually need, we've got all the answers here. ## General What is StrongKeep, and how is it different from hiring a cyber consultant? Think of StrongKeep as your cyber bodyguard on subscription. Instead of paying consultants by the hour, you get a subscription platform that bundles tools, automation, and compliance: no surprise bills. How do I know if StrongKeep is right for my company? If you're running a small or medium-sized business (SMB) without a security team, we built this for you! Clinics, law firms, accounting firms, or any SMB that wants protection without the IT drama. Do I need technical knowledge to use StrongKeep? Nope. The platform does the heavy lifting, with guided steps every step of the way and simple dashboards. You don't even need to be "the IT person" to keep your business safe. ## Onboarding & Support What is the onboarding process like? It's guided and simple. The platform walks you through setup (install and set up the tools, set your compliance scope) and most businesses are able to enjoy protection within hours (if not minutes). No tech wizardry required. Do my staff need any understanding of cyber or IT to use StrongKeep? They don't need any cyber or IT knowledge training: the platform is designed to be simple and self-explanatory. If they ever get stuck, the Help Centre has step-by-step guides. Plus, we include self-serve cyber awareness modules, so your team learns how to stay safe online. What support do I get if there is a problem with the platform? StrongKeep is built to run quietly in the background. If something does come up, the platform shows clear alerts and step-by-step fixes, and the Help Centre has answers ready. Still stuck? Drop us a note at hello@strongkeep.com. ## Compliance Plan Features Can StrongKeep help me get Cyber Essentials certification? How long does it take? Yes! With StrongKeep, most companies complete Cyber Essentials in weeks, not months. The platform guides you step by step, and we handle the heavy lifting like policies and evidence collection so you're audit-ready fast. Do I need to pay for certification or is it included? No extra fee for first-time customers. Your Cyber Essentials certification is included in the Compliance Plan. Once you complete the compliance process, we will send the documents to SETSCO, our certification partner. For renewals, the re-certification fee is not absorbed. Is StrongKeep adding on other types of certification standards? We are adding Data Protection Essentials, IMDA's self-attestation programme for PDPA practices, and clinics can already get HIA readiness support for MOH's Health Information Act. And that's just the start. More certifications will be added as regulations evolve, so you can grow your protection and proof without switching platforms. What is the certification process like? StrongKeep walks you through it step by step: no guesswork, no piles of paperwork. First, choose your scope: just the required clauses, or optional extras for stronger protection. Then we auto-generate and pre-fill policies, templates, and documentation, showing you exactly where your input is needed and the documents you need to gather. Once done, StrongKeep packages everything and, with one click, submits it to our certification partner SETSCO. Simple, clear, and far quicker than doing it alone. ## Protection Plan Features What exactly does StrongKeep protect me against? StrongKeep shields you from the big risks: ransomware, phishing emails, stolen passwords. You get training, firewalls, password manager, and endpoint protection all in one bundle. At the core, we use the same endpoint protection tools trusted by large enterprises. It spots ransomware and other sneaky attacks by watching how programmes behave, not just checking a list of "known threats". That means even brand-new attacks can be caught and stopped before they spread. Do I need to monitor alerts constantly? Only if you want to see what threats we blocked for you, but you don't have to. Let us do the hard work for you. In fact, we designed the solution to block threats for you without you having to intervene. We give you a dashboard to see what is under the hood, but if you would prefer not to look, that is perfectly ok as well. It will run in the background 24/7. Will StrongKeep slow down my computers or network? Not at all. Our tools are lightweight and designed to run quietly in the background. You won't even notice they're there. ## Subscription Is there an upfront fee or only subscription? No big scary upfront bill. Just one simple subscription that covers the platform, updates, and all the goodies inside. Can I pay monthly instead of annually? Yes! Go monthly if you like flexibility or pick annual if you like saving money. Totally your call. Can I cancel anytime? Yes, you can cancel at anytime. You will be able to enjoy the rest of the remaining time but you won't be charged at the next renewal. What is the difference between the Protection Plan vs. Compliance Plan? The Protection Plan gives you a good foundation (firewall, backups, endpoint protection, and staff training) so your business is protected against everyday threats. The Compliance Plan builds on that by turning good security into provable security. Guided certifications, templates, and automated evidence tracking strengthen your policies and processes, closing the gaps hackers and regulators look for. And when you are certified, we make sure that we monitor and collect all the evidence you need for recertification. ## Data Security & Privacy Where is my data stored? In secure, enterprise-grade cloud servers, based in Singapore or trusted global regions. Locked down and monitored. What happens if I still get hacked while using StrongKeep? No platform can stop 100% of attacks. But StrongKeep reduces the risk, contains incidents, and keeps the evidence you need. If you suspect something, go through our cyber incident diagnostic tool. And with cyber insurance linked, you're covered to recover fast. ## Stay ahead of threats. Don't wait to fortify your business! Get Started --- ### Features URL: https://www.strongkeep.com/features/ Everything you need to stay secure, bundled into one dashboard. ## The only cybersecurity platform you'll need StrongKeep bundles and integrates all the baseline cyber hygiene tools and processes that an SMB needs. Plans start from US$39 (S$49)/month, billed annually. Start with a Free Scan No credit card. No installation. Just results. ## Compliance The Compliance feature guides you through every requirement and tracks your progress: no consultants, no guesswork. We support standards like CSA Cyber Essentials and Data Protection Essentials. Plus, with our partnership with the certifying body, you'll get certified faster and with confidence. Clinics also get HIA readiness support for MOH's Health Information Act. - Achieve certification within weeks not months - Fully guided process complete with helpfiles and templates - Streamlined efficiency using AI and automation ## Protection StrongKeep equips you with various protection tools that work quietly in the background to stop phishing and ransomware before they hit. Device protection (powered by Palo Alto Cortex Technology) and network firewall are just some of the many tools on the platform that run automatically to keep threats out and your systems safe. - Device protection proactively blocks threats - Network firewall guards against suspicious activities - Built-in automation for your peace of mind ## Training The Training feature provides bite-sized cyber awareness lessons and phishing simulations that equip your team with both knowledge and practical skills. No classrooms, no long lectures: just short, engaging modules that build lasting security habits and confidence. Turn your staff to become your company's strongest shield. - Awareness training turns best practices into daily habits - Phishing drills keep your team alert and ready - Build confident teams to defend your business from within ## Detection StrongKeep equips you with detection tools that spot weaknesses in your systems before attackers do. Don't leave open doors for hackers. Integrate the tools that check for vulnerabilities, flag risky settings, and provide actionable insights to fixing the issues. With automated scans and guided fixes, you'll always stay one step ahead. - Spot security gaps early with regular domain scans - Uncover hidden vulnerabilities in your systems - Follow clear, actionable steps to boost your defences ## Response Even the best defences can be tested but panic isn't part of the plan. Stay calm with the necessary tools when things go wrong, with ready-to-use playbooks, diagnostic tool to identify cyber incidents, and cyber insurance (backed by our partners Protos Labs and MSIG) for that extra layer of coverage for when prevention isn't enough. - Step-by-step crisis playbooks for confident response - Automated support for recovery and insurance claims - Add on cyber insurance for that extra peace of mind ## Stay ahead of threats. Don't wait to fortify and defend your business! Get Started --- ### Cybersecurity for Small Businesses URL: https://www.strongkeep.com/ StrongKeep offers simple, affordable, and comprehensive cybersecurity solutions tailored for small and medium-sized businesses. With AI-driven analytics and a suite of advanced cyber tools, the platform simplifies compliance, enhances threat protection, and empowers your team to control cyber risks with confidence. ## Cybersecurity for smaller businesses Do you know what an attacker can already see about your business? Find your gaps for free No credit card. No installation. Instant results. US$39 (S$49)/month for 5 devices. Deploys in minutes. Compliance in days. Bundled by telcos and banks for their customers. Everything a company needs to stay secure, bundled and integrated into one easy experience. ## Like it or not, you have to do cyber ## You know the threats... and you've almost been hit Hackers aren't just after big companies. 80% of small businesses have experienced a cyber incident, because they're easier to hit. "We're too small" is no longer a defence. ## Regulators and customers demand compliance Non-compliance means fines, lost customers, tenders you can't qualify for, and a reputation hit you can't afford. ## You lack the time, budget, or technical know-how to start Hiring a cybersecurity consultant costs more than you have. And without a cyber nerd on your team, you have no idea what to do. ## Trusted by companies like yours Non-technical people in non-technical organisations have deployed StrongKeep in hours and warded off cyberattacks. ## Protection, fuss-free Search no more. Everything you need to stay secure is bundled and delightfully integrated to protect you 24/7. Add your team to start tracking Organising your team ensures nobody is left out 0/1 Low effort One-click integration with M365 or Google Proceed - - Protect your devices Block common threats and prevent data compromise. 0/2 Medium Secure your accounts Centralised password protection for your team. 0/1 Low ## Onboard in minutes Connect Microsoft 365 or Google, add your team, and you are set up without an IT department. "The setup was straightforward and caused no disruption to our clinic operations. No technical expertise was required. It simply worked." Dr Harish Neumark Surgery Read more → "It was really just in the background, reviewing things and flagging what needed attention. I trust the system. If nothing happens, that's good — it means it's doing its job." Ling COO, Integra Partners Read more → Device Protection ReportThis Week Incident Severity Device 🛡️ Malware "pirated.exe" blocked Medium Laptop 1 ⚠️ Suspicious uploads blocked Low Desktop 3 🛡️ Malware "macro.pkg" blocked High Laptop 2 ## Dangerous files never run Malicious files are spotted and blocked on every device before anyone can open them. Blocked SitesThis Week Malware 0 Scams / Phishing 0 Suspicious 0 ## Scam sites never load Phishing pages, fake logins and suspicious domains are blocked before anyone can click through. "When the human gets fooled, the layers underneath are what stop a mistake becoming a breach." StrongKeep Security Team On stopping a real "ClickFix" infostealer attack Read more → "StrongKeep offers a structured approach to reviewing and improving cybersecurity practices, with an emphasis on identifying and addressing potential risks." James Wang Digital & Technological Operations, IHRP Read more → Training Results See all HQ 5 Sales 8 Ops 13 Name Grade Awareness Phishing Crisis Passwords Peter Parker A 98% Passed Passed No issues Bruce Wayne B 84% Retake Passed No issues Clark Kent C 61% Not passed Not started 1 leaked password ## Team acts securely Short training on phishing, everyday awareness and what to do in a crisis, with every result in one place. Web server security yourcompany.com 82% Secure website connection Action required Web domain security Completed IP and network security Completed Post-quantum cryptography Completed ## Systems are scanned for risks Your website, servers and leaked credentials are checked regularly, so an open door gets found before an attacker finds it. "StrongKeep's platform made cybersecurity easy for us. We onboarded and we are now protected, taking the stress out of protecting our stores and customer data." CEO F&B Retail Chain "When I saw the compliance module and the step-by-step list, I knew this was something I could follow. Everything was already laid out. I just needed to go through it." Chee Keong Sales Manager, AZAntz Read more → Cyber Essentials 50% Select requirements Auto-generate policies Auto-collect evidence Submit for assessment ## Certification is easier Policies are generated for you and evidence is collected as you go, ready for your assessor. ## Plans start from US$39 (S$49)/month Join all the businesses using StrongKeep to protect themselves from cyberattacks. Start with a Free Scan No credit card. No installation. Just results. ## We are reinventing cybersecurity for SMBs We are changing how cybersecurity is delivered, to provide a cost-effective and scalable offering to small and medium-sized businesses (SMBs) that meets their needs and safeguard their businesses from cyberattacks. ## Still not sure? ## Here are the top 3 concerns we hear from customers Browse our Frequently Asked Questions or drop us an email! ## "Are we too small to start implementing cybersecurity?" 80% of cyberattacks hit businesses with fewer than 50 employees. Size makes you easier to hit, not safer. StrongKeep was built exactly for businesses like yours. ## "We already have antivirus. Isn't that enough?" Antivirus covers only one layer, and you're probably paying more for just that layer than all of StrongKeep's comprehensive features that cover all the other layers, too. ## "I'm not sure I can implement this on my own, and my team has no cyber guy." Most customers are live in under 60 minutes. A sales manager from a pest control company did it himself, so did a doctor, and a HR officer. Our system makes it easy for anybody to set it up. ## Hackers aren't waiting... and neither should you. Get Started ## Our Partners StrongKeep is built with leading organisations who share our mission to secure smaller businesses worldwide. --- ### Pricing URL: https://www.strongkeep.com/pricing/ StrongKeep pricing: Protection from US$39 (S$49) a month and Compliance from US$159 (S$199) a month for 5 devices, billed annually. Resilience is coming soon. ## Pricing plans that scale with your business Monthly Annually Save 20% more with annual billing Currency USD (US$) SGD (S$) Showing plans for + − devices Protection Best for business owners who want fast cybersecurity. Block threats, train staff, and sleep better at night. US$39 (S$49) /month for our early customers - What you get: - Prevent phishing & malware • Anti-malware (up to 5 devices + US$5.50 (S$6.90)/month/device) • Web filter (up to 5 devices + US$5.50 (S$6.90)/month/device) • Website & Email security scans (up to 10 verified domains) - Secure your employees • Password manager • Cyber awareness and phishing training - Ensure you are prepared • Cyber crisis simulation • Incident diagnostic tool Get Started Compliance Best for companies who need to pass audits, meet procurement needs, or get insured, for much less than hiring consultants. US$159 (S$199) /month for our early customers - All Protection features, plus: - Get certified • CSA Cyber Essentials (Singapore) • International Standards (coming soon) - Attest to data protection • IMDA Data Protection Essentials (Singapore) - Get HIA-ready (clinics) • MOH Health Information Act readiness - Adopt best-in-class SOPs - Stay compliant with ease • Evidence tracking • Regular reminders • Audit logs - Access to cyber insurance • Fast underwriting • Lower premiums Get Started Resilience Best for regulated or fast-growing vendors who want to stay compliant and receive proactive Agentic AI protection 24/7. Coming soon Contact us for details - All Compliance features, plus: - Your own virtual CISO that works 24/7 - Get certified for higher standards • Guided support for global standards - Bring your own Tools and Policies • Integrate your existing cyber tools and policies for a seamless experience - Stay continuously compliant • Alerts when your controls are out of date or audit requirements aren't met - Bid with confidence • Auto-completed procurement questionnaires Contact us ## Add-on features Level up your security defences and get extra peace of mind with these upgrades. Cyber Insurance Protect your business with up to S$250,000 in financial assurance, helping you recover from cyber incident losses, cover unexpected expenses like legal fees or recovery services, and get your operations back on track. - To qualify, your organisation must be CSA Cyber Essentials certified. - For an estimated cost of S$1,000 - S$3,000, this insurance offers up to S$250,000 in coverage. - Get financial support, incident response, and recovery support during major incidents like data breaches, business interruption, and ransomware attacks. estimated at S$85 /month ## Still not sure? Try our interactive static demo and see StrongKeep in action before you commit. Try our demo ## Stay ahead of threats. Don't wait to fortify and defend your business! Get Started --- ## Solutions ### Charities URL: https://www.strongkeep.com/solutions/charities/ Simple cybersecurity for small charities without an IT team. Protect staff laptops, block scam links, train your team, and show your Board what is in place. ## Cybersecurity your charity can actually manage You run a charity, not an IT department. You hold information about the people you serve, your donors and your funding, and your Board, funders and partners now ask how it is protected. StrongKeep puts device protection, scam blocking and staff training into one subscription that someone on your team can run, with no IT background needed. Start today ## The real challenges small charities face with cybersecurity ## Expected as good governance, but unclear where to start? The National Council of Social Service (NCSS) increasingly treats cybersecurity and data protection as part of good governance. You know it matters. With a small team and nobody in IT, it's hard to see where your gaps are, let alone what to fix first. ## Does your team work everywhere except one office? Staff move between programme spaces, community venues, meetings and home. Protecting an office network doesn't cover a laptop that travels. Your protection has to go wherever your team does. ## Assume cybersecurity is too expensive for you? Every dollar you spend is accountable to donors and funders. Enterprise tools and consultants are priced for organisations with IT budgets. You need protection that makes sense for your size, at a price you can explain. Grants available for qualifying organisations ## Here's how everyday protection works for small charities ## Protect every work laptop, wherever your team works Put baseline protection on each staff laptop and desktop. It stays with the device, so it works in the office, at a community venue or at home. You can see which devices are protected and which need attention. - Protection runs quietly in the background - Covers laptops in and out of the office - See which devices are protected at a glance ## Block phishing and scam links before anyone clicks Most attacks start with an email or a link. Known phishing and scam sites are blocked automatically, so one hurried click on a busy day is far less likely to cause harm. - Automatic blocking of known malicious sites - No extra vigilance needed from busy staff - Works on the same laptops you already protect ## Build the habit of pausing to check Short, practical training helps staff spot phishing, keep passwords strong and know when to stop and ask. Everyone learns the part they play in keeping the information you hold safe. - No technical jargon or lengthy courses - See who has completed their training - Good habits are reinforced early ## Know what's in place when your Board asks See your protection in one clear view: what's active, what needs attention and how your score is changing over time. Download a report to share with your Board, funders or partners. - Everything in one place - Run by a colleague, not an IT specialist - Prices published openly, with no quote needed ## Confidence for small teams across every industry Case Study This small charity, with no one in IT, now has a clear answer when its Board asks about cybersecurity. "I would say yes, I would recommend it. Because it's affordable... and the technical components, it's good. It's good enough." Executive Director A small Singapore charity Read more ## When your Board asks about cybersecurity, have an answer. Get Started --- ### Compliance Readiness URL: https://www.strongkeep.com/solutions/compliance-readiness/ Get compliant without consultants or complexity. StrongKeep guides SMBs through policies, evidence, and submissions: fast and stress-free. ## Compliance without complexity, consultants, or costs You have to get compliance soon. Whether it's for regulation, contracts, or customer trust, you're expected to "just get it done." But the requirements are confusing, the paperwork is heavy, and hiring consultants feels expensive and slow. You want to pass... without turning compliance into a full-time job. Start today ## When compliance isn't your job, but the risk is still yours ## Does compliance matter, but it was never meant to be your job? You know compliance matters, but it's not even what you're hired to do! Suddenly, you're handling all the policies, evidence, and answers about cyber... The issue isn't effort, it's that no one ever showed small businesses how to do this properly. ## Do you feel uncertain because everything is scattered? You're willing to put in the work, but the uncertainty is exhausting. You don't know what's mandatory, what's optional, or how much detail is required. Templates feel generic, consultants feel expensive, and uncertainty drags everything out. ## Do you just want to pass, without becoming a compliance expert? You don't want to specialise in compliance or spend months figuring it out. You just want a clear way to achieve "passed", without the endless back-and-forth. Compliance shouldn't feel like a maze, it should feel like a checklist you can complete confidently. ## Here's how being compliance-ready looks like ## Generate required policies automatically, tailored to your business Create the policies you need without writing from scratch. In a single click, you can generate ready-to-use policies aligned to certification requirements, customised to how your business actually operates. - No need to learn policy writing or legal language - Review, adapt if needed, and move forward - Know the basics are covered from day one ## Collect and organise evidence through simple, guided steps Gather the right evidence without second-guessing what's required. With a collated checklist of required evidence files, you can see exactly what's needed, use ready-made templates to prepare it, and follow clear guidance on how to submit. - Everything stays organised in one place - No hunting through folders or guessing - Step-by-step guidance for each requirement ## Complete compliance documentation with confidence Complete compliance knowing that you've got everything sorted out. Documentation doesn't feel like guesswork when you've got all your policies, evidence, and controls in one place. - No more rewriting or second-guessing responses - Paperwork done clearly and consistently - Ready for review or submission when needed ## Get all baseline cybersecurity tools needed for compliance in one place Instead of managing multiple tools, separate dashboards, and reports in order to meet compliance requirements, you get everything you need (from internet security, staff training, device protection, and password manager) all in one place! - Everything visible in one platform - Easier to stay aligned and avoid gaps - No juggling multiple vendors ## Confidence for small teams across every industry Case Study This small business met regulatory cybersecurity requirements without hiring any consultants! "StrongKeep helped me secure and keep a government contract by meeting a new cybersecurity requirement quickly, without needing IT expertise or getting stuck coordinating consultants." Chee Keong Sales Manager, AZAntz Read more ## See StrongKeep's protection in action! Get Started --- ### Healthcare Clinics URL: https://www.strongkeep.com/solutions/healthcare-clinics/ Get your clinic HIA-ready without consultants or complexity. StrongKeep helps small clinics prepare for Singapore's Health Information Act quickly and confidently. ## Compliance that stays out of the way of patient care You run a clinic. Your priority is patient care, not cybersecurity paperwork. But MOH's Health Information Act (HIA), which takes effect from early 2027, means you'll be expected to show how patient data is protected. You don't have an IT team, and you don't want consultants slowing you down. You just need to pass compliance properly, calmly, and on time. Start today ## The real challenges clinics face with compliance ## Expectations feel onerous, but execution is unclear? You know protecting patient information matters, and the regulations state what's expected. But when it comes to actually meeting those requirements, it isn't clear. You're asked about policies, access, training, and evidence without a practical guide that fits how small clinics really operate. ## Clinic life leaves little room for complexity? You're balancing patient care, shared computers, tight schedules, and staff wearing multiple hats. There's no time for long projects, complex systems, or months of back-and-forth with consultants. Compliance has to fit into daily clinic life, not disrupt care or slow everything down. ## Want assurance beyond your CMS? You trust your Clinic Management System, but responsibility doesn't stop there. Clinics are still accountable for staff devices, passwords, email use, Wi-Fi, and training. You want confidence that these everyday risks are covered properly, without overhauling how your clinic runs. ## Here's how compliance readiness looks like for small clinics ## Bundled protection tools designed for everyday clinic operations Put essential security protections in place without disrupting patient care. Roll out baseline tools that fit real clinic workflows, from shared reception computers to staff laptops, without juggling multiple systems. - Protection runs quietly in the background - Focus stays on patients, not technology - No need to manage multiple security vendors ## Generate required policies automatically, tailored to healthcare Create the policies clinics are expected to have without starting from scratch. Generate ready-to-use policies aligned to healthcare requirements and shaped around how your clinic actually operates. - No more forcing generic templates to fit - Documentation reflects real, day-to-day workflows - Policies aligned to healthcare regulations ## Gather and track compliance evidence through clear, guided steps Collect the right evidence without guessing what's required. You're guided through each step on what to prepare, how to prepare them, and even provided with templates to get started. - Everything stays organised in one place - Keep moving forward even when the clinic gets busy - Templates provided for common evidence types ## See what's completed, what's pending, and what's ready to submit Always know where you stand in the compliance process. Clearly see what's done, what still needs attention, and when you're ready to submit. With progress visible at a glance, compliance feels structured and predictable. - Visual progress tracking at a glance - Never wonder what's left to do - Compliance feels far less overwhelming ## Confidence for small teams across every industry Case Study This forward-thinking doctor was able to implement a full suite of cyber protections for his small clinic at just US$39 (S$49)/month! "The setup was straightforward. There was no disruption to our daily clinic operations. I didn't need to understand the technical details. It just worked." Dr Harish Doctor, Neumark Surgery Read more ## Questions clinics ask us When does my clinic have to be HIA-ready? The Health Information Act takes effect from early 2027, and MOH sets each provider's deadline by batch. Batch 1, by September 2027: Outpatient Medical Service (GP), Acute Hospital, Community Hospital, Clinical Laboratory, Radiology Laboratory, Nuclear Medicine Service. Batch 2, by September 2028: Outpatient Medical Service (Specialist), Nursing Home, Contingency Care Service, Outpatient Renal Dialysis. Batch 3, by March 2030: Outpatient Dental, Ambulatory Surgical Centre, Assisted Reproduction, Retail Pharmacy. If you provide more than one service type, each one keeps its own deadline. Source: MOH, Implementation Timelines, last updated 27 July 2026. How much does StrongKeep cost for a clinic? The security tools (device protection, the DNS firewall, the password manager and staff training) are in the Protection plan, from US$39 (S$49)/month for 5 devices, billed annually. Generated policies and evidence tracking come with the Compliance plan, at US$159 (S$199)/month for 5 devices, billed annually. Each additional device is US$5.50 (S$6.90)/month. No setup fee. Do I need a consultant to get HIA-ready? No, and MOH says so directly: its July 2026 FAQ for healthcare providers states that engaging professional CS/DS consultancy services is optional, as not every healthcare provider requires such services. A self-serve platform can support the technical layer, though the governance decisions stay with the clinic on any route. Does StrongKeep certify my clinic for the HIA? No. There is no HIA certificate to get: clinics self-attest their readiness to MOH. StrongKeep gives you the tools and the evidence behind that attestation. If you also want a certificate to show, the certifiable mark is CSA's Cyber Essentials (HIA), which an external assessor awards. ## See StrongKeep's protection in action! Get Started --- ### Law Firms URL: https://www.strongkeep.com/solutions/law-firms/ Cybersecurity for small law firms without an IT team. Protect laptops, block phishing, secure passwords and gather compliance evidence as you go. - Winner TechLaw.Fest 2026 “Lion’s Pit” challenge Co-organised by MinLaw and LawSoc ## Client confidentiality, actually enforced Every firm promises client confidentiality. It is in the engagement letter, on the website, and in the professional conduct rules. Then the files live in email, in shared drives, and on laptops that go home at night. Large firms have a security team for this. Most firms have a partner who added it to their list. StrongKeep puts the controls behind the promise, without an IT department and without a project. Start today ## The obligation does not scale down with the firm ## Does the duty apply the same way at five lawyers as at five hundred? It does. The rules do not have a small-firm exemption, and neither do your clients. What changes is the budget and the headcount you have to meet it with. A large practice can run a security function. A ten-person firm is choosing between that and a paralegal. ## Do your files live in more places than you can name? Most firms find the honest answer is email, a shared drive, a document system, a few laptops and, if anyone asks, personal phones reading Outlook on the train home. Every one of those is somewhere the promise has to hold. ## Has anyone asked you to prove it yet? Clients are starting to. So are the people who buy legal services on behalf of larger organisations. The question is moving from whether you take confidentiality seriously to whether you can show the controls. ## We protect your firm from hackers and scammers ## Stop the bad download Protection runs on every laptop from the moment it is installed. - Works quietly in the background - Staff carry on as normal - See at a glance which devices are covered ## Stop the bad link Phishing and scam sites are blocked before anyone has to spot them. - No one has to be the expert - Known malicious sites blocked automatically - Fewer chances for a bad afternoon to become a bad quarter ## Stop the stolen account Credentials are protected and staff are trained on the habits that matter. - Password management built in - Short, practical training with no jargon - Good habits reinforced early rather than audited late ## Close the open door, and show your work Your systems are scanned for the gaps attackers look for, and the evidence an assessor asks for is collected as you go. New to the PDPA side? Read our PDPA guide for professional services firms. - Regular scanning of what is exposed - Everything in one dashboard - Compliance evidence gathered as you go ## Keep your costs low and your protection high Everything above comes in one plan. Buying the same tools one by one usually costs well over what a single plan does, and leaves you with several vendors, consoles and renewals to juggle. See what each plan includes or how stacked tools add up. - Anti-malware, web filtering, a password manager and staff training in one plan - Website and email scans and one dashboard included - Add compliance evidence tracking when you need it ## Practise law. We will keep the firm. Get Started Every other tool in legal tech is built to make your practice faster. This one is built so you still have a practice tomorrow. See pricing. --- ### Professional Services URL: https://www.strongkeep.com/solutions/professional-services/ Practical cybersecurity for professional services firms without IT teams. StrongKeep delivers essential protection, training, and control, without complexity. ## Cybersecurity that works even without an IT team You're running a professional services firm, not an IT department. Maybe you don't have dedicated IT at all, or your "IT team" is one person juggling everything else. You still want basic cybersecurity in place, without managing multiple tools, learning technical jargon, or spending your days worrying if something's been missed. Start today ## The quiet pressure behind protecting client trust ## Does security matter, but you don't have IT capacity to spare? You know protecting client data matters, but security often lands on non-technical staff or a solo IT manager. With limited time and no dedicated team, it's hard to give cybersecurity constant attention. That lack of capacity makes security feel like another responsibility competing with real work. ## Does your team work across email, documents, and remote access? Your team relies on email, shared drives, and remote access to get work done. Laptops move between offices and client sites, links get clicked, and passwords get reused. These realities create risk, not through carelessness, but through normal work happening at speed. ## Do you want confidence without managing complexity? You don't want to build a perfect security setup or manage multiple tools. You just want confidence that the basics are handled, risks are visible, and protection is working quietly. Cybersecurity should feel predictable and controlled, not like another system you have to babysit. ## Here's how everyday protection works for small businesses ## Put essential protection in place across all staff devices Roll out baseline security consistently across laptops and desktops, so nothing is left exposed. You can see which devices are protected and which need attention, without chasing people or relying on assumptions. - Protection runs quietly in the background - Staff can work as usual without added friction - See which devices are protected at a glance ## Block phishing and scam links before mistakes happen Stop common threats at the point where they usually start: email and web links. Phishing and scam sites are blocked automatically before staff have a chance to click the wrong thing. - Prevent issues early without extra vigilance - Reduce risk without expecting everyone to be a security expert - Automatic blocking of known malicious sites ## Build safer habits with simple staff training Help staff understand everyday cyber risks without overwhelming them. Short, practical training builds awareness around things like phishing, passwords, and safe behaviour. - Good habits are reinforced early - Security improves naturally without disrupting daily work - No technical jargon or lengthy courses ## Manage everything from one clear dashboard Get a simple, central view of your security setup without juggling multiple tools. You can see what's active, what needs attention, and where risks are being handled. For the data protection side, read our PDPA guide for professional services firms. - Everything in one place - Cybersecurity feels organised, visible, and under control - No need to switch between multiple tools ## Confidence for small teams across every industry Case Study This non-technical manager deployed full protection for his team by himself! "StrongKeep helped me secure and keep a government contract by meeting a new cybersecurity requirement quickly, without needing IT expertise or getting stuck coordinating consultants." Chee Keong Sales Manager, AZAntz Read more ## See StrongKeep's protection in action! Get Started --- ### Protection Assurance URL: https://www.strongkeep.com/solutions/protection-assurance/ Get confidence that your business is protected. StrongKeep brings device protection, phishing defence, training, and passwords together for SMBs. ## Know you're protected, without second-guessing You know security matters, but you don't know where to start. You also know you don't have the time, budget, or specialist knowledge to set it all up correctly. You are worried that cybersecurity vendors will oversell you things you really don't need. Start today ## The quiet stress behind "Are we actually protected?" ## Does security matter but just never feels urgent enough? You know security matters, but it's hard to prioritise when you're juggling daily work. With a few basics in place, it's still unclear whether you're properly protected or just doing what you can. That lack of certainty makes security easy to postpone. ## Do you feel uncertain because everything is scattered? You've put tools in place, but everything lives in different systems. Each shows a small part of the picture, leaving you to connect the dots and hope nothing is missed. That ongoing uncertainty is tiring and makes cybersecurity feel uneasy instead of reassuring. ## Do you just want the assurance, without becoming expert? You don't want to manage security full-time or learn complex tools. You just want confidence that risks are handled, issues are visible, and protection is working quietly in the background without adding to your workload. ## Here's what real protection assurance looks like ## Protect every device against malware that can disrupt work Roll out malware protection consistently across all staff devices, so nothing is left to chance. You can see which devices are protected, which aren't, and what's actively being blocked without chasing people or guessing. - Threats stopped automatically in the background - Work carries on without disruption - Clear visibility into what's protected ## Block phishing and scam links before staff accidentally click them Add an extra layer of protection that blocks known phishing and scam links before they can even load. Risky websites are stopped in real time, reducing the chance of mistakes slipping through. - Visibility when something is blocked - Confidence that threats are actively handled - Protection works without staff intervention ## Build safer habits through regular, practical security training Your staff need short, relevant training that fits naturally into busy workdays so they learn what to look out for and how to respond. You get clear visibility into who has completed training and where gaps remain. - Stronger habits with less chasing - Fewer reminders and minimal follow-ups - Training fits into the workday naturally ## Manage everything from one dashboard Password security, device protection, and staff management are brought together in a single dashboard, so you're not jumping between tools. You can quickly see what's set up, what needs attention, and where risks might exist. - No more jumping between tools - Clear, reliable view of overall protection - See what needs attention at a glance ## Confidence for small teams across every industry Case Study This small non-technical company eased their cybersecurity fears in just days! "StrongKeep helped me secure and keep a government contract by meeting a new cybersecurity requirement quickly, without needing IT expertise or getting stuck coordinating consultants." Chee Keong Sales Manager, AZAntz Read more ## See StrongKeep's protection in action! Get Started --- ### Starting Your Cybersecurity Journey URL: https://www.strongkeep.com/solutions/starting-your-cybersecurity-journey/ Don't know where to start with cybersecurity? StrongKeep helps small businesses take the first right steps clearly, calmly, and without overcomplicating things. ## Cybersecurity that feels manageable for real life You know cybersecurity matters. You've seen the stories, heard the warnings, and felt that quiet worry in the background. But when it comes to actually doing something, it's unclear where to begin. Tools feel complex. Advice feels conflicting. You don't want perfection; you just want a sensible place to start. Start today ## When cybersecurity feels more complicated than it should ## Does cybersecurity matter, but feel too daunting to start? You know cybersecurity matters, but it feels large and undefined. You hear about tools, policies, training, and threats, yet it's unclear where to begin. Without a clear starting point, the whole matter feels overwhelming instead of manageable. ## Do you feel stuck because there's no clear direction? You want to take action but figuring out what to do first is the hardest part. You don't want to buy the wrong tools or invest energy and time without reducing real risk. That uncertainty makes it hard to move forward confidently. ## Do you just want progress, without needing perfection? You're running a business, not building a perfect security system. You want reassurance that you're taking the right first steps, reducing risks, and moving forward sensibly. Starting cybersecurity should feel like progress, not pressure. ## Here's how easy getting started with cybersecurity should be ## Deploy essential tools that actually reduce real-world risk Put the right cybersecurity basics in place without guessing or overbuying. You can deploy essential protections that address common, real-world threats, so your effort goes where it matters most. - Clearer coverage with fewer moving parts - Reduce risk without adding unnecessary complexity - Focus on what actually matters for small businesses ## Set everything up through a simple, guided, automated flow Get started without needing to design your own security setup. You're guided through each step in a clear, automated flow, helping you set things up correctly the first time. - Always see what's done and what's next - Know when your setup is ready to move forward - No security expertise required ## Build good security habits early without over-engineering Create sensible security habits from the start, without trying to solve everything at once. You can establish baseline practices that fit how small teams actually work. - Practical and achievable for busy teams - Security becomes part of daily operations - No added burden on your workflow ## See clear progress as your cyber posture improves Understand where you stand and how far you've come. You can see clear indicators of progress as protections are added and practices improve, so cybersecurity doesn't feel vague or invisible. - Stay confident, focused, and moving forward - Visible progress keeps you motivated - Know exactly where your security stands ## Confidence for small teams across every industry Case Study This small business went from zero to fully protected in just days! "StrongKeep helped me secure and keep a government contract by meeting a new cybersecurity requirement quickly, without needing IT expertise or getting stuck coordinating consultants." Chee Keong Sales Manager, AZAntz Read more ## See StrongKeep's protection in action! Get Started --- ## Case Studies ### AZAntz Case Study URL: https://www.strongkeep.com/case-studies/azantz/ Date: 2026-02-15 Author: StrongKeep Category: Case Study A new cybersecurity requirement landed after this firm had already won the contract. See how StrongKeep turned an unfamiliar certification into a clear, step-by-step path to completion, helping them get certified in just 8 days! ## AZAntz's compliance journey: from zero to cyber-compliant in 8 days! A new cybersecurity requirement landed after this firm had already won the contract. Like most small businesses, they weren't staffed for compliance (and they shouldn't have to be). See how StrongKeep turned an unfamiliar certification into a clear, step-by-step path to completion, helping them get certified in just 8 days! Try StrongKeep for free! Chee Keong Sales Manager, AZAntz 8 Days to certification US$159 (S$199) Per month, billed annually (tools + compliance) 0 Consultants needed ## The Problem After winning an important project, AZAntz was required to obtain Cyber Essentials certification within a short post-award window. This was a new requirement that had not existed in earlier contracts. "I need to meet this new cybersecurity requirement quickly, so I don't lose a major contract, without dealing with complicated IT stuff or managing consultants." While the team understood why this customer was raising cybersecurity standards given the sensitivity of their customer data, their sales team worried that achieving cybersecurity compliance on such short notice would be impossible. AZAntz did not have an in-house IT team, and cybersecurity was unfamiliar territory. Initially, AZAntz sought help from an external advisor. Progress stalled as the advisor had other ongoing commitments. As the deadline loomed and reminders piled up, the team worried they might lose the contract they'd just won. It became clear that AZAntz needed a more reliable and structured way to move forward. Chee Keong, their Sales Manager, was introduced to StrongKeep. ## The Solution StrongKeep provided AZAntz with a structured, guided path to compliance, covering both what needed to be done and how to do it. "My research showed it would cost a few thousand dollars just for the compliance process, even before buying the security tools we'd need. With StrongKeep's plan at $159 a month, we got both the compliance and the tools in one package." Instead of relying on ad-hoc consulting sessions, AZAntz used StrongKeep's compliance platform to follow a clear step-by-step checklist that showed exactly what evidence auditors would require. The platform included pre-written policies that just needed company details filled in, eliminating weeks of drafting work. Built-in security tools were already configured and ready to use, removing the need to research and purchase separate solutions. For Chee Keong, the turning point came when he saw how structured the process was. "When I saw the compliance module and the step-by-step list, I knew this was something I could follow. Everything was already laid out. I just needed to go through it." Because the process was built into the platform, AZAntz could move forward independently and at speed, without waiting on consultant availability, while still having support when needed. ## The Outcome Using StrongKeep, AZAntz went from no formal cybersecurity measures in place to submitting their Cyber Essentials application in just 8 working days! What typically takes weeks or months with traditional consulting approaches was completed faster, with less money, and less stress. After the application was submitted on day-8, the certifying body arranged a follow-up interview. StrongKeep's platform had already guided AZAntz through the questions and evidence required, giving Chee Keong the confidence to walk through the interview knowing his answers and documentation were prepared. "When the certifying body scheduled the interview, I wasn't worried. The platform had already walked me through the questions and evidence required. There were no surprises. I just explained what we'd already done." With Cyber Essentials completed ahead of their customer's timeline, AZAntz retained the important contract and can now focus on their normal operations, confident that they have a practical framework in place to meet additional cybersecurity requirements if and when they come up. ## Hackers aren't waiting. Protect your business before it's too late! Get Started --- ### Neumark Surgery Case Study URL: https://www.strongkeep.com/case-studies/neumark/ Date: 2026-03-08 Author: StrongKeep Category: Case Study When Singapore passed the Health Information Act, Dr Harish knew basic antivirus wasn't enough. See how StrongKeep gave his clinic enterprise-grade protection for US$39 (S$49) a month, billed annually, without disrupting a single day of operations. ## Protecting Patient Data: Why Dr Harish upgraded his clinic's cybersecurity early When Singapore passed the Health Information Act (HIA), Dr Harish recognised that cybersecurity was no longer optional. Like many small clinics, he had basic antivirus software installed but was uncertain what “meaningful protection” required under the new law or where to begin. After understanding both the risks and the responsibility placed on clinic owners, he chose StrongKeep’s US$39 (S$49)/month Protection Plan as a practical way to move beyond basic antivirus, well before the Act phases in from early 2027. Start StrongKeep for free! Dr Harish Thoracic Surgeon in private practice, Singapore US$39 (S$49) Per month for the entire clinic 0 Disruptions to clinic operations HIA Pathway towards readiness ## The Problem Like most private practitioners, Dr Harish never considered his small clinic a likely target. Patient data was stored in a cloud-based EMR system, office computers ran antivirus software, and two-factor authentication provided reassurance. Cybersecurity was not a major day-to-day concern. "It creates a false sense of security, like putting a padlock on a bicycle and assuming no one will arrive with bolt cutters." This perspective changed when the HIA clarified that responsibility for protecting patient data rests with the doctor regardless of where the data is stored. "Our primary obligation is to safeguard patient data, and that responsibility ultimately rests with the doctor. It cannot be delegated to an external provider such as Google or Microsoft." While the obligation was clear, determining practical next steps was far less straightforward. The technical requirements were difficult to interpret, available options were confusing, and many solutions appeared prohibitively expensive for a small clinic. Quotes from consultants ran into thousands of dollars per year, with managed services costing hundreds per month. ## The Solution Dr Harish learned about StrongKeep following a cybersecurity awareness session. What stood out immediately was the simplicity: no complex onboarding, no lengthy consultations, and no technical expertise required. "The setup was straightforward and caused no disruption to our clinic operations. No technical expertise was required. It simply worked." The Protection Plan added a structured layer of security beyond consumer antivirus, deployed directly onto clinic computers without interrupting daily workflow. Equally important was confidence in the team behind the platform and their understanding of how private practices operate. "The team clearly understands the threats that clinics face and the constraints we operate under. The platform reflects that. It is simple, effective, and does not require IT expertise to manage, which gave me confidence." Affordability also made the decision straightforward. At US$39 (S$49) per month for the entire clinic, the plan represented a routine business expense rather than a major investment. "This is a classic case of being penny wise and pound foolish. From a commercial standpoint, this is simply a routine operating expense. Saving $39 at the expense of potentially thousands is not a sound decision." ## The Outcome Today, Dr Harish runs his clinic with confidence that a meaningful layer of cybersecurity protection is in place : one that goes beyond basic antivirus and aligns with the intent of HIA requirements. "I now have a robust solution in place. This goes well beyond basic antivirus protection." Importantly, the solution also positions his practice for future regulatory compliance. Measures implemented today will contribute toward formal requirements when they become mandatory. "I am not only protected today but also prepared for future HIA requirements. The safeguards already in place will contribute directly toward compliance, so there will be no need to start from scratch. It is similar to installing a fire alarm system - the likelihood of a serious incident may be low, but the cost and effort of protection are minimal compared with the potential consequences." Dr Harish has since recommended StrongKeep to colleagues who are beginning to consider HIA implications. His advice is straightforward: early preparation is far easier than reactive action later. "The Health Information Act is already in force, so there is little reason to delay. Even for small clinics, the cost is highly affordable, and many doctors have simply not realised how straightforward it is to implement effective protection." ## Company Profile - Neumark Surgery - Staff size: 2 - Objective: Protect patient data ahead of Health Information Act enforcement - Alternatives explored: Basic antivirus, consultants ## Results with StrongKeep - Clinic computers protected with enterprise-grade cyber protection - Clear pathway towards HIA readiness - Cyber protection implemented without disrupting clinic operations - Total cost: US$39 (S$49)/month for the entire clinic, billed annually - Already recommending StrongKeep to fellow practitioners! ## Hackers aren't waiting. Protect your business before it's too late! Get Started --- ### Integra Partners Case Study URL: https://www.strongkeep.com/case-studies/integra/ Date: 2026-04-18 Author: StrongKeep Category: Case Study When Integra Partners spun out as an independent venture capital firm, COO Ling knew that protecting confidential investor data was non-negotiable. See how she found StrongKeep and secured her 10-person team without needing IT staff or consultants. ## Protecting Investor Data: Peace-of-mind cybersecurity with StrongKeep When Integra Partners spun out as an independent venture capital firm in 2020, COO Ling knew that protecting confidential investor data was non-negotiable. After two rounds of bouncing between vendors due to acquisitions, she found StrongKeep and made the switch. Today, Integra operates with confidence that their small team's devices are protected without the complexity of enterprise solutions. Start StrongKeep for free! Ling COO, Integra Partners 10 Staff protected 0 Consultants needed 0 Downtime during migration ## The Problem As a VC firm, Integra holds sensitive data - investor KYC documents, passport photos, confidential deal flow. From the outset, Ling and the team took a proactive approach to addressing cybersecurity risks. "In Singapore, it seems that most companies do the bare minimum to stay compliant. But we handle confidential information - not just from our portfolio companies, but also from our investors. KYC information, passport photos, all of that. We recognised that safeguarding this information is simply good practice." They'd inherited their cybersecurity vendor from their former parent company prior to their spin-out. It worked very well - until the vendor was acquired, and acquired again. Each time, the service changed hands and the minimum client size crept upward. "When the second sale went through, the vendor decided the minimum number of people they wanted to serve was one or two thousand. We clearly don't have that." Integra was dropped. The enterprise vendors they explored were built for large organisations - overkill for a currently ten-person team without an IT department. "We don't have an IT department. I'm the one who deals with laptops, systems, and making sure everyone's devices are working. I needed something I could manage myself." ## The Solution Ling discovered StrongKeep and was drawn to the all-in-one approach - endpoint protection, web firewall, and password management in a single platform, without the complexity. "The onboarding was pretty seamless. We had a small hiccup when we were running both the old and new systems at the same time, but once we sorted that out, everything just worked." The migration was completed across all devices without disrupting the team's workflow. What stood out was the simplicity. Everything was managed from one platform - no separate tools to configure, no vendors to coordinate. And critically, it ran in the background without requiring Ling's constant attention. "It was really just in the background, reviewing things and flagging what needed attention. I trust the system. If nothing happens, that's good - it means it's doing its job." ## The Outcome Today, Integra operates with multiple-layers of protection - endpoint monitoring for malicious activity and a web firewall blocking phishing attempts before they reach staff. Alerts surface when something suspicious happens, but doesn't overwhelm the team. "The only alerts I've gotten are when our team members travel and are working from a sensitive international location. It flags it, but it doesn't stop them from doing what they need to. That's the right balance." For Ling, the value is clearest in the day-to-day reality of managing a small team's devices. "With a team of less than twenty, our IT process is flexible. People can pick their own laptops, devices change hands. That's exactly why we need a platform that just handles it." Since joining StrongKeep, Ling has offered to share the platform with other VC firms in her network - a sign of confidence that speaks louder than any metric. ## Company Profile - Organisation: Integra Partners - Industry: Venture Capital - Team size: 10 - Previous solution: Legacy cybersecurity system (dropped after two acquisitions) - Alternatives explored: Enterprise cybersecurity vendors - Objective: Protect confidential investor and portfolio company data with a solution sized for a small team ## Results with StrongKeep - Migrated from legacy vendor with no downtime or data loss - COO manages security independently without IT staff - Protection runs in the background without constant oversight ## Hackers aren't waiting. Protect your business before it's too late! Get Started --- ### IHRP Case Study URL: https://www.strongkeep.com/case-studies/ihrp/ Date: 2026-05-08 Author: StrongKeep Category: Case Study For IHRP, cybersecurity was not being overlooked. The challenge was gaining sufficient visibility into the organisation's cybersecurity posture to prioritise action, support internal reporting, and evidence its controls for external assessment under the CSA Cyber Essentials Mark (CEM). ## Helping IHRP gain clearer visibility into its cybersecurity posture For IHRP, cybersecurity was not being overlooked. The challenge was gaining sufficient visibility into the organisation's cybersecurity posture to prioritise action, support internal reporting, and evidence its controls for external assessment under the CSA Cyber Essentials Mark (CEM). As a lean organisation, IHRP had limited resources for continuous monitoring and independent risk validation. The team needed a more structured way to benchmark its existing policies, identify gaps, and assemble the evidence base required for CEM certification, without significantly expanding internal capabilities. StrongKeep helped IHRP run a gap analysis across its cybersecurity policy framework, adopt a tailored set of policy templates, and organise the evidence trail required for CEM assessment. Start StrongKeep for free! James Wang Manager, Digital & Technological Operations, IHRP 5 Key cybersecurity areas reviewed 12 Customised policy templates adopted Certified Cyber Essentials, Dec 2025 ## The Problem IHRP understood the importance of cybersecurity, but visibility across its overall posture was limited. Without a clear and independent view, it was difficult to determine which risks required attention, where policy gaps existed, and which controls were already documented to assessor standards. "Prior to using StrongKeep, one of the main challenges was limited visibility into our overall cybersecurity posture. As a lean organisation, resources for continuous monitoring and independent validation of potential risks were constrained." This created uncertainty around the organisation's potential exposure to cybersecurity risks, and added friction when preparing for compliance and certification cycles. "It resulted in some uncertainty around potential exposure to risks, and made it harder to evidence our controls when needed." IHRP needed a more structured approach to reviewing cybersecurity. One that could surface the right issues, produce policy documentation aligned to recognised frameworks, and remain practical for a lean team to manage. ## The Solution StrongKeep provided IHRP with a practical framework for reviewing its cybersecurity environment and closing documentation gaps against the CEM control set. Rather than approaching cybersecurity as one broad and complex area, the engagement focused on several key domains: asset management, system protection, patching, backup practices, and incident preparedness. These are the same areas covered by the CEM requirements. "StrongKeep's gap analysis benchmarked our existing policies and surfaced where we needed to strengthen documentation. We adopted twelve customised policy templates covering incident response, data backup, access control, asset management, secure configuration, and related areas, and put each through our internal review and approval process." The platform's compliance module then helped organise the evidence collection required by the assessor, mapping controls to artefacts in a structured way. "The organisation was exploring options to better understand its cybersecurity environment and identify risks in a more structured manner, without significantly expanding internal capabilities." For IHRP, StrongKeep offered the right balance between external perspective and practical guidance, helping the organisation strengthen its approach without adding unnecessary operational complexity. ## The Outcome StrongKeep helped IHRP move from uncertainty towards a clearer, more organised view of its cybersecurity posture, and to a tangible certification milestone. "With StrongKeep's support, IHRP achieved the CSA Cyber Essentials Mark in December 2025. It provided greater clarity on existing gaps and areas for improvement, and gave us a documented baseline we can return to as our cybersecurity needs evolve." With clearer visibility into gaps and improvement areas, cybersecurity discussions became more grounded and actionable. The organisation was better placed to consider what needed attention, what could be improved, and how risks should be communicated internally and to the board. "StrongKeep offers a structured approach to reviewing and improving cybersecurity practices, with an emphasis on identifying and addressing potential risks." Looking ahead, IHRP is preparing for its CEM renewal cycle in 2027, which will expand scope to cover delta requirements around AI, operational technology (OT), and cloud security. The documented baseline established through the StrongKeep engagement provides a starting point for that next cycle, rather than a blank page. For organisations with limited in house cybersecurity resources, IHRP shared: "It may be relevant for organisations that are looking for additional external perspectives on their cybersecurity posture, particularly where in-house resources are limited." For IHRP, StrongKeep helped turn cybersecurity from a broad area of concern into a more structured, visible, and certifiable process. ## Company Profile - Organisation: IHRP (Institute for Human Resource Professionals) - Website: ihrp.sg - Industry: Human Resources / Professional Body - Objective: Achieve CSA Cyber Essentials Mark certification and establish a documented cybersecurity baseline - Challenge: Limited visibility into overall cybersecurity posture and documentation gaps for assessor grade evidence - Internal context: Lean organisation with constrained resources for continuous monitoring and independent risk validation - Areas reviewed: Asset management, system protection, patching, backup practices, and incident preparedness ## Results with StrongKeep - Achieved CSA Cyber Essentials Mark certification in December 2025 - Adopted twelve customised cybersecurity policy templates covering the CEM control domains - Established a documented and assessor ready evidence base through the compliance module - Gained greater clarity on existing cybersecurity gaps and areas for improvement - Established a more organised approach to managing cybersecurity processes - Supported more informed internal discussions around cybersecurity risks and controls - Added an external perspective without requiring significant internal capability expansion - Built a documented baseline to support the 2027 CEM renewal, including delta scope for AI, OT, and cloud security ## Hackers aren't waiting. Protect your business before it's too late! Get Started --- ### Case Study: Stopping a "ClickFix" Infostealer Before It Could Steal URL: https://www.strongkeep.com/case-studies/clickfix-infostealer-case-study/ Date: 2026-07-01 Author: StrongKeep Security Team Category: Case Study A ClickFix infostealer landed on one device at a Singapore SME. StrongKeep's DNS filtering blocked thousands of call-home attempts while EDR reconstructed the attack, with no evidence of data leaving the network. Case Study ## Stopping a "ClickFix" Infostealer Before It Could Steal A single pasted command let an infostealer onto one device at a Singapore SME. StrongKeep's layered defence blocked it at the network and caught it on the endpoint, before anything could leave the building. July 1, 2026 By StrongKeep Security Team > 1,000 Call-home attempts blocked 65 Devices protected 0 Other devices infected AI (like Claude / Codex) has "trained" humans to do two very dangerous behaviours, which led to an attack on a local company (that StrongKeep helped protect). Firstly, we are all being trained to copy commands into terminals without really understanding what they do. Secondly, we are all clicking "Yes" blindly to the permissions. Recently, we just protected a customer against what’s known as a "ClickFix" attack, which is one of the cleverer tricks going around that exploit exactly those two behaviours. A ClickFix infostealer landed on one device at a Singapore SME, most likely before the customer moved to StrongKeep. It never got the chance to do its job. StrongKeep blocked every attempt it made to reach its control servers and detected the activity on the endpoint, and the same protection was extended automatically to every other customer. ## At a Glance - Customer: a Singapore SME running around 65 devices across Windows and Mac (anonymised) - Threat: a ClickFix infostealer on one device, most likely present before StrongKeep was deployed - What StrongKeep did: blocked the malware's connection to its control servers and detected the activity on the endpoint - Outcome: no evidence of data leaving the customer's network on StrongKeep's watch; device cleaned; the same protection extended automatically to every other customer ## The Threat: ClickFix ClickFix is a social-engineering attack that turns the user into the attacker's hands. A fake error page, fake CAPTCHA, or fake "fix it" prompt tells the person to copy a line of text and paste it into their Terminal (Mac) or Run box (Windows). That single paste installs an infostealer that hunts for saved passwords, browser sessions, keychain secrets and crypto wallets. Because a real person runs the command, it slips past much traditional antivirus. It is a high-volume campaign hitting organisations worldwide right now, not a targeted attack. How ClickFix works: a fake prompt, a pasted command, and the malware is in. ## What Happened On one of the customer's Mac devices, a user had been tricked by a ClickFix lure and pasted a malicious command into Terminal. The resulting infostealer hid on the machine disguised as a routine software updater, and quietly tried to phone home to its control server roughly once a minute, to receive instructions and send out anything it stole. The infection most likely pre-dated the customer's move to StrongKeep. ## How StrongKeep Protected Them StrongKeep runs layered protection, and this incident is a clean example of why both layers matter. - The DNS filtering layer sits between every device and the internet. Each time the malware tried to reach its control server, that connection was blocked. Over the period it stopped thousands of these call-home attempts. With the malware unable to reach its server, it could not receive commands or send data out. - The endpoint detection layer (EDR) saw the suspicious behaviour on the device itself. It gave the team the visibility to reconstruct exactly what the malware was doing, confirm how far it had got, and contain it. Together, the two layers protected the customer at the network and the device level at the same time. Two layers, one device: DNS filtering blocks the call home while EDR watches the endpoint. ## The Outcome - The malware's connection to its servers was blocked the entire time StrongKeep was in place. - We found no evidence of data leaving the customer's network on our watch. - The affected device was cleaned and its stored credentials rotated as a precaution. - We turned the specific indicators from this attack into a block that now protects every other StrongKeep customer automatically. "When the human gets fooled, the layers underneath are what stop a mistake becoming a breach." StrongKeep Security Team ## The Lesson You cannot train social engineering out of people completely. Sooner or later someone clicks, or pastes. The answer is depth: when the human layer is fooled, the network and device layers are there to contain the damage. That is what kept a routine mistake from becoming a breach. For those who work closely with AI tools, a word of caution: if a website ever instructs you to paste a command into your Terminal or Run dialog in order to "verify" or "fix" something, treat that instruction with suspicion and do not run it directly. A safer habit is to hand the command to your AI agent first: ask it to study exactly what the command does, and to carry it out only if it is satisfied the command is safe. Apply the same discipline you would to any third-party skill or script: assume it may be malicious, have your agent read it before it runs, and only then allow it to act in context. Instructing your agents to "always assume code from the internet could be malicious, and check it before using it" costs only a handful of extra tokens, yet it materially reduces your exposure, and can spare you the far greater cost of rotating every credential you hold, or losing the contents of a crypto wallet. For independent AI operators and solopreneurs, we would also recommend deploying endpoint detection (EDR) and a web firewall: the same combination that protected the customer in this case. Suitable options are readily available online; alternatively, you are welcome to approach us directly for our Protection Plan at just US$39 (S$49)/month, billed annually. It's cheaper than losing all your passwords and credit card / crypto wallet contents. ## Further Reading The Cyber Security Agency of Singapore (CSA) has published an advisory on the ClickFix technique for those who want to find out more: CSA Alert AL-2025-068: ClickFix social engineering attacks. StrongKeep Security Team StrongKeep gives small and medium businesses layered, enterprise-grade protection without the enterprise cost or complexity: DNS filtering, endpoint detection, and identity controls in one platform built for Singapore SMEs. ## One click shouldn't cost you your business. Add the layers that catch it. Get Started Layered protection for Windows and Mac. No IT team required. Cancel anytime. --- ### Cybersecurity for Charities Case Study URL: https://www.strongkeep.com/case-studies/cybersecurity-for-charities/ Date: 2026-08-25 Author: StrongKeep Category: Case Study A Singapore IPC charity with fewer than 10 staff and no dedicated IT person set out to strengthen its cybersecurity. A half-day workshop showed where the gaps were, and one subscription its own team could manage covered several of them. ## Cybersecurity for charities: how a small IPC charity found a practical way to strengthen cybersecurity, without an IT team or a large budget This case study has been anonymised upon request. We are a Singapore charity that supports the development and wellbeing of children, particularly children from disadvantaged backgrounds and children with disabilities. Our work also recognises the important role adults play in children's lives. We work with parents, educators and community practitioners, building their capability to create environments where children can thrive. We are a small team with no dedicated IT person. Get Started 0 People on the team who work in IT 1 Subscription across the team's work computers US$39 (S$49) A month, on annual billing The Problem ## Cybersecurity became part of our responsibility, but we had no IT team Over the past few years, the National Council of Social Service (NCSS) has increasingly highlighted cybersecurity and data protection as important aspects of good governance for charities. As an organisation entrusted with information about children and families, as well as donations and public funds, we have always sought to handle this responsibility with care. These growing expectations also prompted us to consider how we could further strengthen our cybersecurity practices. The challenge was figuring out what good cybersecurity could look like for an organisation of our size, and finding something we could realistically afford and manage. The push to strengthen our cybersecurity came from recognising that this was increasingly part of being a responsible charity. For two or three years, NCSS had been running sessions for charities on protecting data and strengthening organisational practices. Cybersecurity was increasingly discussed alongside financial sustainability, risk management and board governance. What made the issue more real were the stories we heard through sector sessions and conversations with other charities: real examples of organisations experiencing cybersecurity breaches and the consequences that followed. "When NCSS shares real-life stories about cyber breaches... it's really scary how the breaches happen. If there's no protection, you can lose not only information, but also people's trust and your reputation." Staff of the Charity The Diagnosis ## We knew cybersecurity mattered. We just didn't know where our gaps were. Like many small charities, our systems had grown organically. Being a small team with no dedicated IT person with everyone's plate already full, we knew cybersecurity was important, but it was difficult to know where to begin. "To be fair, I think we didn't know where we needed to be protected, or what was exposing us." Executive Director Our first step was not to buy a product. Instead, we reached out to a contact who works in cybersecurity. We engaged him with an honorarium to facilitate a half-day workshop with the team. We talked through our everyday practices and the kinds of risks a small organisation like ours needs to consider. He helped us identify areas where our cybersecurity practices could be strengthened. One of the most useful insights was that cybersecurity was not simply about buying software. Some of the areas for improvement were rooted in everyday habits and practices. The workshop also gave us a clearer sense of what we needed. Based on the recommendations, we then researched the options available in the market and considered what would be appropriate for an organisation of our size, needs and resources. The Solution ## Finding something simple enough for a small team to manage The ED had previously heard StrongKeep co-founder Gaurav Keerthi speak at a sector event. One thing had stayed with her: there might be a cybersecurity option designed with smaller organisations and their budgets in mind. "I listened to a talk with Gaurav and I thought, this could be an option, because it's affordable. You always think of cybersecurity as very expensive." Executive Director The invitation into the world of cybersecurity prompted us to think more carefully about how our team actually works. Most of the week, staff are not sitting together in one office. We work across programme spaces, community settings, meetings and from home. Protecting only an office network therefore did not necessarily reflect the way our organisation operates. We needed something that could travel with our laptops and support the everyday behaviour of our team. StrongKeep addressed several of the gaps identified during our cybersecurity workshop. The ED also explored larger consumer cybersecurity brands. But for a small charity without an IT department, the question was not simply whether the technology worked. It was whether we could understand it, manage it and get support when we needed it. And, of course, cost mattered. StrongKeep offered protection for devices at US$39 (S$49) per month on annual billing, with its pricing published openly rather than requiring an individual quotation. "It's affordable and the offering was important." Executive Director The Outcome ## We now know what we have in place, and can explain it When our Board, funders or partners ask what we are doing about cybersecurity, we can now clearly explain what is in place, what it protects and what it costs. A colleague within the team is able to manage the platform without needing to be an IT specialist, making it practical for our small team. The process has helped us build on our existing cybersecurity practices, adding several additional layers of protection across our work computers. More importantly, it has helped the team better understand where some of our vulnerabilities were and the role each of us plays in keeping the organisation and the information we hold safe. It did not remain theoretical for long. One morning, one of our staff received an email from one of their actual partners. It came from the partner's real email address and asked her to click a link to update her details. The partner's email account had been compromised. Nobody at our charity clicked the link. Instead, the team stopped, checked and contacted the partner. The issue was dealt with that morning. For us, that moment reinforced something important: cybersecurity is not only about technology. It is also about creating awareness and habits within the team, knowing when to pause, question and check. Asked whether she would recommend StrongKeep, we came back to two things: affordability and having a level of protection that makes sense for a small organisation. "I would say yes, I would recommend it. Because it's affordable... and the technical components, it's good. It's good enough." Executive Director ## Company Profile - Organisation in Singapore: IPC Charity - What we do: Support children's development and wellbeing, while building the capability of the adults in their lives - Team size: Less than 10 staff - Before StrongKeep: No organisation-wide cybersecurity product - Also considered: Home antivirus with a separate firewall and VPN, as well as two other suppliers - Our goal: Strengthen cybersecurity as part of our broader governance responsibilities in a way that a small charity without an IT team could realistically manage ## What our charity has now - Additional layers of cybersecurity protection through one subscription - A system that a team member can manage without being an IT expert - Greater awareness of cybersecurity across the organisation - A clearer answer when our Board and funders ask how we protect the information entrusted to us - Most importantly, a stronger shared understanding that protecting our organisation and its data is everyone's responsibility ## When your board asks about cybersecurity, have an answer. Get Started --- ### Incident 408: The Most Honest Malware We've Blocked All Year URL: https://www.strongkeep.com/case-studies/incident-408-pdf-crack/ Date: 2026-09-22 Author: StrongKeep Security Team Category: Case Study A licence cracking tool bundled with a pirated PDF editor landed on a staff device at a Singapore SME. The filename asked the user to disable their antivirus first. StrongKeep blocked it before it ran. Case Study ## Incident 408: the most honest malware we've blocked all year Most malware lies about what it is. This one put its intentions in the filename, told the user to switch off their antivirus first, and asked to be run as administrator. StrongKeep blocked it anyway. September 22, 2026 By StrongKeep Security Team 31/70 Security vendors flagged the file -12 VirusTotal community score 0 Times it was allowed to run Malware usually goes to some trouble to look boring. It dresses up as a font installer, a delivery notification, or a routine software update. Incident 408 skipped all of that. It announced what it was, stated its preferred working conditions, and included operating instructions, all in the filename. Nobody at the customer was targeted. Somebody just wanted to edit a PDF without paying for the software, found a free copy online, and unzipped it. StrongKeep blocked the file on the device before it ran. ## At a Glance - Incident: 408 - Customer: a Singapore SME (anonymised) - Threat: a licence cracking tool bundled inside a pirated PDF editor - How it arrived: downloaded by a staff member and extracted to disk using Windows File Explorer, the normal file browsing program - What StrongKeep did: blocked the file on the endpoint before it was run - Outcome: the crack never executed, no administrator rights were granted, and the device was cleaned ## The Filename Was the Entire Warning The file landed here, in the Downloads folder of a standard user account: C:\Users\user\Downloads\WINDOWS PDF.2025 v25.001\WIN PDF 2025\第二步crack(右键以管理员运行).exe For anyone who does not read Chinese, that translates to roughly "step two crack (right-click to run as administrator)". Two things are worth sitting with. The first is "step two", which implies a step one that had already happened and a step three that was still to come. The second is that the file asks, by name, for the highest level of access on the machine. The same file has been seen elsewhere under an English name, and whoever chose it was not hiding anything either: "STEP 2 CRACK PLEASE DISABLE ANTIVIRUS BEFORE EXTRACTING THIS.exe" The actual filename, capital letters and all This is the part that deserves a moment of respect. The attacker did not need a zero-day, a phishing email, or a clever lure. They simply asked people to turn off their security software, and enough people do it that the technique keeps paying. The sample as the rest of the industry sees it, filename and all. ## What the File Actually Was Thirty-one of seventy security vendors flagged the sample as malicious, and its community score sat at -12. The behavioural tags attached to it tell a consistent story: - peexe confirms it is a Windows executable, not the document or utility a user might assume they had downloaded. - calls-wmi means it reaches into a management interface that is built into every copy of Windows. Attackers like it because it is already installed, already trusted, and already permitted to make changes. - detect-debug-environment means the file checks whether it is being watched by an analyst before deciding how to behave. Legitimate software has no reason to care. - overlay means extra data has been bolted onto the end of the file, a common way to smuggle a second payload inside something that still looks like one program. A tool whose only advertised job is patching a licence check does not need to evade analysts or hide a second payload. The crack was the bait. Whatever was in the overlay was the business model. If you want to check this sample against your own tooling, or search your estate for it, the SHA-256 is: c44b70655b22bce392a0b29ba7ddf4fcf39976fdad8ba0c6cd6585b2e11a059d ## How It Got There There was no exploit and no compromised website pushing files onto the machine. StrongKeep recorded that the file was written to disk by Windows File Explorer, which is the ordinary program people use to browse folders. That detail matters, because it tells us exactly what happened in human terms: a member of staff downloaded a folder of PDF editing software, opened it, and extracted the contents. Windows did precisely what it was told. So did the person. This is the uncomfortable truth about most SME incidents. They are not sophisticated. They are somebody trying to get their job done with the tools they could find. ## How StrongKeep Blocked It StrongKeep's endpoint protection identified the file as malicious as it landed on disk and blocked it there. The crack was never executed, so it never got the administrator rights its own filename was asking for, and "step three" never arrived. Worth noting what did not have to happen. Nobody had to spot the Chinese filename. Nobody had to recognise that a free PDF editor with a bundled crack was a bad idea. Nobody had to resist the instruction to disable their antivirus, which was the one instruction the whole attack depended on. The protection held at the point where human judgement had already been overtaken by the desire to finish a document. "If a program asks you to switch off your antivirus before you open it, it has already told you what it is." StrongKeep Security Team ## Why the Free Version Is Rarely Free Cracks are unusually effective delivery vehicles, for reasons that have nothing to do with technical skill: - They come with permission to disable your defences. No other category of software can ask this and be taken seriously. A crack can, because users expect a false positive. - They need administrator rights by design. Patching a licence check means writing to protected files, so anything riding along inherits full control of the machine. - Nobody reports them. If the PDF editor works, the user assumes it went fine. If something feels off afterwards, admitting it means admitting to installing pirated software. There is a second bill, too. Unlicensed software on a company device is a compliance problem in its own right. Cyber Essentials, most customer security questionnaires, and any serious procurement review will ask whether your software is licensed and supported. "One of the team found a free copy" is not an answer that survives contact with an auditor or a client. ## What to Do Instead - Check what you already own. Most PDF work at an SME is filling, signing, merging and converting. Microsoft Edge and most modern browsers handle a lot of that, and Word will open and edit a PDF directly. The paid editor is often solving a problem nobody actually has. - Take administrator rights off day-to-day accounts. A standard user cannot install a crack even if they want to, which removes the decision from the moment of temptation. - Run endpoint protection that stops the file, not just the website. This one arrived inside a folder a user had already downloaded and unzipped. Blocking it needed something watching the device itself. - Make it easy to ask. Staff go looking for cracked software when buying the real thing is slow or awkward. A clear route to request a licence, answered in days, is a cheaper security control than most tools you can buy. The employee in this case was not careless or reckless. They had a document to finish and found something that promised to help. That is going to keep happening, in every business, forever. The job of security is to make sure it stays a wasted afternoon instead of an incident. StrongKeep Security Team StrongKeep gives small and medium businesses layered, enterprise-grade protection without the enterprise cost or complexity: DNS filtering, endpoint detection, and identity controls in one platform built for Singapore SMEs. ## Your team will download something they shouldn't. Be ready when they do. Get Started Endpoint protection for Windows and Mac. No IT team required. Cancel anytime. --- ## Comparisons ### Antivirus vs EDR: what business-grade protection actually means URL: https://www.strongkeep.com/compare/antivirus-edr/ Category: By tool Consumer antivirus catches yesterday's malware. Business-grade EDR contains today's incidents before they spread. Compare StrongKeep Cortex, Norton, Bitdefender, Trend Micro, and Microsoft Defender. Compare · Antivirus vs EDR ## Why one EDR beats a stack of consumer antivirus and what auditors actually look for Consumer antivirus catches yesterday's malware. Business-grade EDR contains today's incidents before they spread. Here is how the four most-used SME options compare. ## What is the actual difference? Most SME owners we audit assume antivirus and EDR are the same thing with different names. They are not. Three plain-English distinctions cover most of the gap. Distinction 1 ## Signature vs behaviour Consumer antivirus looks for known bad files. EDR watches for suspicious behaviour: process injection, ransomware encryption patterns, unusual privilege escalation. New malware never matches a signature on day one. Distinction 2 ## One device vs the whole team Consumer antivirus protects a single laptop. EDR consoles let one human see the whole estate, push policy changes, and review alerts across every device in one place. Distinction 3 ## Block vs contain Consumer antivirus blocks bad downloads. EDR isolates an infected device from the network at the moment of detection, so a ransomware incident on one laptop cannot reach the file server. ## How the four most-used SME options compare Read the row, not just the tick. Feature StrongKeep (Cortex EDR) Norton Small Business Bitdefender GravityZone Trend Micro Worry-Free Microsoft Defender (free) Detection method Behaviour + signature + AI Signature-first Signature + heuristics Signature + heuristics Signature + heuristics Ransomware containment Auto-isolate Limited Limited Limited No Central console Yes Add-on Yes Yes Local only Supports BYOD Yes Yes Yes Yes Limited (managed devices only) Automatic incident isolation Yes No No No No Time to roll out (5-person team) First device protected in minutes · whole team in under 2 hours Per-device install Per-device install + console setup Per-device install + console setup Manual per device Price (per device / month) Included in Protection, from US$39 (S$49)/month SG SMB pricing on application SG SMB pricing on application SG SMB pricing on application Bundled with Windows Pricing for Norton, Bitdefender, and Trend Micro is not published on SG SMB pages at the time of writing. Request a quote from each vendor for a like-for-like comparison. ## What if I am already on Microsoft Defender? Defender for Business (the paid Microsoft 365 SKU) is a credible EDR. Defender free (the version that ships with consumer Windows) is not. Most SG SMEs we audit have Defender free running with an unpaid licence gap they did not know about. If you are already on Defender for Business or another paid EDR, declare it in your cyberscan and the assessment moves to Strong. We have a separate comparison for that case: StrongKeep compared to Microsoft Defender. ## The hidden cost of stacking Most SMEs we audit pay for four or five overlapping tools: consumer antivirus, DNS filter, password manager, training platform, and quarterly compliance consulting. Add them up and the per-device cost is usually 1.5 to 2 times a single bundled EDR plan. One vendor, one console, one bill. Consolidating onto a single bundled plan typically lands well below the sum of the line items it replaces, and renewals stop showing up five times a year. ## Switch from consumer antivirus to business-grade EDR Protection plan includes Cortex EDR, DNS filtering, password manager, and bite-sized cyber training. One line item of US$39 (S$49) per month, billed annually, covering up to 5 devices. First device protected in minutes; whole team in under two hours. CSA Cyber Essentials evidence collection and audit-ready compliance reporting live in the Compliance plan layered on top. Start with a Free Scan See the protection feature in detail No credit card required to run the free cyberscan. ## Related comparisons Compare ## Already running CrowdStrike or Sophos? We rarely recommend mid-contract EDR replacements. Here is how we layer alongside instead. Compare ## StrongKeep compared to Microsoft Defender What a Microsoft 365 Business Premium quote buys, and what the same money buys from us. ## See exactly what an attacker would see. Run the free cyberscan. Start with a Free Scan --- ### Cybersecurity compliance frameworks: which one applies to you URL: https://www.strongkeep.com/compare/compliance-frameworks/ Category: By framework A plain-English map of the Singapore frameworks (PDPA, CSA Cyber Essentials, Trust Marks and the Health Information Act) plus the international standards coming next (UK Cyber Essentials, EU NIS2 + CyFun, Australia Essential 8), and what StrongKeep automates for each. Compare · Compliance frameworks ## Which cybersecurity frameworks apply to your business? Singapore today, internationals next. Most SG SMEs see three or four unfamiliar acronyms on their cyberscan and want one question answered. Which of these actually applies to me? Here is the map, including the international standards we are adding next. ## The shortest version For most SG SMEs: PDPA applies by default. CSA Cyber Essentials is the realistic starting cert. Trust marks (DPE, Cyber Trust) are tender and customer-facing signals. The Health Information Act (HIA) will apply to licensed healthcare providers, with deadlines by batch from September 2027 to March 2030. MAS-TRM is sector-mandatory for licensed financial institutions and on our roadmap. International equivalents (UK Cyber Essentials, EU NIS2 + CyFun, and Australia Essential 8) are on the way as we expand outside Singapore. ## The frameworks at a glance Framework Who it is for Mandatory? Renewal cadence What StrongKeep automates PDPA All SG businesses handling personal data Yes (law) Ongoing Privacy policy template, DPO contact, breach response runbook, evidence checklist CSA Cyber Essentials SG SMEs, often required by tenders Voluntary (often de facto) Every 2 years Most evidence; remainder is operator attestation CSA Cyber Trust Mark SG SMEs signalling beyond CE Voluntary Every 2 years CE controls plus extended monitoring CSA Cyber Trust Mark (Level 3) SG SMEs in regulated supply chains Voluntary (higher tier) Every 2 years Coming soon DPE Trust Mark Customer-facing SMEs (B2C) Voluntary Every 2 years PDPA controls plus customer-trust signals Health Information Act (HIA) Licensed healthcare providers (every HCSA licensee) Yes (law) From early 2027, with deadlines by batch: September 2027, September 2028, March 2030 Self-attested to MOH by your batch deadline. The certifiable mark is CSA's Cyber Essentials (HIA) HIA readiness: security tools, generated policies and the evidence behind your attestation MAS-TRM MAS-licensed financial institutions Yes (sector mandate) Continuous Coming soon UK Cyber Essentials UK SMEs and government supply chain Voluntary (often required for tenders) Annual Coming soon EU NIS2 Essential and important entities in the EU Yes (EU directive) Continuous Coming soon EU CyFun EU SMEs (Belgium-led cyber-fundamentals framework) Voluntary baseline Continuous Coming soon Australia Essential Eight AU businesses and Commonwealth supply chain Voluntary (mandatory for federal contractors) Continuous (maturity-based) Coming soon Coverage percentages and exact automation scope vary by framework version. Check with a StrongKeep consultant before submission to confirm what is and is not auto-collected for your sector. "Coming soon" frameworks are on our roadmap as we expand outside Singapore. ## One paragraph per framework PDPA ## Personal Data Protection Act The baseline law. Applies to every SG business handling personal data. Covers consent, purpose, accuracy, protection, retention, and notification obligations. CSA Cyber Essentials ## The realistic starting cert Voluntary in principle, often required in practice by government tenders, MNCs, and larger customers. Renews every two years. Most SMEs we work with start here. CSA Cyber Trust Mark ## The next step up For SMEs that want to signal cybersecurity maturity beyond Cyber Essentials. Adds monitoring and risk-based controls. Level 3 (deeper assurance for regulated supply chains) is on our roadmap. DPE Trust Mark ## Data Protection Essentials A customer-facing trust signal under PDPC for businesses handling personal data. Useful for B2C SMEs that want to show data-handling discipline on their website. HIA ## Health Information Act MOH's law for licensed healthcare providers. It takes effect from early 2027, and deadlines run by batch from September 2027 to March 2030 (see which batch you are in). Providers self-attest their readiness to MOH; the certifiable mark is CSA's Cyber Essentials (HIA). Read our plain-English HIA guide. MAS-TRM ## Technology Risk Management (coming soon) Mandatory for MAS-licensed financial institutions. Sets continuous expectations on technology risk, third-party management, and incident response. On our roadmap. UK Cyber Essentials ## UK starting baseline (coming soon) NCSC's foundational scheme. Increasingly required in UK government tenders and supply chains. Close equivalent to CSA Cyber Essentials. EU NIS2 ## EU directive on essential entities (coming soon) Requires essential and important entities across the EU to implement cybersecurity risk-management measures and report incidents. Significant scope expansion compared with NIS1. EU CyFun ## Cyber Fundamentals (coming soon) The Belgian-led Cyber Fundamentals framework, increasingly used as a practical baseline for EU SMEs. Maps cleanly to NIS2 obligations. Australia Essential 8 ## ACSC's eight mitigation strategies (coming soon) The Australian Cyber Security Centre's prioritised list of eight mitigation strategies. Mandatory for federal contractors and de facto for AU SMEs in regulated supply chains. ## Phased path: get HIA-ready before your batch deadline For clinics working towards the HIA specifically. Protection plan fixes technical posture today. The Compliance plan adds policies, evidence tracking, and gap monitoring so your readiness evidence is in place well before your batch deadline. If you also want a certificate to show, CSA's Cyber Essentials (HIA) mark is the route. The pattern is the same for international frameworks on our roadmap: register on Protection now to fix the controls, layer on Compliance when the local cert opens for your market. ## What StrongKeep automates per framework Per framework, the platform collects most of the evidence and produces submission-ready documents. Operator attestations remain manual by design (no platform can attest on behalf of a Director). For Cyber Essentials, this typically means most of the work happens in the platform and the remainder is a half-day of owner attestations and supporting documents. Be honest about limits. No platform can promise 100 percent automation across every framework: some controls require human judgement on business processes. We tell you exactly which ones before you submit. ## Get the compliance map turned into a checklist The Compliance plan turns the framework that applies to you into a guided submission pack: policies generated, evidence collected, gaps flagged, and a clear list of operator attestations. Start with a Free Scan Read our HIA readiness guide Already on Protection? Compliance layers on top: your existing evidence carries forward. ## Related pages Solution ## Compliance Readiness How StrongKeep's Compliance feature guides you through policies, evidence, and submission without consultants. Case study ## AZAntz met a new cybersecurity requirement to keep a government contract How a small business hit a tender-mandated security bar without hiring IT or running a consultant engagement. ## Compliance does not have to feel like a maze. Start with the cyberscan. Start with a Free Scan --- ### Cyber training that staff actually finish: bite-sized, real-world, and gamified URL: https://www.strongkeep.com/compare/cyber-training/ Category: By tool Annual cybersecurity training stops working by February. Compare StrongKeep's bite-sized, case-study-driven, gamified training with KnowBe4, Proofpoint, and ad-hoc HR-led training. Compare · Cyber training ## Cyber training your staff actually finish bite-sized, real-world, gamified. The standard SME training pattern is a 30-minute video in January, a multiple-choice quiz, and a certificate. By April, recall is near zero. StrongKeep training is built to be the opposite of that: short modules people can finish on a phone in five minutes, real SMB breach case studies, and gamified progression that rewards completion. ## Why annual training stops working by February A 30-minute classroom video tests well at the end of the session and tests poorly six weeks later. Simulated-phishing click rates come back to baseline within a quarter. It is not because the content is bad. It is because a single annual session is the wrong delivery model for a topic that changes weekly. The fix is not more training. It is shorter, more frequent, and rooted in things that actually happened. That is the form factor we built around. ## What StrongKeep training does differently Bite-sized ## Five minutes, finished on a phone Each module is short enough to complete in a coffee break. Staff stop dreading training because it stops being a one-hour block on the calendar. Real-world cases ## SMB breaches, not stock footage Modules are built around incidents that actually happened to small and mid-sized businesses: a clinic ransomwared via a phishing email, a law firm whose vendor portal was credential-stuffed, a charity whose treasurer wired funds to a spoofed CEO address. Relatable beats theoretical, and SMB-scale scenarios beat enterprise war stories your team will never face. Gamified ## Streaks, points, and team leaderboards Completion rewards, team rankings, and progression rings. Sounds gimmicky. Works empirically. Owners tell us their staff actually compete on training scores. No per-user meter ## No limits on frequency, types, or modules Every staff member gets the whole library, refreshed continuously. No "advanced modules from $X extra per user", no per-campaign charges, no quotas. It is included. ## What the library covers Phishing identification, suspicious links and attachments, password hygiene, multi-factor authentication, social engineering by phone and WhatsApp, invoice fraud, AI-generated impersonation, remote-work hygiene, USB and removable media, data classification, incident reporting, and PDPA basics. Modules are refreshed as new tactics appear in the wild. Simulated phishing runs alongside the modules. When a staff member fails a simulated phish, they get the relevant module assigned automatically. ## How the training options compare Feature StrongKeep training KnowBe4 Proofpoint Security Awareness Internal ad-hoc (HR-led) No training Bite-sized modules (≤5 min) Yes: default Yes (configurable) Mix of short and long No No Real-world SMB case studies SMB incidents Global library (US-centric) Global library (US-centric) Depends on the trainer No Gamification (streaks, points, leaderboards) Built-in Limited Limited No No Simulated phishing campaigns Auto Yes (deep + complex) Yes No No Limits on frequency / module types None: full library included Tiered (modules vary by plan) Tiered Limited by your trainer's time N/A Admin overhead to run a programme Minimal (default-on) Designed for a full-time admin Designed for a full-time admin Owner's evening 0 Best fit SMBs 5 – 200 staff Enterprises with training admins Enterprises Very small teams (none) Price (per user / month) Included in Protection, from US$39 (S$49)/month SMB pricing on application SMB pricing on application Free (your time) $0 ## What about KnowBe4? KnowBe4 is the dominant enterprise vendor in this space and the platform itself is highly capable: they support continuous nano-learning, AI-personalised paths, and deep simulated-phishing campaigns. For a 5 to 50 person SMB without a dedicated security-awareness admin, the setup cost and per-user price often outweigh the marginal benefit over StrongKeep's default-on, bundled training. If you have someone whose full-time job is running the awareness programme, KnowBe4 is a reasonable choice. If you do not, StrongKeep's bundled training is the lower-overhead path that still produces real behaviour change. ## Stop running annual training that nobody remembers Bite-sized modules, real-world SMB cases, gamified progression, and simulated phishing: all included in the Protection plan. No separate training admin role required. Start with a Free Scan See the training feature in detail No credit card required to run the free cyberscan. ## Related comparisons Compare ## Antivirus vs EDR Consumer antivirus is not business-grade. Here is what auditors look for instead. Compare ## Compliance frameworks The frameworks live today, the international standards coming next, and what StrongKeep automates. ## Train your team without losing a day to classroom slides. Start with a Free Scan --- ### DNS filtering vs perimeter firewall: where each one stops the attack URL: https://www.strongkeep.com/compare/dns-filtering/ Category: By tool A FortiGate in your office cannot see a staff laptop on home Wi-Fi or hotel networks. Compare DNS filtering and perimeter firewall coverage for SG SMEs. Compare · DNS filtering vs firewall ## DNS filtering vs perimeter firewall where each one actually stops the attack A FortiGate in your office cannot see a staff laptop on home Wi-Fi or hotel networks. DNS filtering travels with the device. ## The coverage map Most SG SMEs we audit already have a hardware firewall in the office. The question is not whether the firewall works. It is what the firewall can see. - Staff in office on work Wi-Fi. Firewall sees this. DNS filter also sees this. - Staff in a café on personal hotspot. Firewall blind. DNS filter sees this. - Staff phone tethering. Firewall blind. DNS filter sees this. - Staff at home on personal Wi-Fi. Firewall blind. DNS filter sees this. In any team where staff work outside the office sometimes, perimeter firewall coverage is roughly 30 to 60 percent of the actual threat surface. The phishing link clicked on a Sunday afternoon at home never touches your FortiGate. ## Where each control covers your team Feature StrongKeep DNS filter Firewall only (FortiGate / Sophos UTM) Cisco Umbrella Cloudflare Gateway No filtering Office network coverage Yes Yes Yes Yes No Home Wi-Fi coverage Yes (agent) No Yes (roaming client) Yes (WARP) No Mobile / phone tethering coverage Yes No Yes Yes No Known-phishing block list (auto-updated) Yes Manual rule sets Yes Yes No Time to deploy (5-person team) First device in minutes · whole team in under 2 hours Multi-day install ~half a day ~half a day 0 Price (per user / month) Included in Protection, from US$39 (S$49)/month Hardware capex + annual maintenance SG SMB pricing on application SG SMB pricing on application $0 ## What if I already have Cisco Umbrella? Cisco Umbrella is a legitimate DNS firewall. We position differently on bundling and SME-friendliness. Umbrella DNS Essentials is typically quoted in the low single-digit-dollar range per user per month for that one capability, on a quote-based annual contract. StrongKeep DNS filtering ships inside the Protection plan, at US$39 (S$49) a month billed annually, alongside EDR, password manager, and bite-sized cyber training in the same line item. If your team is happy with Umbrella, keep it. The DNS-filter piece of Protection can be turned off and you can still use the rest. ## What StrongKeep does that a hardware firewall cannot - Cloud-managed. No rules to update on a box that lives in a wiring cupboard. - Home Wi-Fi and mobile coverage through a lightweight agent. - Blocks known phishing and malware domains at the DNS lookup, before the browser ever connects. - No per-device install required for office traffic. Configure once at the network level. - Logs and reports flow into the same console as your EDR alerts. ## Close the home Wi-Fi gap in an afternoon DNS filtering ships inside the Protection plan. No extra licence to buy. Start with a free cyberscan to see what your current setup misses. Start with a Free Scan Why a hardware firewall is not enough No credit card required to run the free cyberscan. ## Related comparisons Compare ## Antivirus vs EDR Consumer antivirus catches yesterday's malware. EDR contains today's incidents before they spread. Compare ## MFA vs password manager MFA protects one login. A password manager protects all of them. Here is why both belong. ## Find your home Wi-Fi gap before an attacker does. Start with a Free Scan --- ### MFA vs password manager: different problems, both required URL: https://www.strongkeep.com/compare/password-manager/ Category: By tool Multi-factor authentication blocks attackers who already have the password. A password manager stops staff reusing the same password on 12 sites that are not yours. Compare team password managers for SG SMEs. Compare · MFA vs password manager ## MFA protects one login. A password manager protects all of them. Multi-factor authentication blocks attackers who already have the password. A password manager stops staff reusing the same password on the twelve sites that are not yours. ## The reuse problem MFA does not solve Most credential-theft incidents we see in SG SME breach reports do not start where you might think. They start with a personal-site breach. A hobby forum. A recruitment site. A small e-commerce shop. A staff member used the same password as their work login. MFA on the Microsoft 365 side does not help when the same password gets sprayed against an exposed admin interface, a legacy IMAP endpoint, or a third-party SaaS app that never required MFA in the first place. A team password manager prevents the reuse mechanically. Every site gets a generated password the staff member never sees, and never types into the wrong tab. ## What "team" adds vs a personal password manager Shared secrets ## Vendor logins, social media, shared inboxes Team folders for credentials that have to be shared. Each shared item is scoped to the right people and revoked centrally when access changes. Offboarding ## Easy revoke when staff leave Remove an ex-employee from the team vault and their access to shared credentials stops. Personal password managers cannot do this. Strength enforcement ## Required policy at creation Minimum length, generated complexity, required rotation for sensitive accounts. Compliance assessors look for the policy, not just the password. ## How team password managers compare Feature StrongKeep (team PWM) Bitwarden Teams 1Password Business Dashlane Business M365 MFA only Team sharing folders Yes Yes Yes Yes No Password-reuse audit Yes Yes Yes Yes No Easy offboarding Yes Yes Yes Yes Yes Setup time (5-person team) First user in minutes · whole team in under 2 hours ~30 minutes ~30 minutes ~30 minutes Already in M365 Bundled with EDR, DNS, training Yes No No No No Price (per user / month) Included in Protection, from US$39 (S$49)/month SG SMB pricing on application SG SMB pricing on application SG SMB pricing on application Included in M365 ## What about the browser's built-in password storage? Fine for personal use. Not a business control. Chrome and Safari password storage has no team sharing, no audit trail, no offboarding, and is locked to the device. Compliance assessors do not accept browser password storage as a password manager. If your CSA Cyber Essentials submission lists Chrome as your password manager, expect a finding. ## Stop the reuse, keep the MFA The Protection plan includes a team password manager with shared vaults, strength enforcement, and easy offboarding. MFA stays on. They solve different problems and both belong on the stack. Start with a Free Scan See how identity hygiene fits the rest of the stack No credit card required to run the free cyberscan. ## Related comparisons Compare ## Antivirus vs EDR Consumer antivirus is not business-grade. Here is what auditors look for instead. Compare ## Cyber training that actually changes behaviour Bite-sized modules, real Singapore SME breach cases, and gamified progression. People finish training when you stop making it a one-hour block on the calendar. ## Find the reused passwords before an attacker does. Start with a Free Scan --- ### Already running CrowdStrike or Sophos? Don't switch. Layer. URL: https://www.strongkeep.com/compare/strongkeep-vs-crowdstrike-sophos/ Category: By vendor Mid-contract EDR replacements are rarely worth it. Keep your existing agent and add the compliance, training, password, and DNS-filtering pieces your EDR was never meant to cover. Compare · StrongKeep alongside CrowdStrike or Sophos ## Already running CrowdStrike or Sophos? Do not switch. Layer. We rarely recommend mid-contract EDR replacements. Keep your existing agent. Add the compliance, training, password, and DNS-filtering pieces your EDR was never meant to cover. ## Why we do not pitch rip-and-replace Mid-contract switching costs are real. Engineering time to roll out a new agent across every device. Tuning new alerts. Re-training the team on a new console. Risk of a coverage gap during the migration window. And on top of that, the contractual cost of breaking an existing MDR or EDR contract early. The marginal coverage gain from swapping one serious EDR for another rarely justifies the pain. We have watched customers try and fail at this. Our honest stance: if you already have CrowdStrike, Sophos, SentinelOne, or any other paid EDR working in production, keep it. ## What we add to a serious-EDR deployment Layer 1 ## Compliance evidence collection CSA Cyber Essentials, DPE and MAS-TRM evidence packs, plus HIA readiness evidence, assembled from your live telemetry. Your EDR produces alerts. We turn them into audit-ready evidence. Layer 2 ## Bite-sized continuous training Short, gamified modules built around real Singapore SME breaches. Simulated phishing campaigns run alongside. Completion records collected automatically for the auditor. Layer 3 ## Team password manager Shared vaults, strength enforcement, and easy offboarding. No EDR comes with this. Auditors look for the policy and the tool. Layer 4 ## DNS filtering for off-LAN traffic Coverage for staff on home Wi-Fi, hotel networks, and phone tethering. Your perimeter firewall does not see this. Your EDR was not built for it. Layer 5 ## Single-console reporting EDR alerts plus training records plus password audit plus compliance status in one view. The owner sees one page on Monday and knows where they stand. Layer 6 ## In-app case escalation One-tap escalation from the StrongKeep console when something is blocked or quarantined incorrectly. Cases route to a human on the StrongKeep team. Clinical and payment-flow false positives resolve quickly inside business hours. ## The layering pattern in practice The shape of the engagement is the same across customers who already have a serious EDR in production. The EDR agent stays. The contract stays. The renewal date stays. What changes is what runs alongside it. StrongKeep deploys in parallel and takes on the four control areas the EDR was never built to deliver: compliance evidence, awareness training records, team password management, and DNS filtering for off-LAN traffic. The customer sees one console for the rest of their stack, and the EDR continues to do what it already does well. ## When we would revisit consolidation At your EDR renewal date. Not before. Ninety days before the contract is up, the conversation is about whether Cortex EDR (the engine inside our Protection plan) would meet your bar at a lower line-item cost. Sometimes the answer is yes and the customer consolidates. Sometimes the answer is no and the customer renews with CrowdStrike or Sophos and keeps the StrongKeep layer. Both outcomes are fine. The point is the conversation happens at renewal, on the customer's timeline, not ours. ## Keep your EDR. Close the rest of the gap. The Compliance plan layers on top of any existing EDR. CSA Cyber Essentials, training, password manager, DNS filtering, and the single-console reporting layer. Start with a Free Scan Talk to a consultant No credit card required to run the free cyberscan. ## Related comparisons Compare ## StrongKeep compared to Microsoft Defender What a Microsoft 365 Business Premium quote buys, and what the same money buys from us. Compare ## SG compliance frameworks Eight schemes, three regulators, and HIA deadlines by batch from September 2027. The map for picking the right cert. ## See what the layer adds to your existing EDR. Start with a Free Scan --- ### StrongKeep compared to Microsoft Defender and M365 Business Premium URL: https://www.strongkeep.com/compare/strongkeep-vs-microsoft-defender/ Category: By vendor Your vendor quoted you Microsoft 365 Business Premium. Here is what it buys, what it still needs a consultant for, and what the same money buys from StrongKeep. Compare · Microsoft Defender ## StrongKeep compared to Microsoft Defender Your IT vendor has quoted you Microsoft 365 Business Premium. Here is what that buys, what it still asks of you, and what the same money buys from us. ## This is not a choice between Microsoft and StrongKeep You need Microsoft 365 for email, documents and file storage whatever you decide about security. We are not an alternative to that and we do not try to be. The real question is narrower. Is upgrading everyone to Business Premium the best way to buy your security layer, or does a lower Microsoft tier plus a dedicated security product get you further for the same money? ## What Business Premium adds, and what it still asks of you Over Business Standard, the upgrade brings four things: Microsoft Defender for Business on your computers, Defender for Office 365 Plan 1 on your email, Intune for managing devices, and Entra ID P1 for conditional access. Intune and Entra ID in particular do things a security product does not, and if you issue company laptops they are worth having. These are tools, not outcomes. Each one adds something else to manage, and someone to manage it. Defender needs onboarding and policy. Intune needs enrolment profiles and compliance rules. Conditional access needs someone to decide what the conditions are. Then all three produce alerts that somebody has to read at 11pm on a Friday. Almost no firm under 200 staff has someone in-house who can do that, so you pay a consultant on retainer to do it instead, and you keep paying. That is why a CISO-as-a-service or some virtual consultant engagement must be part of the same quote as the Microsoft licences. It is not padding. It is the cost of making the licence do something, and it is a permanent line rather than a setup fee. There is a market figure for it, and it is below. ## Three things people assume are in the Microsoft package, and are not Gap 1 ## Security awareness training and phishing simulation. Microsoft's Attack Simulation Training needs Defender for Office 365 Plan 2. Business Premium ships Plan 1, and Plan 2 is a paid add-on on top of it. Gap 2 ## A team password manager, that allows team-level password sharing and breach monitoring. Neither exists in any Microsoft business tier, and multi-factor authentication does not cover the same ground. Vendor logins, shared inboxes and social accounts still get reused and passed around by email. Gap 3 ## Scanning of your web and mail servers. The misconfigurations an attacker looks for from outside your network are not something the Microsoft tiers check on your behalf. ## What StrongKeep is One subscription, built for firms under 200 staff, that a non-technical person can deploy and run. - Palo Alto Cortex XDR Pro for endpoint detection and response, across Windows, macOS, Android and iOS. It is the enterprise engine large organisations run, not a small-business edition of one. - A DNS-layer firewall that blocks malicious and scam domains across all of your traffic, not only what passes through Microsoft. One of our customers had switched off a Microsoft scam-protection feature because it kept blocking legitimate client email. Ours works differently. We leave the email alone and stop the download or the link from doing damage on the laptop. - Security awareness training, customisable phishing simulation and company-wide crisis exercises. - A team password manager, so shared logins can carry strong passwords and two-factor even when several people use them. - Continuous scanning of your server and domain configuration for the weaknesses attackers look for from outside. No retainer, no consultant. Running it is part of the subscription. ## Side by side Capability Microsoft 365 Business Premium StrongKeep Protection Endpoint detection and response Defender for Business on Windows and macOS, mobile only if enrolled in Intune Palo Alto Cortex XDR Pro on Windows, macOS, Android and iOS Category-based web filtering Windows and macOS only DNS layer, every device and all traffic Security awareness training and phishing simulation Not included in Office 365 Plan 1 Included Team password manager Not in any business tier Included Breached-password alerts Requires Entra ID P2 Included External web and mail configuration scanning Not included Included Incident response retainer Not included Black Panda add-on, S$3.50 per device per month Malicious link and download blocking Inside Microsoft traffic, via Defender for Office 365 Plan 1 All traffic, at the DNS layer Device management and conditional access Intune and Entra ID P1 Not included Who runs it day to day Your IT vendor, on a retainer We do Charged by Per user Per device ## What each path costs Price the upgrade, not the licence. You are paying for Microsoft 365 either way, so the number that matters is the gap between Business Premium and the tier you are on today. At Singapore list prices in September 2026, excluding GST, Business Basic is about S$8 per user per month, Business Standard about S$17, and Business Premium about S$29. For a 30-person firm with 30 devices: Path Security tools Consultant Total each year Upgrade 30 users from Business Standard to Business Premium about S$4,320 about S$4,000 about S$8,300 Keep your current Microsoft tier and add StrongKeep Protection for 30 devices about S$2,658 none about S$2,658 StrongKeep Protection is S$49 a month for the first five devices, then S$6.90 a month for each device after that, billed annually. The consultant figure is not ours. About S$4,000 a year is the average repeat engagement across the 28 providers CSA has appointed to its CISO-as-a-service panel. Listed three-year plans run to around S$930 a month, closer to S$11,000 a year. Neither figure covers implementing what the consultant recommends, which is quoted on top. We are cheaper on the tools alone, by about S$1,660 a year. Count the consultant and the Microsoft path costs roughly three times what we do, every year, for as long as you keep it. ## If Cyber Essentials is on your roadmap Our Compliance plan makes it easy for Microsoft 365 users to get the evidence that they need to get certified, even without external consultant help. It is S$199 a month, S$150 above Protection, and it covers the auditor and certification cost as well. No Microsoft tier produces that at any price. We would not tell you to buy it on day one. It is worth knowing the path exists before you commit to something that does not lead there. ## Price the upgrade before you sign the quote StrongKeep Protection is S$49 a month for the first five devices, then S$6.90 for each device after that, and no consultant retainer on top. We would rather you bought the right thing than the thing we sell, so start with the free scan and see what the Microsoft quote leaves open. Start with a Free Scan Book a 30-minute call on the numbers No credit card required to run the free cyberscan. ## Related comparisons Compare ## Already running CrowdStrike or Sophos? We rarely recommend mid-contract EDR replacements. Here is how to layer alongside. Compare ## Consumer antivirus vs EDR If you are still on Norton, Trend or Bitdefender consumer AV, here is the gap to close. Prices quoted are Singapore list prices excluding GST, correct as at 11 September 2026. Microsoft pricing changes. Check before relying on it. Sources: Microsoft 365 Singapore business plan pricing; Microsoft Defender for Office 365 service description; Microsoft Learn on attack simulation training licensing and on web content filtering platform support; CSA CISO-as-a-service panel pricing, averaged across the 28 appointed providers. --- ## Free Tools and Guides ### An IT Manager's Cybersecurity Guide to Cover Your Ass URL: https://www.strongkeep.com/free-tools/it-managers-guide/ Date: 2025-07-24 Author: Vanessa Quek Category: Guide When you're the lone IT manager also stuck with the cyber stuff, the trick is to own the role with confidence. By using the Cyber Essentials, having a solid paper trail, and adding on cyber insurance, you're building the ultimate 'Cover Your Ass' strategy. Guide ## An IT Manager's Cybersecurity Guide to Cover Your Ass When you're the lone IT manager also stuck with the cyber stuff, the trick is to own the role with confidence. Here's your ultimate "Cover Your Ass" strategy. July 24, 2025 By Vanessa Quek There's a common misconception that cyberattacks mainly target large corporations. In reality, 39 per cent of small businesses in Singapore report losses or disruptions due to cyberattacks in Singapore in 2024. However, while the need for stronger cyber posture is clear, the question remains: who takes on the task? In most small and medium-sized businesses (SMBs) with no extra headcount or budget, the responsibility often falls on the shoulders of the IT manager. ## When You're the One-Man IT Show In SMBs, it's common to find just one person running the entire IT show. No fancy cybersecurity team, no specialist consultants, just an overstretched IT manager handling everything from laptops and email to cloud apps, printers, and day-to-day troubleshooting. Then, when upper management casually adds, "Since you're IT, you should look into the cybersecurity stuff too," it often leaves the poor IT manager frantically scrambling for answers on Google or ChatGPT, all while juggling an already overloaded list of tasks. Let's be honest: most IT managers in this situation aren't dreaming of becoming cybersecurity gurus, they're just trying to avoid the dreaded blame game if something bad happens. That instinct to "cover your ass" is natural, they just want to be able to face their bosses and confidently say, "Here's what I did. It was reasonable, and here's the proof." As the IT manager of an SMB, you're already wearing the cybersecurity hat, even if it's only 10% of your job. While that means you're responsible for implementing security controls and recommending improvements, you're not accountable for overall business risk: that belongs to management. ## Minimum Viable Cybersecurity: How to Do Just Enough to Pass So, here's the gameplan: do just enough, don't aim for perfect security. By implementing best practices and documenting your cybersecurity efforts, you not only safeguard your organisation but also build a solid case for yourself while keeping those pesky threats at bay. We assure you that cybersecurity isn't as hard as it seems. Let's look at some essential practices that will dramatically lower your risk without the stress of chasing perfection! ## Cyber Essentials as a Basic "Cover Your Ass" Strategy The very first thing that we'd recommend you get started on is the Cyber Essentials Mark (CEM), developed by the Cyber Security Agency of Singapore (CSA). The CEM is a foundational cybersecurity certification designed to help organisations implement and maintain essential cybersecurity measures. It includes a self-assessment that doubles as a practical checklist, which guides and helps you stay on track of: - Securing user accounts and passwords - Backing up critical data - Keeping systems and software up to date - Protecting endpoints - Conducting staff training on cybersecurity awareness - Preparing a basic incident response plan What makes CEM especially useful is that it not only helps you establish the core cybersecurity controls but it also provides clear documentation of what's being done and what still needs attention. This becomes invaluable when reporting to management or your board, because you're able to show how you're actively addressing cybersecurity risks and fulfilling your responsibilities, all while covering your back should incidents occur. ## A Solid Paper Trail Is Your Best Friend However, ticking boxes on a checklist isn't quite enough on its own. Documenting every step you take, is equally important. Documentation allows you to capture all relevant details such as advice provided, risks that were knowingly accepted, names of individuals involved, and specific actions taken. By recording the security controls you've implemented, the gaps identified, available resources, and the decisions made by management, you create a clear and defensible record of what was discussed and agreed upon. If anything goes sideways, these records will serve as back up for your actions and decisions and become evidence to show you took reasonable, professional steps. That's how you protect yourself from unfair blame, especially if conflicts arise later. Beyond risk management, consistently documenting your work also builds your reputation for being thorough and reliable, which are qualities that every workplace values and strengthens your credibility over time. ## Insurance: The Ultimate "Cover Your Ass" Once you've got your basics sorted and a solid paper trail in place, the next smart layer of protection to consider is cyber insurance. Cyber insurance won't stop an attack from happening, but it acts as a critical safety net when things go south. If your organisation suffers a breach or cyberattack, having this coverage can help you recover costs, manage liabilities, and avoid financially crippling damages. Let's be real, having insurance isn't just an optional extra, it's smart business. It shows that you're not only following best practices but also proactively managing risks through smart risk transfer. Cyber insurance policies are designed to help businesses and individuals handle potential hefty financial losses from incidents like ransomware, data breaches, and business interruption. As cyber threats become increasingly common and costly, more organisations are turning to insurance to limit their exposure and support recovery. But here's the catch: insurers usually won't offer meaningful coverage unless you've already implemented adequate security measures. This means that if you want that safety net, you'll need to make sure you've got solid cybersecurity practices in place to prove that you're taking steps to protecting your systems. That's where frameworks like CEM come into play. You'll not only be able to answer insurers' questions confidently but also demonstrate to management and stakeholders that you're serious about cybersecurity. In short, investing in cyber insurance isn't just about protecting your organisation financially, it also gives you access to specialist expertise and incident response support that can make all the difference when navigating the chaos after an attack. ## Cybersecurity Doesn't Have to End Your Career We get it: you're wearing every hat in the building: IT, operations, support, and now cybersecurity, too. It's a lot and the stakes can feel overwhelming. But here's the good news: cybersecurity isn't about chasing perfection. It's about owning your role with confidence and sticking to the essentials. Use the CSA CEM checklist to guide your efforts, keep clear and thorough documentation to back up your decisions, and make sure your business is covered with cyber insurance. Once you've got these in place, you're already taking smart, steady steps that protect your organisation, meet your board's expectations, and cover your own back. The best part? You don't have to do all these alone! Purpose-built to support IT managers like you, StrongKeep brings compliance, protection, and insurance altogether in one intuitive platform. Through StrongKeep's AI-powered CEM compliance feature, you'll get guided step-by-step help, complete with templates, so you can nail your certification in just a few weeks. Plus, access to StrongKeep's Library allows you to store all your policies, artefacts, and documentation safely, so you've always got evidence to back you up. To top it off, StrongKeep partners with Protos Cover to offer cyber insurance as a critical part of your "Cover Your Ass" strategy, helping you bounce back faster when an attack occurs. StrongKeep gives you all the tools you need to run the cyber show smarter, not harder. Stop letting cybersecurity be a burden, use it to shine in your role instead! Vanessa Quek Vanessa is the User Experience and Communications Lead at StrongKeep. Together with a team of knights, she spends her days finding fresh ways to connect with organisations that need cybersecurity solutions to navigate procurement and regulation requirements, handle board expectations, and improve their cyber resilience. When she's not bridging the gap between tech and people, she's probably chasing new ideas, generating more Sir Stonk poses, or both! ## Ready to cover your ass? Start with StrongKeep! Get Started --- ### Do small businesses need a hardware firewall? We think not. URL: https://www.strongkeep.com/free-tools/hardware-firewall/ Date: 2025-12-09 Author: Sir Stonk Category: Insights If you run a small business, a shiny new firewall box in the office can feel like progress. Here is the uncomfortable truth. For most SMBs in 2025, that box is the wrong bet. Insights ## Do small businesses need a hardware firewall? We think not. For most SMBs in 2025, that shiny firewall box is the wrong bet. A DNS firewall, paired with strong endpoint and identity controls, delivers safer outcomes with far less friction. December 9, 2025 By Sir Stonk If you run a small business, a shiny new firewall box in the office can feel like progress. It sits there with blinking lights and the reassuring promise of "protection." Here is the uncomfortable truth. For most SMBs in 2025, that box is the wrong bet. A DNS firewall, paired with strong endpoint and identity controls, delivers safer outcomes with far less friction and far better value. Image generated by ChatGPT ## First, what is a Firewall and how is a DNS Firewall different? A traditional hardware firewall sits at the edge of your network and inspects all incoming and outgoing data, deciding what to allow or block based on complex rules. Because it processes every packet, it requires careful setup, regular maintenance, and can slow down network traffic, and if the device fails or misconfigurations occur, it can block the entire company from accessing the internet. In contrast, a DNS firewall works at the level of domain lookups, blocking malicious links before any connection is made. It does not inspect or process all data, so it stays fast, lightweight, and extremely easy to deploy: often just by changing DNS settings or installing a small agent. Despite its simplicity, a DNS firewall is highly effective at stopping phishing links, malware sites, and command-and-control domains without the operational complexity of a hardware firewall. Image obtained from Firewall: Definition, How They Work & Why You Need One | Okta ## 1) Hardware firewalls demand care you will not consistently give A modern firewall is not a smoke detector. It needs frequent updates, rule hygiene, log reviews, certificate care, and the occasional firmware dance that brings down the office at 7 p.m. on a Wednesday. That rhythm is fine for a full-time network team. It is unrealistic for a five-to-fifty person company where the "IT department" is one overworked generalist or an external vendor who drops by once a month. DNS firewalls flip that equation. There is no on-prem box to babysit. Protection is delivered as a cloud service. Policies are managed centrally in a browser. The burden shifts from hands-on device maintenance to light-touch policy administration. In other words, you trade a high-maintenance control for a low-maintenance control that still blocks the nasties you see most often. For SMBs, that operational simplicity is not a luxury. It is the difference between a control that actually works and a control that quietly decays. ## 2) Hardware firewalls do not match how your people actually work Traditional firewall thinking assumes your staff sit behind the office perimeter and tunnel back in with a VPN. That is not your reality. Your team lives in Google Workspace or Microsoft 365, shares files in chat apps, joins video calls from home, and answers emails on personal phones. Many dislike the friction of a VPN and do not use it unless required. A DNS firewall follows the person rather than the place. Whether a risky link arrives by email, WhatsApp, a QR code, or a browser search, the protection travels with the user and applies on any network, including home Wi-Fi and coffee shop hotspots. That is a better match for remote and hybrid work. When protection aligns with daily habits, it gets used. When it depends on staff remembering to switch on a VPN, it often does not. ## 3) DNS firewalls block the biggest real-world threat: malicious destinations Most successful attacks against small businesses do not start with James-Bond-level intrusions. They begin with social engineering and a malicious destination. Click the fake invoice. Reset your password on a look-alike site. Authorise a dodgy app that steals your mail. These attacks all rely on a device reaching out to a domain that should never resolve. A DNS firewall cuts that journey at the first step. If the domain is known to be malicious or newly registered in a suspicious way, it never resolves and the connection fails. You break the kill chain before anything downloads or executes. Is a hardware firewall "more capable" at deep packet inspection? Possibly, and that matters in specialised environments. For the majority of day-to-day threats an SMB actually encounters, stopping the destination is both fast and effective. ## 4) Fewer network devices means a smaller attack surface and fewer outages Here is the irony. The hardware you buy to protect yourself can become your weakest link. Attackers love internet-facing infrastructure that is rarely patched on time. Routers, firewalls, and VPN concentrators are routinely targeted because a single flaw can compromise an entire network. If that device fails or a firmware update goes wrong, the whole office grinds to a halt. Moving protection to DNS reduces this risk. You remove a highly targeted on-prem appliance from your stack. You also reduce the chance that SSL inspection on an undersized box will break modern apps or cause mysterious slowness. The result is a smaller attack surface and a happier helpdesk. Your team notices when Zoom stutters or the CRM times out. They do not notice when a malicious domain quietly fails to resolve. In security, invisible and reliable is a win. ## 5) Better economics and a better user experience Small businesses do not just need security. They need security that fits the budget and does not slow anyone down. Hardware firewalls carry two costs. There is the visible line item for the box and its annual subscription. Then there is the invisible cost of time spent tuning rules, chasing certificate issues, troubleshooting broken websites, and scheduling disruptive updates. A DNS firewall shifts you to a predictable subscription that scales by user or device, with almost no local maintenance. Because decisions happen at the domain layer, performance hits are minimal and breakage is rare. Staff do not lodge tickets about slow browsing or blocked mobile apps. Finance does not complain about surprise upgrade cycles. Executives do not wonder why the office internet went down during a firmware push. You get fewer headaches and a cleaner TCO story without compromising on the protection that matters most to you. As a simple cost comparison for a company of 15 staff: - A traditional hardware firewall + VPN start at S$1500 for the hardware, with added annual software (VPN) and maintenance support costs (usually about S$800/year) - A next-gen hardware firewall + VPN will cost about S$2500 for hardware, with the same added costs. - A DNS firewall has no hardware cost, and maintenance is included in the service. It will cost about S$450/year (if you get it separately) - StrongKeep customers are able to access a bundled EDR (sophisticated AI-based anti-malware protection for the device) and the DNS firewall at just US$5.50 (S$6.90)/month/device, which lowers the overall cost of adding DNS firewall protection to your company. ## DNS Firewalls are for SMBs, not Enterprise needs DNS control is not network segmentation, and it does not see everything. Two practical gaps follow from that. - First, segmentation. If you have on-prem servers, point-of-sale devices, CCTV, or operational technology that should never talk to each other, a DNS firewall will not create those walls for you. You still need to separate traffic with simple VLANs, SD-WAN, or a virtual or cloud firewall in front of sensitive services. Without segmentation, a compromised device can move laterally more easily. - Second, visibility and bypass. Some applications hard-code DNS, use encrypted DNS to public resolvers, or talk directly to IP addresses over protocols that a DNS layer cannot observe. This is not a deal breaker, but it is a reason to pair DNS filtering with modern endpoint protection. The endpoint can watch outbound connections, stop malicious processes, and quarantine a host if something slips through. If you operate in a regulated environment that specifies a boundary appliance, you may need to meet that requirement with a cloud-managed or virtual option rather than a physical box. ## Conclusion: spend where it changes outcomes Security that only works on paper does not serve a small business. A hardware firewall looks serious, but it asks for constant care, sits in the wrong place for a remote workforce, and often becomes another problem to manage. A DNS firewall meets the moment. It blocks the destinations that fuel the majority of incidents, follows your people wherever they work, shrinks your attack surface, and replaces operational toil with a simple policy. If you run specialised workloads, host sensitive on-prem systems, or must satisfy a control that truly requires a boundary device, make that investment with eyes open and keep the ruleset tight. For everyone else, skip the box. Put your money into DNS filtering, strong endpoints, and identity controls that keep your team safe without getting in their way. You will not just save on hardware. You will save on stress, downtime, and the everyday friction that makes people look for shortcuts. That is what practical cyber for small businesses should feel like. At StrongKeep, we have built cybersecurity that makes sense for smaller businesses, that is simpler to use, effectively keeps you secure, and is way more affordable than the enterprise stuff that other vendors are pushing on to you. Keep yourself secure (on a budget), with StrongKeep. Sir Stonk StrongKeep ## Ready to modernize your security approach? Get Started --- ### 8 Cybersecurity and Compliance Myths Singapore Clinics Get Wrong URL: https://www.strongkeep.com/free-tools/clinic-cybersecurity-compliance-myths/ Date: 2026-06-22 Author: StrongKeep Team Category: Healthcare Compliance Eight cybersecurity and compliance myths Singapore clinics get wrong, corrected with primary sources from CSA, PDPC, and MOH: PDPA, the Health Information Act, CS/DS Essentials, antivirus, and consultants. Healthcare Compliance ## 8 Cybersecurity and Compliance Myths Singapore Clinics Get Wrong 22 June 2026 By StrongKeep Team ~14 min read Sourced to the Cyber Security Agency of Singapore (CSA), the Personal Data Protection Commission (PDPC), and the Ministry of Health (MOH), June 2026 TL;DR The biggest risk to a small clinic is rarely the regulation itself; it is the myths around it. The Personal Data Protection Act (PDPA) applies today. The Health Information Act (HIA) is expected to add cybersecurity and data security duties for healthcare providers it regulates, as it phases in from 2027. The practical baseline is smaller than most owners fear. Below are eight common myths, each corrected with a primary government source. This applies to any Singapore clinic. General practice is in HIA Batch 1, by September 2027, specialist outpatient practice in Batch 2 by September 2028, and dental in Batch 3 by March 2030; the full table of fourteen service types is in our readiness checklist. If your practice is not licensed under the Healthcare Services Act at all (optometry, for instance, which the Optometrists and Opticians Board regulates) the HIA timeline may not reach you, but the Personal Data Protection Act duties below already do. Sources are listed in full at the end. ## The biggest myths, at a glance - "We are too small to be a target". Wrong. A Singapore eye clinic lost data on 73,466 patients to ransomware in 2021; clinics hold valuable patient data and rarely have a security team. - "It is just an IT problem". Wrong. It is a governance duty. CSA's Cyber Essentials first asset category is People, not technology. - "Our CMS handles our cyber". Wrong. Under PDPA s4(3) you keep the same obligations even when a vendor processes data for you. - "The HIA replaces the PDPA". Wrong. They stack. The PDPA applies now; the HIA is expected to add cybersecurity and data security duties on top as it phases in from 2027. - "We have until 2027, no rush". Wrong. PDPA duties exist today. GP clinics are HIA Batch 1, deadline September 2027, and evidence has to build over time. - "Antivirus is enough". Wrong. It is one measure among nine in CSA's Cyber Essentials mark; access control, configuration, updates, backups and incident response are separate. - "We need an expensive consultant". Wrong. MOH says consultancy is optional, and a self-serve platform can carry the technical layer. - "Getting ready is a one-time effort". Wrong. The measures are continuous, and the evidence has to build up over time. ## Myth 1: "We are too small to be a target" Many clinic owners assume attackers chase only large hospitals or banks. The reverse is closer to the truth. Attackers favour smaller organisations precisely because they hold valuable data but rarely have a security team. Patient records are among the most valuable data there is, and a small practice is a far softer way in than a hospital. Reality Small clinics are squarely in the crosshairs. In August 2021 a Singapore private specialist practice, Eye and Retina Surgeons, was hit by ransomware that exposed the personal and clinical data of 73,466 patients, as reported at the time: names, addresses, NRIC numbers, contact details and clinical information. Not a hospital, not a government system, a private clinic. CSA's Singapore Cyber Landscape 2022 makes the general point: ransomware cases affected "mostly Small-and-Medium Enterprises (SMEs)" that "lack dedicated resources to counter cyber threats". ## Myth 2: "Cybersecurity is just an IT problem, so we would need an IT team" Compliance is often filed under "IT" and then quietly deferred because the clinic has no IT staff. But the obligations are governance decisions, not code an engineer writes. CSA's Cyber Essentials mark is aimed at small organisations "looking to establish foundational cybersecurity measures", and its very first asset category is People, not technology. Under the PDPA, your clinic is accountable for the personal data in its possession or control. Those are decisions an owner or practice manager makes. Reality It is a governance responsibility, not only an IT task, and it does not require an in-house IT team. Most of it is decisions and records, which a practice manager can own. See the simple path to Cyber Security and Data Security (CS/DS) Essentials without an IT team. ## Myth 3: "We already have antivirus, so we are covered" Antivirus matters, and modern anti-malware does far more than match known signatures: it uses behavioural detection to catch unfamiliar threats. But it is still only one control among many. In CSA's Cyber Essentials mark, virus and malware protection is a single measure among nine, spread across five categories: Assets, Secure or protect, update, backup, and respond. A single tool does not cover access control, secure configuration, software updates, backups, or incident response. ## Myth 4: "Our CMS handles our cyber" Your Clinic Management System (CMS) processes patient data. It does not own your compliance. Under section 4(3) of the PDPA, when a data intermediary processes personal data on your behalf you keep "the same obligations under the PDPA as if the personal data were processed by the organisation itself". A CMS, cloud service or software vendor is a data intermediary. It does carry part of the load, and it is worth knowing which part. MOH's implementation circular records 17 systems integrated to the National Electronic Health Record (NEHR) for GPs, 15 of them Cyber Essentials certified, with 8 more in progress, together covering roughly 60 per cent of outpatient GP and specialist clinics. A certified system builds in some of the cybersecurity requirements for you, in the circular's own examples "timely software updates, multi-factor authentication". It does not secure your staff devices, email or passwords, write your policies, or build your evidence pack. Ask your vendor where they sit on Synapxe's list, and put a data processing agreement in place. Reality You keep the obligation, even when a vendor does the processing. A CMS does not deliver your cybersecurity compliance; the device, account, network, training, and evidence work remains your clinic's responsibility. ## Myth 5: "The Health Information Act replaces the PDPA, and the PDPA barely applies to a small clinic" The PDPA and the HIA are frequently confused, with owners assuming the newer law cancels the older one. They stack; they do not substitute. The PDPA applies to every clinic today, independently of the HIA. Appointing a Data Protection Officer (DPO) is mandatory under section 11(3) of the PDPA for every organisation, big or small, and that duty is separate from anything the HIA requires. The HIA will apply to healthcare providers it regulates: HCSA-licensed institutions (GP, specialist, hospitals, nursing homes, allied health), retail pharmacies, and contributors to or users of the National Electronic Health Record (NEHR). As it phases in, it is expected to add cybersecurity and data security measures on top of existing PDPA duties. The penalties are real on both sides. PDPA breaches can attract up to S$1 million, or 10 per cent of annual turnover in Singapore for larger organisations, whichever is higher. Once the HIA provisions apply, serious failures to put the required measures in place may attract a fine of up to S$1 million, and unauthorised access to the NEHR may attract a fine of up to S$50,000 and/or up to two years' imprisonment for a first offence, per the Health Information Bill Second Reading speech. ## Myth 6: "Getting compliant means one expensive consultant project" A consultant is a convenience, not a requirement, and MOH says so in its own words. Its FAQ for healthcare providers (July 2026, question 23) states that "engaging professional CS/DS consultancy services is optional, as not every healthcare provider requires such services to meet the necessary CS/DS requirements". CSA's Cyber Essentials mark for HIA entities and PDPC's Data Protection Essentials marks are baseline certifications built for resource-constrained SMEs, and a self-serve platform can support the technical layer. If you do engage a consultant, government co-funding lowers the bill. CSA's CISOaaS scheme co-funds up to 70 per cent of an eligible consultancy engagement, and Enterprise Singapore's Productivity Solutions Grant covers up to 50 per cent of qualifying solutions on Enterprise Singapore's pre-approved list, capped at S$30,000 per company per financial year, running 1 April to 31 March. Note that the GP IT Enablement Grant has closed. Reality You do not automatically need an expensive consultant for a small clinic's readiness work. Across the fourteen firms on CSA's CISOaaS provider listing (as at 31 July 2026), the median one-off Cybersecurity Health Plan for a clinic of one to five endpoints is about S$4,850 before funding, or S$1,455 after up-to-70% co-funding, plus a median retainer of about S$545 a month. The spread is wide, from S$3,500 to S$18,000 before funding, so get more than one quote and check what funding you qualify for before you buy. A self-serve platform is the other route. StrongKeep bundles the technical layer, generates your policies and collects the evidence, on a published monthly price with no consultant engagement to arrange. The governance calls stay yours on any route. ## Myth 7: "Getting ready is a one-time effort" Readiness is a state you keep, not a job you finish. The measures themselves are continuous. MOH asks for awareness training periodically, illustrated in its own text as at least once a year. Anti-malware has to stay running and updating. Accounts and asset inventories need reviewing, and a review you did fourteen months ago does not count as a periodic one. That is why evidence has to accumulate rather than be produced on the day. MOH's implementation circular says it "will look at the facts of each case carefully", and the facts are the record you kept before something went wrong, not the one you assembled afterwards. A log that starts the month before your deadline tells a different story from one that starts now. ## Myth 8: "We have until 2027, so there is no rush" Two clocks are already running. First, the PDPA applies now: the duty to appoint a DPO and the exposure to penalties of up to S$1 million exist today, not in 2027. Second, GP clinics are in HIA Batch 1, due by September 2027. Because compliance evidence has to accumulate over time, and because that evidence has to build up over time, a late start means a scramble rather than a tidy deadline. Reality The PDPA duties and penalty exposure are live today. The HIA deadline for GP clinics (Batch 1) is September 2027, and readiness is something you build up, not switch on at the deadline. ## What Singapore law actually requires Two regimes matter for a clinic, with different timings. The PDPA is in force now; the HIA phases in from 2027 for healthcare providers regulated under it. Obligation Applies What it means for a clinic PDPA: protect personal data Now Make reasonable security arrangements for patient and staff personal data. You stay accountable even when a vendor or cloud service processes data on your behalf. PDPA: appoint a DPO Now Mandatory under section 11(3) for every organisation, big or small. Can be an existing staff member; the role, not a new hire, is what is required. PDPA: penalties Now Up to S$1 million, or 10 per cent of annual turnover in Singapore for organisations above the turnover threshold, whichever is higher. HIA: CS/DS Essentials measures GP by Sep 2027 Put in place MOH's Cyber Security and Data Security (CS/DS) Essentials: three categories (cybersecurity, data security, common organisational practices), 13 practical measures, including strong passphrases and two-factor authentication (2FA) for administrative access, including remote access, to important systems such as an internet-facing system holding sensitive or business-critical data. HIA: enforcement From early 2027, which MOH has said it intends MOH can issue directions to rectify a breach, letters of warning and notices of composition, and can prosecute. Its stated approach is to look at the facts of each case carefully. HIA: penalties From early 2027, which MOH has said it intends Up to S$1 million for failing to put the required measures in place. Separately, unauthorised NEHR access can draw up to S$50,000 and/or up to 2 years' jail for a first offence, per the Second Reading speech. Singapore clinic cybersecurity and data protection obligations, and when they apply ## The practical baseline is smaller than the myths make it. StrongKeep helps small Singapore clinics put the technical measures in place and stay HIA-ready: device protection, account security, policies, evidence, and support towards Cyber Essentials certification. A practice manager can run it, with no IT team and no consultant required. Get started Current rates and terms are on our pricing page. Two clocks are already running: the PDPA today, and September 2027 for GP clinics in Batch 1. Of the eight myths above, which ones are your clinic still working from? Our readiness checklist walks all 13 measures in plain English, so you can tick off what is already true. ## Frequently asked questions about clinic cybersecurity and compliance The same eight myths, answered briefly. Is a small Singapore clinic really a target for cyberattacks? Yes. In August 2021 Eye and Retina Surgeons, a Singapore private specialist practice, was hit by ransomware that exposed data on 73,466 patients. CSA's Singapore Cyber Landscape 2022 found most ransomware victims were SMEs that lack dedicated resources to counter cyber threats. Clinics are attractive because they hold valuable patient data but rarely have a security team. Is cybersecurity compliance just an IT problem? No. CSA's Cyber Essentials mark is designed for organisations with limited IT and cybersecurity expertise, and its first category is Assets: People. Under the PDPA, your clinic is accountable for personal data in its possession or control. Compliance is a governance responsibility and does not require an in-house IT team. Is antivirus enough to meet Singapore's cybersecurity requirements? No. In CSA's Cyber Essentials mark, virus and malware protection is one measure among nine across five categories: Assets, Secure/Protect, Update, Backup and Respond. The SingHealth Committee of Inquiry concluded that stronger, multi-layered security mechanisms should have been in place. Modern anti-malware does behavioural detection, but it is still only one layer of many. If we use a cloud or software vendor, are they responsible for our compliance? No. Under section 4(3) of the PDPA, when a data intermediary processes personal data on your behalf, you have the same obligations as if you processed it yourself. A cloud or software vendor, including a Clinic Management System, is a data intermediary, not your compliance owner. You remain accountable and should carry out due diligence and sign proper data processing agreements. Does the Health Information Act replace the PDPA? No. They stack. The PDPA already applies to every clinic today, independently of the Health Information Act. Appointing a Data Protection Officer (DPO) is mandatory under section 11(3) of the PDPA. The HIA applies to healthcare providers regulated under it, including HCSA-licensed institutions, retail pharmacies, and NEHR contributors or users, and adds cybersecurity and data security measures on top of existing PDPA duties. Do we need an expensive consultant to become compliant? No, and MOH says so directly: its July 2026 FAQ for healthcare providers states that engaging professional CS/DS consultancy services is optional, as not every healthcare provider requires such services. A self-serve platform can support the technical layer, though the governance decisions stay with the clinic on any route. If you do engage a consultant, the CISOaaS scheme co-funds up to 70 per cent of an eligible engagement, and Enterprise Singapore's Productivity Solutions Grant covers up to 50 per cent of qualifying solutions, capped at S$30,000 per company per financial year. The GP IT Enablement Grant has closed. Is getting ready a one-time effort? No. The measures are ongoing: awareness training periodically, with MOH illustrating that as at least once a year, anti-malware kept running and updating, and periodic reviews of accounts and asset inventories. Once its obligations apply, the Health Information Act is expected to require cybersecurity and data security measures to be maintained over time, which means evidence accumulates rather than being produced on the day. Readiness is a state you keep, not a job you finish. We have until 2027, so is there any rush? Yes. The PDPA applies today, so the Data Protection Officer duty and penalty exposure of up to S$1 million or 10 per cent of turnover exist now. GP clinics are in HIA Batch 1, due September 2027. Evidence that controls were in place has to accumulate over time, so starting late means scrambling. Sources are linked inline throughout, and were accessed between 30 July and 5 August 2026. This guide is general information, not legal advice. Confirm current obligations, deadlines, and grant eligibility with MOH, PDPC, CSA, Enterprise Singapore, or your own adviser. Note: MOH batches the deadline by service type, and a provider running more than one service type carries more than one date. The full table is in our readiness checklist. ## Related guides for Singapore clinics Solution ## StrongKeep for healthcare clinics: CS/DS Essentials support and HIA readiness Checklist ## HIA readiness checklist for Singapore GP clinics Guide ## CS/DS Essentials without an IT team: the simple path for Singapore clinics ## Compliance is smaller than the myths make it. StrongKeep helps small Singapore clinics put the technical layer in place and stay ready, so the practical baseline is something a practice manager can run. No IT team. No consultant required. See StrongKeep in action Current rates and terms on our pricing page. --- ### Can a Singapore GP Clinic Meet CS/DS Essentials Without an IT Team? URL: https://www.strongkeep.com/free-tools/csds-essentials-without-it-team-singapore-clinics/ Date: 2026-06-29 Author: StrongKeep Team Category: Healthcare Compliance A small Singapore GP clinic can work towards MOH's CS/DS Essentials without a dedicated IT team. Here is the practical do-it-yourself path, what a practice manager does, and the StrongKeep vs CISOaaS-consultant trade-off. Healthcare Compliance ## Can a Singapore GP Clinic Meet CS/DS Essentials Without an IT Team? 29 June 2026 By StrongKeep Team ~17 min read Reviewed against Ministry of Health (MOH) CS/DS Essentials (March 2026) TL;DR Yes. A small Singapore clinic can work towards MOH's Cyber Security and Data Security (CS/DS) Essentials without a dedicated IT team or a full consultant project. A dedicated IT team is not a legal requirement: most of the measures are practical steps a practice manager can put in place, either unaided, with a self-serve platform that guides each step, or with a consultant. The clinic stays the responsible party for readiness whichever route it picks. CS/DS Essentials will apply to GP, specialist and other clinics licensed under the Healthcare Services Act (HCSA), once the Health Information Act (HIA) phases in. The deadline depends which batch you are in, and our readiness checklist sets out the dates alongside all 13 measures. This guide is written around a typical 1 to 5 doctor practice. The setup is a real sequence of steps, done in plain English rather than in code. ## CS/DS Essentials without an IT team: at a glance - Is an IT team required. No. A practice manager with administrator access to clinic devices can put many of the measures in place. - What CS/DS Essentials is. MOH's measures across three categories: Cybersecurity, Data Security, and Common Cybersecurity and Data Security Practices, 13 measures in total. - Three routes. Do it yourself unaided, use a self-serve platform that guides each step, or engage a CISO-as-a-Service (CISOaaS) consultant. All are valid. - Typical setup time. Initial technical setup in a few days to two weeks for most small clinics; evidence collection is ongoing. - What stays yours. DPO appointment, breach reporting (to the Personal Data Protection Commission (PDPC) now, and to MOH once the HIA applies), vendor agreements, and governance decisions remain the clinic's, whatever tooling you use. - GP clinic deadline. GP clinics are in Batch 1 of the HIA rollout, due by September 2027. ## Why clinics assume this needs an IT team, a consultant, or a project Three assumptions drive that feeling, and each one is softer than it looks. ## Assumption 1: "I will need an IT team to install and manage security tools." What you need is administrator access and a free stretch of time, not an IT background. Anti-malware, two-factor authentication and backups are set up through guided installers: no command line, no firewall configuration, no network engineering. The honest caveat is that enrolment happens device by device, and a mixed Mac and Windows fleet is slower, because each Mac asks for its own permission approvals. ## Assumption 2: "Getting ready will take months and disrupt the clinic." Plan for a real block of effort, not an afternoon. Most small clinics finish the initial technical setup within a few days to two weeks, in short sessions after hours or during quiet periods. Software installs in the background, so there is no clinic closure and no downtime. The time goes into enrolling each device and reviewing the generated policies rather than writing them from scratch. ## Assumption 3: "I need a consultant to interpret what MOH actually wants." You can engage one, and for some clinics that is the right call. But MOH says in its FAQ for healthcare providers (July 2026, question 23) that "engaging professional CS/DS consultancy services is optional, as not every healthcare provider requires such services to meet the necessary CS/DS requirements". The do-it-yourself path is one valid option among three. The honest framing A dedicated IT team is not a legal prerequisite for CS/DS Essentials. What you do need is someone accountable inside the clinic, usually the practice manager or owner, who owns the steps and the evidence. Tooling and consultants can help with the work, but the responsibility stays with the clinic. ## The path a small clinic actually follows Here is the sequence, described as the work rather than as any one product. A clinic can run these steps unaided, with a self-serve platform, or with a consultant. What changes between those routes is how much you assemble yourself, not what has to happen. ## 1. Take stock of what you have and what the measures ask for Confirm your organisation details, how many devices you run, and what your current setup already covers, then read that against the measures themselves. Our readiness checklist sets out all 13 in plain English, so you can tick off what is already true before deciding what to buy or change. If you intend to certify, The Cyber Security Agency of Singapore's (CSA) Cyber Essentials mark for HIA entities requires you to work through its guided self-assessment first, so it is worth reading what an assessor will ask before you start buying. Who does this: practice manager or clinic owner. ## 2. Get protection onto every device that touches patient data Desktops, laptops and shared terminals, Windows and macOS alike. Modern endpoint tools install in the background without interrupting clinic sessions. The slow part is not any single install, it is working through a mixed fleet device by device, including the laptop that rarely comes into the practice. While you are on each machine, turn on automatic updates for the operating system and your clinical software: MOH asks you to install updates promptly and to prioritise the critical and important ones, and a device that patches itself is the cheapest way to keep that true. Who does this: practice manager or clinic admin. ## 3. Check who else touches your data Your clinic management system, your cloud provider, whoever manages your IT. For each, establish where health information is stored, what security certifications they hold, and who carries what if there is an incident. MOH's implementation circular, as at March 2026, records 17 systems integrated to NEHR for GPs with 15 of them Cyber Essentials certified, so your vendor may already be doing more of this than you think. Ask, and keep the answer. Who does this: clinic owner, one conversation per vendor. ## 4. Write the policies Acceptable use, incident response, backup, access control and business continuity, at minimum, plus a short rule on how documents holding health information get labelled so staff can tell at a glance what they are handling. Business continuity is the one clinics skip: MOH asks you to name the systems that have to stay available, put a fallback behind them, and say what the practice does when they are down, including after a cyber incident. These are short documents. You do not have to start from nothing: PDPC publishes a free Data Protection Notice Generator that builds the patient-facing privacy notice, which is a separate PDPA document you also need rather than one of the four policies above, and its getting-started guide for Data Protection Officers points to the guidance and courses available to whoever takes the role. Platforms and consultants offer templates too; either way the clinic-specific detail and the sign-off are yours. Who does this: clinic owner or appointed DPO (a DPO is required under the Personal Data Protection Act (PDPA)). ## 5. Turn on two-factor authentication and verify your backups Replace every default password with a strong passphrase, on all accounts and not just the administrator ones. Enable two-factor authentication for administrative and remote access to important systems. It is built into Microsoft 365 and Google Workspace, and both publish admin guides: Microsoft's multifactor authentication setup and Google's 2-Step Verification. Then set up a backup, stored separately from the systems it protects, and confirm it restores. If it lives in a cloud service, MOH asks you to understand how backup responsibility splits with the provider and to keep an alternative form of backup. Worth checking: a Microsoft 365 or Google Workspace subscription is not by itself a backup of your data. Who does this: practice manager, no IT background required. ## 6. Train your staff, and keep the completion records MOH asks for periodic awareness training, ideally at least annually in its own words, delivered in-house, by an external provider, or through self-help resources. This one cannot be done for you: the evidence is a completion record from each staff member, and only they can generate it. Book it early, out of sequence with the rest of this list if you have to, because only calendar time produces a register that shows it. Who does this: every member of staff, once booked by the practice manager. ## 7. Sort out the physical side and how you dispose of things Locked storage for hardcopy records, cable locks for laptops that leave the practice, and a written way of destroying health information before any hardware or paperwork leaves the building: shredding, encrypting a disk before it is reformatted, overwriting stored data properly. Mostly one-time purchases and one written procedure, and nothing here is technical. Who does this: practice manager. ## 8. Keep the evidence current From here the work is upkeep: knowing which measures are active, where the gaps are, and what evidence you could produce on any given day. Training records and periodic reviews only count when they show a pattern, so the log that starts now tells a different story from the one that starts the month before your deadline. Who does this: anyone with clinic admin access, a few minutes a week. What CS/DS Essentials requires MOH's CS/DS Essentials organises the measures into three categories: Cybersecurity (updates, device protection, access control, two-factor authentication, secure configuration, backups, asset management), Data Security (identifying, protecting, and safely handling health information, and controlling who may see it), and Common Cybersecurity and Data Security Practices (staff training, vendor oversight, security reviews, disposal, contingency planning, and incident response). That is 13 practical measures in total. ## What these eight steps do not reach They are not the whole of the thirteen measures, and it is worth being plain about where they stop. MOH's largest measure is the second one, and several of its parts sit outside this sequence: an inventory of every account, including administrator, third-party and service accounts; a unique login for each person, with shared, dormant and inactive accounts removed; a documented way of granting and revoking access; contractor access scoped and removed, with an agreement signed; log-in tracking, with access to the security logs restricted to the people who need it; accounts locked after repeated failed sign-ins; and secure configuration, meaning weak protocols replaced and unused features switched off. Physical access to the machines themselves sits alongside all of it. None of it is technical, but the account work is slow, and it is directory work rather than device work: your Microsoft 365 or Google Workspace admin centre, and your clinic system's user list. It is the part that most often gets left, which is why it is set out here rather than buried. Our readiness checklist walks all thirteen measures clause by clause if you want to work through the full set. Three of the eight steps nobody else can do for you. Training (step 6) needs each staff member to actually complete it, because the evidence is their record. Vendor checks (step 3) need someone with the authority to ask a supplier an awkward question and act on the answer. And the sign-off on every policy in step 4 is the clinic's, whoever drafted it. That is the real answer to whether you need an IT team: you do not, but you do need someone who can decide. The next section sets out exactly where that line falls. ## What a platform helps with, and what stays the clinic's responsibility This is the part that matters most for a clinic owner weighing up the do-it-yourself path. A platform helps you put the technical measures in place and build the evidence trail. It does not, and cannot, take on the legal and governance obligations. Those stay with the clinic regardless of which tool or provider you use. Readiness responsibility StrongKeep helps with Stays the clinic's responsibility Device protection and endpoint security Guidance and tools to put it in place; automated alerts on your dashboard Oversight Two-factor authentication Guided setup, and the credential vault generates your two-factor codes Turning it on in each system, and checking it stays on Verified backup configuration Setup guidance only (pair with a backup provider, e.g. Microsoft 365) Running the backup, and checking it restores. MOH also asks you to know where the responsibility line sits with your cloud provider, and to hold an alternative form of backup Firewalls A DNS firewall, running from the day you enrol. MOH names this as one form of network perimeter firewall for a clinic running a network. It filters every clicked link across email, browser and messaging apps, and there is nothing for you to configure Switch on the firewall built into Windows or macOS, and the one in your router. For a simple setup, endpoints connecting to the internet and cloud applications, MOH's FAQ says Microsoft Defender "may provide sufficient firewall protection", and asks you to evaluate your own risk profile rather than treat that as settled Policies Generated complete and ready for you to review and sign off You review and sign annually Evidence collection and readiness tracking Ongoing collection; live dashboard Review and keep current Appointing a Data Protection Officer Not part of the platform Required under PDPA section 11(3), your decision Reporting data breaches (to the PDPC now, and to MOH once the HIA applies) Guidance through the process, so you are not working it out under pressure. MOH asks for initial notification within 2 hours of assessing that a threshold is met, and an incident report within 14 days of that initial notification Making the report. The legal obligation is the clinic's Staff cybersecurity awareness training Quiz-based awareness modules on the platform; completion tracked per person Ensuring staff complete the modules Vendor data processing agreements Not part of the platform The clinic's contractual obligation Incident response governance decisions Not part of the platform A clinic decision-maker is required CS/DS Essentials: what StrongKeep helps with vs what the clinic owns In short, StrongKeep helps you put the technical measures in place and keeps the evidence trail; governance, legal duties, and accountability remain with the clinic. Using a platform, or a consultant, does not make a clinic compliant or certified on its own. Your CMS does not cover this either Your clinic management system (such as Plato, SGiMED, or GPConnect) manages National Electronic Health Record (NEHR) data flows and clinical records. It does not secure your staff devices, email, Wi-Fi, or passwords, generate your CS/DS Essentials policies, collect evidence for MOH, or run staff awareness training. Those responsibilities sit outside the CMS. ## Who does the work on each route There are three routes, and the right one depends on how much you want to handle yourself. None is wrong. What follows is who does what; the money is a separate question. On this route Who runs the eight steps Who owns the decisions Unaided You do, from scratch, working out the sequence as you go. You. Self-serve platform You do, guided, with the tools and the evidence trail supplied. You. A platform cannot sign a policy or judge a vendor for you. CISOaaS consultant They run the assessment and write the plan; you act on it. Training delivery and board-level advice are typically included. Fees vary by provider; CSA publishes a provider listing. Still you. The clinic remains the responsible party whoever writes the document. The three routes differ in who does the work, not in who carries the obligation. Read the table down rather than across and one thing stands out: the clinic's own column is the same size in all three routes. Buying more, or hiring better, moves work out of the first column and never out of the second. That is the practical reason "do we need an IT team" and "do we need someone accountable" are different questions, and only the first one has a product for an answer. ## If you want to do it yourself, with help, the evidence pack builds as you go. StrongKeep helps you put the CS/DS Essentials measures in place: tools and guidance for device protection, generated policies, evidence collection, and support towards CSA's Cyber Essentials certification (a separate baseline scheme from MOH's CS/DS Essentials). No IT team needed. No setup fee. Get started Current rates and terms are on our pricing page. None of this needs an IT team; it needs someone in the clinic who owns the steps and the evidence, and enough unhurried time to work through them before September 2027. Who is that person in your practice, and have they been given the time? ## Frequently asked questions Straightforward answers to the questions a 1-5 doctor practice asks before committing. Do I need an IT consultant or IT staff to meet MOH CS/DS Essentials requirements? No, a dedicated IT team is not a legal requirement. MOH's CS/DS Essentials measures cover device protection, software updates, access control, backups and incident response. A practice manager with administrator access to clinic devices can put many of these measures in place, either unaided, with a self-serve platform that guides each step, or with a consultant. The clinic stays the responsible party for readiness regardless of which route it picks. How long does it take to work towards CS/DS Essentials with StrongKeep? Most small clinics can complete the initial technical setup within a few days to a couple of weeks. StrongKeep helps you enrol clinic devices, generates your policies, and starts building an evidence pack. Evidence collection is ongoing: CS/DS Essentials expects you to show that controls are working over time, not just at a single point. The dashboard shows your readiness at any moment. What does a practice manager actually have to do to set up StrongKeep? Enrol each clinic device, one at a time, confirm your organisation details, and review the policies, which are generated complete and ready to use. There are no scripts to run and no firewall rules to configure by hand, but it is a real sequence of steps and device enrolment is the longest part, so set aside unhurried time for it. The onboarding guide walks through each step in plain English. If you can manage a clinic's appointment software, you can manage these steps. What is the difference between StrongKeep and hiring a CISOaaS consultant? A CISOaaS engagement usually involves an initial assessment, a written plan, and an ongoing managed-service retainer. A consultant can advise on customisation, deliver staff training, and offer board-level governance advice. StrongKeep is a self-serve platform on a published monthly subscription with no setup fee and no contract; it helps you put the technical measures in place and build an evidence pack, but it does not replace human judgement on governance decisions. CSA's CISOaaS co-funding (up to 70% of an eligible engagement, applied for via the Infocomm Media Development Authority's (IMDA) CTOaaS portal as MOH's funding page directs) applies to an eligible engagement rather than acting as a standing discount on your ongoing costs. Both are valid; they suit different budgets and needs. Does StrongKeep require ongoing management after setup? Only light-touch review. StrongKeep flags issues and shows device status on your readiness dashboard, so most clinics review it periodically rather than daily. You do not need IT staff to write readiness reports by hand, but keeping controls and evidence current remains the clinic's responsibility. Can a clinic owner with no IT background use StrongKeep? Yes, with an honest qualifier: the steps ask for patience and administrator access, not technical skill. StrongKeep is designed for healthcare professionals rather than IT staff. The onboarding uses plain-English steps, and your policies are generated complete and ready to use. No scripts, no firewall configuration, and no technical jargon are required; the steps are repetitive rather than difficult, so give them unhurried time rather than the gaps between patients. What parts of CS/DS Essentials does StrongKeep not cover? StrongKeep helps with the technical controls, generates your policies, and handles evidence collection and readiness tracking. It does not: - Appoint your Data Protection Officer (a PDPA obligation for every Singapore organisation, separate from HIA) - Report data breaches to the PDPC now, or to MOH once the HIA applies, for you - Negotiate data processing agreements with vendors - Guarantee staff finish their awareness training (the platform provides quiz-based modules and tracks completion; ensuring staff complete them stays with the clinic) - Make clinical governance decisions These responsibilities remain the clinic's regardless of which platform or provider you use. Is setting up StrongKeep disruptive to clinic operations? No. Device enrolment runs in the background, with no downtime, no server setup, and no clinic closure required. It can be done after hours or during quiet periods, and device performance during normal clinic hours is not affected. Sources are linked inline throughout, and were accessed between 30 July and 5 August 2026. This guide is general information, not legal advice. Confirm current obligations, deadlines, and grant eligibility with MOH, PDPC, CSA, Enterprise Singapore, or your own adviser. Note: a practice providing more than one service type does not get the later date. Each service follows its own timeline, so a GP practice that also does specialist work keeps September 2027 for the GP service. The full table of service types is in our readiness checklist. ## Related guides for Singapore GP clinics Solution ## StrongKeep for GP clinics: CS/DS Essentials support and HIA readiness Guide ## Cybersecurity and compliance myths small clinics get wrong Checklist ## HIA readiness checklist for Singapore GP clinics ## You do not need an IT team to start. StrongKeep helps a small Singapore clinic put the CS/DS Essentials measures in place, with the evidence pack building as you go. No IT team, no setup fee, no contract. See StrongKeep in action Current rates and terms on our pricing page. --- ### HIA Readiness Checklist for Singapore GP Clinics: All 13 CS/DS Essentials Measures URL: https://www.strongkeep.com/free-tools/hia-readiness-checklist-singapore-gp-clinics/ Date: 2026-07-24 Author: StrongKeep Team Category: Healthcare Compliance All 13 measures in MOH's CS/DS Essentials, as a readiness checklist for Singapore GP clinics, with the HIA incident reporting thresholds and timelines. Healthcare Compliance ## HIA Readiness Checklist for Singapore GP Clinics: All 13 CS/DS Essentials Measures 24 July 2026 By StrongKeep Team ~9 min read Reviewed against Ministry of Health (MOH) CS/DS Essentials (first edition, 2026) TL;DR The Ministry of Health's (MOH) Cybersecurity and Data Security (CS/DS) Essentials set out 13 security measures for organisations handling health information, across cybersecurity, data security and common practices. GP clinics fall in Batch 1 of the upcoming Health Information Act, due September 2027. The Health Information Act (HIA), MOH's upcoming law on the safe handling of health information, isn't in force yet. General practitioner (GP) clinics fall in Batch 1, due September 2027, alongside five other service types listed in the table below. The Personal Data Protection Act (PDPA), Singapore's existing data protection law, applies today. Keep the two clocks separate. The measures come from MOH's Cybersecurity and Data Security Essentials (first edition, 2026), developed by MOH in consultation with the Cyber Security Agency of Singapore (CSA), the Infocomm Media Development Authority (IMDA) and the Personal Data Protection Commission (PDPC). They set the security measures expected of "HIA entities": every Healthcare Services Act (HCSA) licensee, which puts a licensed GP clinic in scope, plus National Electronic Health Record (NEHR) contributors and users, and prescribed entities. ## HIA deadlines by clinic type MOH batches the deadline by service type. The date below is not only a security deadline: it is the date a provider starts contributing to the NEHR and has the cybersecurity and data security measures in place. - Batch 1 by September 2027 Your batch - Outpatient Medical Service (GP) - Acute Hospital - Community Hospital - Clinical Laboratory - Radiology Laboratory - Nuclear Medicine Service - Batch 2 by September 2028 - Outpatient Medical Service (Specialist) - Nursing Home - Contingency Care Service - Outpatient Renal Dialysis - Batch 3 by March 2030 - Outpatient Dental - Ambulatory Surgical Centre - Assisted Reproduction - Retail Pharmacy MOH, Implementation Timelines, last updated 27 July 2026. If you provide more than one service type, you have more than one deadline. MOH's rule is that "NEHR contribution and CS/DS requirements apply according to each service's respective implementation timeline". A GP practice that also runs a dental chair keeps September 2027 for the GP service and March 2030 for the dental one. The earlier date is the one that governs your planning. What matters is the evidence. You need to be able to show that you have done what the measures ask, in the moment someone asks for it: after an incident, or if MOH follows up on a breach. So read each box below as a record you could produce, dated before anyone came looking. For each item the question is not "have we done this?" but "could we show it?" The 13 measures fall into three groups: cybersecurity, your machines and network, including updates, anti-malware, firewalls, backups and passwords; data security, the health information itself, being who may see it and how it leaves the clinic; and common practices, how the clinic runs around the technology, from staff training to having a plan for the day something goes wrong. Start by knowing what health information your clinic holds and can access, such as medical records and laboratory test results. Everything below is how you protect it. ## Where to start MOH doesn't rank or sequence the 13 measures set out below, so treat this order as our practical suggestion rather than the regulator's. - First, the protections that install once and then largely run themselves. Anti-malware on every device, and malicious-link blocking at the network layer. They close the most common attack routes for the least work. Automatic updates belong in this group too, with one difference: switching them on takes a minute, and confirming they actually ran stays a job someone in the clinic has to do. - Next, the measures that take real time to finish. Account and password hygiene is the hardest: unique logins for everyone, removing shared and dormant accounts, two-factor authentication and a password manager all sit in measure 2, and they are the fiddliest part to roll out. None of it can be rushed at the end. - Start collecting evidence now. Training records and periodic reviews cannot be backdated, and the ones you begin this month are the ones you will have. Nothing else on this list is made harder by starting late in quite the same way. - Write the policy documents last. A policy is easier to write once the practice it describes already exists. If you want the certificate, the route is published. CSA's Cyber Essentials mark for HIA entities sets out what an assessor looks for, and as things stand our understanding is that earning it is not mandatory. It covers hardcopy records as well as systems, so the locked-cabinet and disposal measures are in scope too, and it separates what is required from what is merely recommended. You will not be doing all of this unaided. MOH is issuing a guidebook and templates over 2026, which it says should cover most of the measures, and a clinic management system vendor that is CE certified builds several Section A controls in for you. Beyond that, some clinics work through it themselves, some use a self-serve platform, and some engage CISO-as-a-service. ## How to work through this list Each of the 13 measures below sets out what MOH asks for, then names the record that shows you have done it. That second line is the one that matters when someone asks you to evidence readiness, and it is the part most clinics leave until last. Work down the list and mark each measure as done, partly done, or not started. Print this checklist to tick it off on paper. Nothing here is submitted anywhere; it is for your own record. Unsure how the HIA relates to the PDPA? Our guide to clinic cybersecurity myths untangles that. Where StrongKeep does some of the work, the measure is marked: StrongKeep covers this StrongKeep covers part of this Unmarked measures are the clinic's own. The obligation stays yours either way: the mark is only about who does the work. ## Section A: Cybersecurity (IT and software measures) MOH applies these to computers and systems interconnected with the NEHR or containing health information. ## 1. Updates StrongKeep covers part of this - Operating system and application updates from legitimate sources are installed promptly, critical or important ones first. Record to keep. Nothing to buy here: switch automatic updates on, and let them run when they ask to. Keep a note of the date you last confirmed every device was current, and who checked. ## 2. Secure/Protect StrongKeep covers this - Anti-malware runs on every endpoint (laptops, desktops, servers), auto-updates its signatures, scans files on access, including downloads and USB drives, and runs regular scans. - Firewalls are configured and deployed: built-in operating system and router firewalls in a simple setup; a perimeter firewall accepting only authorised traffic in a network setup. - Staff policies require authorised software from trusted sources only, trusted networks (not public Wi-Fi) for clinic data and email, and immediate reporting of suspicious emails. Staff are also told why public networks are risky, not just that they are barred. - You keep an inventory of all user, administrator, third-party and service accounts: name, username, department, role, date created, last log-on. - Each person has a unique account; shared, dormant or inactive accounts (for example, unused for over 60 days) are removed; the administrator account is used only for administrator tasks, with senior management approval. - Access is granted and revoked through documented approvals, reviewed on staff changes, so people reach only what their role needs. - For each person granted access, you record six things: name, the system they can reach, department, role or account type, the date access started, and the date it ends where there is one. - Default passwords are replaced with strong passphrases (MOH's benchmark: at least 12 characters, mixing upper case, lower case and/or special characters), changed on any suspected compromise. Two-factor authentication (2FA) is used for administrative access, including remote access, to important systems, such as an internet-facing system holding sensitive or business-critical data. Accounts lock after multiple failed logins (for example, after 10). - Third parties and contractors reach only what their work requires, lose access when done, and sign a non-disclosure agreement (NDA) if handling health information. - Physical access to IT assets is restricted to authorised people; log-ins are tracked and security logs are viewable only by authorised individuals. - Desktops, servers and routers use secure settings: weak protocols replaced before use, unused features disabled, auto-connection to open networks and auto-run of non-essential programmes switched off. Record to keep. The largest measure, and mostly account work rather than software. The account inventory is itself the record: every user, administrator, third-party and service account, with who approved it and when it was last used. Expect to go device by device and through your Microsoft 365 or Google Workspace admin centre. ## 3. Backup StrongKeep covers part of this - Business-critical systems and essential data are backed up regularly, at a frequency matched to recovery needs; backups are restricted to authorised personnel and stored separately from the operating environment. - For cloud services, know who is responsible for backup, you or the provider, and keep an alternative backup. Record to keep. The record is your backup schedule, where the copies are kept, and who can reach them. MOH does not ask you to test a restore. It is still the only way to find out whether the backup works, so do it anyway, and date it when you do. ## 4. Asset StrongKeep covers this - New hardware and software are authorised before use, approval dates recorded in an up-to-date asset inventory; anything unapproved is removed. - Assets past End-of-Support (EOS), when the maker stops updates and servicing, are replaced; any continued use is risk-assessed, approved by senior management and monitored until replaced. Record to keep. The asset list is the record, and the End-of-Support line is the one with a budget attached: anything you keep running past it needs the assessment and the sign-off above, in writing. MOH has worked with Health Information Management Systems (HIMS) vendors, including clinic management systems, to embed key controls: timely updates, two-factor authentication for configuration changes, protected backups. Not all have certified yet. MOH's implementation circular records that, as at March 2026, 15 of the 17 HIMS integrated with the NEHR were CE certified, with all providers encouraged to certify before the end of 2026. Check your own vendor rather than assume. ## Section B: Data security (data-related practices) These apply to electronic data and hardcopy documents alike. ## 5. Secure StrongKeep covers part of this - Policies identify and protect your health information, with clauses in employment and vendor contracts prohibiting unauthorised disclosure. - Hardcopy records live in access-controlled spots such as locked cabinets, or offsite only with storage providers whose security you have checked (with deposit records and periodic stock-takes); laptops and portable media holding health information are cable-locked when not in use. - Retention periods have a documented rationale, considering the PDPA, HCSA licence conditions, contracts and national guidelines. - Copies of health information are made only by authorised people, for an official need-to-know purpose, and staff keep possession of copies made externally. - Transfers are controlled: only necessary information leaves the clinic, materials stay in staff possession, screens are shielded from view, and files sent electronically are password-protected, the password sent by a different channel and recipients checked. Record to keep. Most of this is written down rather than configured. The records are your signed policy and a retention schedule that says how long you keep each kind of record and why, with the reason traceable to the PDPA, your HCSA licence conditions or a national guideline. ## 6. Identify - Health information is marked so staff recognise it, for example headers or footers added at creation; where impractical, policy specifies which data counts as health information and staff apply the matching safeguards. - In deciding whether and how to mark it, you weigh four things MOH names: the format, hardcopy or electronic; how practical marking is, including the cost of changing an IT system; who handles the information, your own staff or a third-party vendor; and what the marking is meant to achieve. Record to keep. The smallest measure on the list. The record is the policy line stating what counts as health information in your clinic, so a new staff member can tell without asking. ## 7. Access StrongKeep covers part of this - Access to health information goes only to people with a legitimate need to know for their work, third parties included. - Someone with the authority to do so decides who has that need, and everyone given access acknowledges in writing that they have read your security measures, your policies, and the laws that apply such as the PDPA. Record to keep. Someone has to decide who needs access, and that decision has to be someone's job. The record is each person's written acknowledgement that they have read your policies and the rules that apply. Section B is mostly process work; if your clinic has no technical staff, our walkthrough of meeting the CS/DS Essentials without an IT team shows how a practice manager runs it. ## Section C: Common practices (personnel training, vendor management, organisation protocols) ## 8. Training and education StrongKeep covers this - Staff attend cybersecurity and data security awareness training periodically, ideally at least once a year in MOH's words, in-house, external or via self-help resources. - Day-to-day hygiene policies tell staff the security behaviour expected of them. Record to keep. Only your staff can generate this one. The record is the completion register, with dates. MOH asks for training periodically, and ideally at least once a year in its own words, so what you want is a register that keeps going rather than one push before the deadline. ## 9. Outsourcing and vendor management StrongKeep covers part of this - Any IT provider managing your network, systems or medical devices has clearly understood services, and sends regular vulnerability reports and security updates. - For third-party software and devices, you know where health information is stored (Singapore or overseas), what safeguards and certifications the vendor holds, and who bears what responsibility in an incident. - For cloud services, you understand your own responsibility for security configurations. Record to keep. This needs someone willing to ask a supplier an awkward question. The record is the vendor's written answers: where your data sits, what certifications they hold, and who is responsible for what when something goes wrong. How much of this to outsource is its own decision, and it turns on who in the clinic is able to hold a vendor to the answers above. ## 10. Security reviews and internal audit StrongKeep covers this - You periodically review your safeguards, check that policies are being followed (self-assessments or external audits, at your discretion), and fix any lapse promptly, retraining where needed. Record to keep. Keeping evidence is not the same as reviewing it. The record is a dated review note saying what you checked, what had slipped, and what you did about it. ## 11. Disposal - Health information is securely destroyed before any hardware or data is disposed of: shred documents, encrypt a hard disk before reformatting, overwrite stored data completely. Record to keep. The record is a disposal log: what was destroyed, when, by whom, and how. This applies to paper as much as to hard disks. ## 12. Emergency planning for contingency StrongKeep covers this - A business continuity plan identifies critical assets needing high availability and their redundancies, covers disruptions including cyber incidents and data breaches, and is ready to execute. Record to keep. The record is the plan itself, dated, plus evidence someone has actually read it. The useful test is whether your practice manager could run it on a Tuesday morning without calling you, because that is the scenario it exists for. ## 13. Incident response StrongKeep covers this - An up-to-date incident response plan assigns roles, sets procedures to detect, respond to and recover from common threats such as phishing and ransomware, and includes a communication plan with escalation timelines for internal and external stakeholders. - Everyone with access to your IT environment knows the plan and how to report suspicious activity. Record to keep. The record is the plan plus evidence your staff have seen it. Under the HIA the first notification to MOH is due within two hours of assessing that a threshold is met, which is not enough time to work out who to call. ## Incident reporting under the HIA: thresholds and timelines Once the HIA applies to your clinic, these are the reporting rules in the Essentials; until then, PDPA breach notification to the PDPC remains the live duty. What is reportable Threshold Cybersecurity incident Involves a computer or system that contains health information, or is interconnected with one, and that is under the clinic's control Data breach Aligned to the PDPA threshold: the breach results in, or is likely to result in, significant harm to an affected individual, or is, or is likely to be, of significant scale (500 or more affected individuals) For both categories: - Initial notification to MOH within 2 hours after the clinic assesses that the incident meets a reporting threshold. - An incident report within 14 days of the initial notification. - The clinic must notify affected individuals at the same time as notifying MOH, or as soon as practicable after, if the incident causes or is likely to cause significant harm. MOH's examples of notifiable cybersecurity incidents include unauthorised hacking, malicious software, denial-of-service and man-in-the-middle attacks. What counts as "significant harm" will be detailed in subsidiary legislation, and the specific reporting process will be shared in due course. September 2027 sounds far away, and thirteen measures do not embed in a quarter. The useful question is not which ones you could tick today, but which ones you could evidence today, because those are different lists and only the second one counts. If the gap is people rather than intent, meeting the Essentials without an IT team walks the sequence a practice manager can run. ## Frequently asked questions about the HIA Is the HIA in force yet? No, not yet. GP clinics sit in Batch 1 of the implementation timeline, due September 2027. The clock already running is the PDPA's: Singapore's existing data protection law applies to your clinic today, HIA or not. Which batch are GP clinics in? Batch 1, by September 2027. Five other service types share that date: acute hospitals, community hospitals, clinical laboratories, radiology laboratories and nuclear medicine services. Batch 2 (specialist outpatient, nursing homes, contingency care, outpatient renal dialysis) follows by September 2028, and Batch 3 (dental, ambulatory surgical centres, assisted reproduction, retail pharmacy) by March 2030. That date is when NEHR contribution starts as well as when the cybersecurity and data security measures have to be in place. The full table of service types is on this page. What happens if my clinic misses its deadline? Not settled yet, and worth being straight about that. The Health Information Act gives MOH enforcement powers, which the Minister of State set out at the Bill's Second Reading, but the specifics, including what counts as significant harm and how penalties are set, come in subsidiary legislation that has not been published. What is already true is that the PDPA applies to your clinic today, with its own enforcement regime, so a clinic with weak data security is exposed now rather than only from 2027. Do the CS/DS Essentials apply to my clinic? Yes, if your clinic is an HIA entity, and a licensed GP clinic is one. The Essentials apply to every Healthcare Services Act (HCSA) licensee, to National Electronic Health Record (NEHR) contributors and users, and to prescribed entities. Hold an HCSA licence? That's you. ## Sources - Ministry of Health, Cybersecurity and Data Security Essentials, first edition, 2026. https://healthinfo.gov.sg/files/CYBERSECURITY_AND_DATA_SECURITY_ESSENTIALS.pdf - Ministry of Health, Batched Implementation Timelines (implementation batches and CS/DS deadlines). https://www.healthinfo.gov.sg/implementation-timelines/ - Cyber Security Agency of Singapore, Cyber Essentials mark for Health Information Act (HIA) entities, Annex C-HIA (normative), V202603. Cyber Essentials for HIA Entities (PDF) This article is general information for clinic owners, not legal advice. For guidance on your clinic's specific obligations, consult a qualified professional or contact MOH's HIA enquiries channel. ## Related guides for Singapore GP clinics Guide ## Meeting CS/DS Essentials without an IT team Guide ## Cybersecurity and compliance myths small clinics get wrong Solution ## StrongKeep for GP clinics: CS/DS Essentials support and HIA readiness --- ### PDPA Compliance for Singapore Law, Accounting and Corporate Secretarial Firms URL: https://www.strongkeep.com/free-tools/pdpa-compliance-singapore-professional-services/ Date: 2026-10-02 Author: StrongKeep Team Category: Data Protection What the PDPA asks of a small Singapore law, accounting or corporate secretarial firm: the obligations in plain English, appointing a Data Protection Officer, and the 30-day and 3-day breach notification clocks. Data Protection ## PDPA compliance for Singapore law, accounting and corporate secretarial firms 2 October 2026 By StrongKeep Team ~9 min read Sourced to the Personal Data Protection Commission (PDPC), October 2026 TL;DR The Personal Data Protection Act (PDPA) applies to every Singapore firm that handles personal data, with no small-firm exemption. A professional services firm must appoint a Data Protection Officer (DPO), make reasonable security arrangements for client data, and, if a breach happens, assess it within 30 days and notify the PDPC within 3 calendar days of deciding it is notifiable. Most of the work is ordinary security hygiene plus records that show you did it. This guide is for small law practices, accounting firms and corporate secretarial firms in Singapore. Firms like these hold more sensitive personal data than their size suggests: NRIC and passport copies for client due diligence, payroll and tax records, shareholder and director registers, and case files. It covers the PDPA only. Your professional body's rules on confidentiality and record keeping sit alongside it. ## Does the PDPA apply to your firm? Yes, if you collect, use or disclose personal data in Singapore, which every client-facing firm does. Size and headcount make no difference to whether the Act applies. Two points change how it applies to professional services work. - Business contact information is largely outside the Act. A client contact's work email and office number, given for business purposes, is excluded from most obligations. Their NRIC, home address, salary and family details are not. - You may be a data intermediary for some clients. When an accounting or corporate secretarial firm processes personal data on a client's behalf, such as running payroll or keeping a register, it can be that client's data intermediary. Intermediaries carry the protection and retention obligations and must tell the client about a breach they detect. The same logic runs the other way. Your cloud email, document storage and practice management vendors are your data intermediaries, and you remain accountable for the personal data they hold for you. ## The PDPA obligations in plain English The PDPC sets out the data protection obligations in full. For a small firm, they come down to this. Obligation What it means for a small firm Consent, purpose and notification Tell clients why you collect their data, collect only what that purpose needs, and use it only for that purpose. Access and correction Be able to tell a client what personal data you hold about them, and correct it when asked. Accuracy Take reasonable care that data you rely on is correct and complete. Protection Make reasonable security arrangements against unauthorised access, loss and misuse, including for data your vendors hold for you. Retention limitation Stop keeping personal data once you no longer need it for business or legal purposes, and dispose of it properly. Transfer limitation If data goes overseas, for example to a cloud service hosted abroad, make sure it is protected to a comparable standard. Accountability Appoint a DPO, write and follow data protection policies, and tell staff about them. Data breach notification Assess suspected breaches promptly, and notify the PDPC and affected people when the breach is notifiable. The penalties are set by the Act. The PDPC can impose a financial penalty of up to S$1 million, or 10 per cent of annual turnover in Singapore for organisations whose turnover there exceeds S$10 million, whichever is higher. ## Appointing a Data Protection Officer Every organisation must designate at least one person to be responsible for its PDPA compliance. The PDPC's DPO page is clear that this applies whatever the size of the organisation, and that the DPO's business contact details must be available to the public. In a firm of five to fifty people, the DPO is usually a partner, a director or the office manager. It is a role, not a new hire. You can have an outside provider do the work, but the firm stays responsible, so someone inside it still needs to own the decisions. A workable DPO brief for a small firm covers five things: - Know what you hold. Keep a simple list of the personal data the firm collects, where it lives (email, shared drive, practice software, paper) and who can reach it. - Own the policies. A short data protection policy, a retention schedule and a breach response plan, all written down and shown to staff. - Answer requests. Be the published contact for client access and correction requests and complaints. - Check the vendors. Know which providers hold client data for you and what their contracts say about security and breaches. - Run the breach clock. Be the person who starts the assessment the day a suspected breach surfaces. The PDPC also asks organisations to register their DPO's business contact details. The route has changed before, so use the current instructions on the PDPC's DPO page. ## Breach notification: the 30-day and 3-day clocks Since February 2021 the PDPA has carried a mandatory breach notification duty. The PDPC's Guide on Managing and Notifying Data Breaches sets out how the two clocks work. - Assess within 30 calendar days. Once you have credible grounds to believe a breach has happened, you must take reasonable and expeditious steps to assess whether it is notifiable, within 30 calendar days. Document every step: the PDPC may ask for it. - Decide whether it is notifiable. A breach is notifiable if it is likely to result in significant harm to the people affected, or if it affects 500 or more people. Regulations list the kinds of data deemed to cause significant harm; the PDPC's examples include credit card details and financial information such as wages, commission and bonuses. - Notify the PDPC within 3 calendar days. Once you decide a breach is notifiable, notify the PDPC as soon as practicable and no later than 3 calendar days after that decision. The PDPC's own example: decide on 1 January, notify by 4 January. - Tell the people affected. Where the breach is likely to cause them significant harm, notify them as soon as practicable, at the same time as or after you notify the PDPC. For a professional services firm, the second step is rarely close. Client files routinely hold exactly the financial and identity information the regulations have in mind, so a compromised mailbox or a lost laptop can be notifiable on day one. The breach most small firms meet first It is usually ordinary: an email sent to the wrong client, a staff mailbox opened by a phishing link, or a laptop left in a taxi. Each one starts the 30-day clock. Firms that cope well have decided in advance who assesses, who calls the PDPC and who writes to clients. ## What reasonable security looks like in a small firm The Act does not list technical controls. It asks for arrangements that are reasonable for the data you hold, and client files in professional services are sensitive. In practice that means: - Protection on every device. Anti-malware on each laptop and desktop, with updates switched on. - Strong, separate logins. No shared accounts, a password manager, and two-factor authentication on email and cloud storage. - Safer links and email. Blocking of known phishing and malicious sites, plus a check that your website and email domain are set up securely. - People who know the tricks. Short, regular training on phishing and invoice scams, which target firms that move client money. - Access that ends when people leave. A leaver's accounts closed on their last day. - A rehearsed plan. A breach response plan someone has walked through at least once. ## How StrongKeep helps, and what it does not do StrongKeep is a self-serve platform for small firms without an IT team. The two plans map onto the obligations above. - The Protection plan covers the security layer. Anti-malware and a web filter on every device, website and email security scans, a password manager, and cyber awareness and phishing training. A cyber crisis simulation and an incident diagnostic tool help you rehearse the breach clock before you need it. - The Compliance plan adds the paperwork that shows it. Generated policies, evidence tracking, regular reminders and audit logs, so your DPO can show what was in place and when. It also guides you through CSA's Cyber Essentials, which an external assessor certifies, and through Data Protection Essentials (DPE). DPE is an IMDA and PDPC programme with a DPE logo as recognition. It is not a certification. What StrongKeep does not do matters as much for a firm that holds privileged material. It does not read or inspect your documents or emails: it works from device and security logs. It does not act as your DPO or make the legal call on whether a breach is notifiable. And no tool can guarantee a breach will not happen; what it can do is make one less likely and leave you with the records to show you took reasonable care. See StrongKeep for law firms, for professional services, or what each plan includes. ## Frequently asked questions about the PDPA for professional services Does a small law, accounting or corporate secretarial firm need a Data Protection Officer? Yes. Section 11(3) of the PDPA requires every organisation to designate at least one person to be responsible for its compliance, whatever its size. It can be an existing partner, director or office manager, and their business contact details must be made available to the public. Can we outsource the Data Protection Officer role? You can have an outside provider carry out the work, but the firm stays responsible for complying with the PDPA. Someone inside the firm still needs to own the decisions and know where the records are. How quickly do we have to report a data breach to the PDPC? Once you have credible grounds to believe a breach has happened, you have up to 30 calendar days to assess whether it is notifiable. If it is, you must notify the PDPC as soon as practicable and no later than 3 calendar days after that determination. A breach is notifiable if it is likely to cause significant harm to the people affected, or if it affects 500 or more people. Is Data Protection Essentials a certification? No. Data Protection Essentials (DPE) is an IMDA and PDPC programme that helps small businesses put basic data protection and security practices in place, with a DPE logo as recognition. It is not a certification and it does not replace your PDPA obligations. Sources are linked inline and were accessed on 2 October 2026. This guide is general information, not legal advice. Confirm current obligations with the PDPC or your own adviser. ## Related pages Solution ## StrongKeep for law firms Solution ## StrongKeep for professional services firms Compare ## Which compliance frameworks apply to your business ## Put the security behind your PDPA duties Protect every device, train your team and keep the records your DPO needs, without an IT department. Start with a Free Scan Plans and terms on our pricing page. --- ### Free Tools and Guides URL: https://www.strongkeep.com/free-tools/ Free, AI-powered cybersecurity tools and plain-English guides for SG SMEs from StrongKeep. Run a cyber posture assessment, drill your leadership team with a tabletop exercise, and work out what the rules actually ask of you. ## Free tools and guides No sales call. No credit card. These are free, AI-powered tools we built so SG SMEs can see, in minutes, where they actually stand, and guides that explain what the rules actually ask of you. If they earn your trust, the rest of StrongKeep does the same job at a price built for small teams. ## Tools Free AI assessment ## CyberScan Answer a few questions about how your business runs and get a personalised cyber risk report in under two minutes. CyberScan looks at the same gaps an auditor would (phishing exposure, password hygiene, device protections, misconfigurations) and tells you exactly where your business is soft and what to fix first. Free. No login or credit card required to start. AI-run scenario drill ## Crisis Tabletop Exercise Run a realistic ransomware, data-breach, or supplier-compromise drill with your leadership team in thirty minutes. Our AI generates a scenario tailored to your industry, injects curveballs as the exercise unfolds, and grades how your team responds. The cheapest way to find out who freezes, who improvises, and which decision nobody actually owns, before a real incident charges you for the answer. Free. No credit card required to start. ## Cyber education Download the trailer (MP4, 11 MB) Three real attacks on small businesses, retold as comics. Watch the two-minute trailer, then play each story and make the calls yourself. Free, no sign-up. Clinic owner, Singapore ## The Morning Your receptionist calls at 07:34. The front desk screen is showing a ransom demand, and the first patient is due in 68 minutes. Make the clinic owner's four decisions and see what each one cost. Based on the 2021 ransomware attack on a Singapore eye clinic. Interactive story Play now Family business owner, Indiana, USA ## Everything Checked Out Your biggest customer paid every invoice on time, and for 96 days none of it reached you. Someone emailed her new bank details, and every check you ran said the payments were fine. Make the owners' four decisions. Based on a US Department of Justice case. Interactive story Play now Finance director, Singapore ## The Restructuring Your CFO messages you on WhatsApp about a confidential restructuring. Three days later, USD 499,000 has left the account. Take the finance director's job for four days and make his four decisions. Based on a 2025 Singapore Police Force release. Interactive story Play now ## Guides Data Protection ## PDPA Compliance for Singapore Law, Accounting and Corporate Secretarial Firms The PDPA obligations that matter for small professional services firms, how to appoint a Data Protection Officer, and how breach notification works, sourced to the PDPC. 2026-10-02 StrongKeep Team Healthcare Compliance ## HIA Readiness Checklist for Singapore GP Clinics: All 13 CS/DS Essentials Measures The 13 CS/DS Essentials measures MOH expects of HIA entities, as a checklist for Singapore GP clinics, plus the incident reporting thresholds and timelines. 2026-07-24 StrongKeep Team Healthcare Compliance ## Can a Singapore GP Clinic Meet CS/DS Essentials Without an IT Team? The do-it-yourself path to MOH's CS/DS Essentials for a small GP clinic: what a practice manager actually does, what stays the clinic's responsibility, and how the platform and consultant routes compare. 2026-06-29 StrongKeep Team Healthcare Compliance ## 8 Cybersecurity and Compliance Myths Singapore Clinics Get Wrong The biggest risk to a small clinic is not the regulation, it is the myths around it. Eight common cybersecurity and compliance misconceptions in Singapore, corrected with cited sources. 2026-06-22 StrongKeep Team Insights ## Do small businesses need a hardware firewall? We think not. Traditional hardware firewalls are outdated for SMBs in 2025. Discover why DNS firewalls with endpoint and identity controls offer better security with less complexity. 2025-12-09 Sir Stonk Guide ## An IT Manager's Cybersecurity Guide to Cover Your Ass Stretched thin managing cybersecurity? This practical guide shows IT managers how to implement minimum viable security without burning out. 2025-07-24 Vanessa Quek ## Try a free tool. Decide for yourself. Run the free CyberScan --- ## Media Coverage ### Straits Times: Should S'pore Compel Insurers to Report Ransomware Incidents? URL: https://www.strongkeep.com/news/ransomware-reporting/ Date: 2025-07-28 Author: The Straits Times Category: Media Coverage Our CEO Gaurav Keerthi explained to Krist Boo from The Straits Times that when a ransomware attack hits their company, many SMEs turn to the authorities hoping that they have a 'magic key' to save them. Unfortunately, the harsh reality hits them. Media Coverage ## Should S'pore Compel Insurers to Report Ransomware Incidents? When ransomware attacks hit, SMEs turn to authorities hoping for a "magic key" to save them. Unfortunately, the harsh reality is very different. July 28, 2025 The Straits Times: Krist Boo Our CEO Gaurav Keerthi explained to Krist Boo from The Straits Times that when a ransomware attack hits their company, many SMEs turn to the authorities hoping that they have a "magic key" to save them. Unfortunately, the harsh reality hits them: There's no magic decryptor. No "Undo." Authorities won't have the solution. "Your main overriding concern [as a victim] is to get back in shape. Informing other people who will ask you questions is not top on your list of priorities." Gaurav Keerthi, CEO of StrongKeep Screenshot from The Straits Times article ## The Uncomfortable Reality When SMEs experience ransomware attacks, they often approach authorities expecting immediate solutions. However, the reality is far more challenging than most victims anticipate. This reality check is difficult for businesses already in crisis mode. The expectation that someone can simply reverse the damage often leads to disappointment and delays in taking appropriate action. ## Survival Comes First When a business is under attack, priorities become very clear very quickly. Victims focus on restoring operations rather than filing reports or answering questions from investigators. This highlights a fundamental tension between the immediate operational needs of affected organizations and broader reporting obligations that regulatory frameworks might impose. ## The Reporting Dilemma Should insurers be compelled to report ransomware incidents? The question raises important considerations: - Data collection: Better incident data could help the broader ecosystem understand and respond to threats - Privacy concerns: Victims may face additional exposure and reputational damage - Timing challenges: Reporting during crisis adds burden to already overwhelmed teams - Trust implications: Mandatory reporting may discourage insurance claims or honest disclosure ## Read the Full Story Read the full article on The Straits Times: Should S'pore compel insurers to report ransomware incidents? Gaurav Keerthi CEO & Founder, StrongKeep. Former Deputy Commissioner of Cybersecurity at CSA Singapore, former CIO of the Singapore Air Force, and cyber advisor to Singapore's largest companies. ## Don't wait for ransomware. Protect your business now! Get Started --- ### Straits Times: As Cyber Piranhas Circle, Uncomfortable Alliances Must Hold the Line URL: https://www.strongkeep.com/news/cyber-piranhas/ Date: 2025-10-29 Author: The Straits Times Category: Media Coverage Our CEO Gaurav Keerthi explained to Bhavan Jaipragas from The Straits Times the uncomfortable but necessary bit: this duality is manageable with clear rules of engagement: transparent expectations, measurable responsibilities, mutual accountability. Media Coverage ## As Cyber Piranhas Circle, Uncomfortable Alliances Must Hold the Line Even when state interests and commercial incentives don't align, partnership isn't optional anymore: it's the only way to keep safe. October 29, 2025 The Straits Times: Bhavan Jaipragas Even when state interests and commercial incentives don't align... partnership isn't optional anymore; it's the only way to keep safe. Our CEO Gaurav Keerthi explained to Bhavan Jaipragas from The Straits Times the uncomfortable but necessary bit: this duality is manageable with clear rules of engagement: transparent expectations, measurable responsibilities, mutual accountability. "In cybersecurity, it should be clear when government is helping a victim company recover from a devastating attack, and when they are imposing penalties for insufficient prevention. This tension is often the hardest to manage." Gaurav Keerthi, CEO of StrongKeep ## Clear Rules of Engagement Managing the tension between state interests and commercial incentives requires: - Transparent expectations: Clear communication about what's required from all parties - Measurable responsibilities: Defined roles and accountabilities that can be tracked - Mutual accountability: Both government and businesses held to their commitments ## Partnership Is No Longer Optional While state interests and commercial incentives don't always align, partnership is no longer optional: it's the fundamental requirement for security in today's threat landscape. The cyber threats we face today are too sophisticated and too pervasive for any single entity to address alone. Governments have the intelligence and regulatory authority, while commercial entities have the technical expertise and operational visibility. Together, these uncomfortable alliances become the only viable defense. ## Read the Full Story Read the full article on The Straits Times: As cyber piranhas circle, uncomfortable alliances must hold the line Gaurav Keerthi CEO & Founder, StrongKeep. Former Deputy Commissioner of Cybersecurity at CSA Singapore, former CIO of the Singapore Air Force, and cyber advisor to Singapore's largest companies. ## Join the alliance. Protect your business today! Get Started --- ### Bank InfoSecurity: The Great Cyber Divide URL: https://www.strongkeep.com/news/cyber-divide/ Date: 2025-10-30 Author: Bank InfoSecurity Category: Media Coverage Gaurav Keerthi, CEO and founder of security start-up StrongKeep, said this threat landscape has led to what the World Economic Forum calls 'cyber inequity,' in which large enterprises remain well protected, while smaller ones lag behind in cyber readiness. Media Coverage ## The Great Cyber Divide: Smaller Enterprises Start at Disadvantage At the GovWare Conference 2025, StrongKeep CEO Gaurav Keerthi addressed what the World Economic Forum calls "cyber inequity": the significant gap in cybersecurity preparedness across company sizes. October 30, 2025 Bank InfoSecurity / GovWare 2025 Your browser does not support the video tag. Watch the full interview with Gaurav Keerthi at GovWare 2025 Third-party supply chain ecosystems, and the complexity that comes with them, have become just as much of an advantage for enterprises as they have a challenge. With organizations increasingly relying on vendors, cloud providers and open-source tools, threat actors are constantly finding new ways to compromise enterprises. ## The Cyber Inequity Challenge Gaurav Keerthi, CEO and founder of security start-up StrongKeep, said this threat landscape has led to what the World Economic Forum calls "cyber inequity," in which large enterprises remain well protected, while smaller ones lag behind in cyber readiness. "Cybersecurity is unequally distributed. Big enterprises have a lot of it. Small enterprises have none of it. And to some extent, it's a little bit unfair, but they become the targets because the attackers are trying to get after your company through them." Gaurav Keerthi, CEO of StrongKeep ## Key Discussion Points In this video interview with Information Security Media Group at the GovWare Conference and Exhibition 2025, Keerthi discussed: - Governance and procurement controls: Why these can effectively mitigate third-party risk - Expanding resilience frameworks: How resilience frameworks are expanding beyond technology - Enterprise collaboration: The importance of collaboration to strengthen the overall cyber landscape ## Third-Party Risk With organizations increasingly relying on vendors, cloud providers, and open-source tools, the attack surface has expanded dramatically. Threat actors are constantly finding new ways to compromise enterprises through their supply chain relationships. Smaller firms become attractive targets for attackers seeking entry into larger organizations. By compromising a vendor with weaker defenses, attackers can gain access to larger, better-protected organizations, making cybersecurity a collective challenge. ## The Path Forward True resilience extends beyond technology solutions. It requires building security awareness, establishing clear processes, and creating a culture where cybersecurity is everyone's responsibility. Enterprise collaboration is essential to improve the overall cyber landscape. Larger organizations can support smaller partners through shared resources, training, and accessible security frameworks. Gaurav Keerthi CEO & Founder, StrongKeep. Former Deputy Commissioner of Cybersecurity at CSA Singapore, former CIO of the Singapore Air Force, and cyber advisor to Singapore's largest companies. ## Don't let your business be the weakest link! Get Started --- ### Spotlight: A startup trying to IKEA-ify cybersecurity for SMEs URL: https://www.strongkeep.com/news/techinasia-ikeafy/ Date: 2026-01-29 Author: TechInAsia Category: Media Coverage While shaping cybersecurity policy at Singapore's Cyber Security Agency, Gaurav Keerthi saw a persistent gap. Regulations were designed to raise security standards, but the market failed to produce practical tools for small businesses. Media Coverage ## Spotlight: A startup trying to IKEA-ify cybersecurity for SMEs Moving away from complex, enterprise-style solutions toward simpler, more modular approaches designed for the businesses that need it most. January 29, 2026 TechInAsia This Tech in Asia feature on StrongKeep explores a growing shift in cybersecurity, moving away from complex, enterprise-style solutions toward simpler, more modular approaches designed for SMEs. ## IKEA-ifying Cybersecurity Rather than scaling down traditional tools, the piece highlights the idea of "IKEA-ifying" cybersecurity: breaking it into clear, manageable components that businesses can implement without deep technical expertise. It reflects a broader recognition that most companies need solutions that are practical, structured, and easy to adopt, not overly engineered systems built for large organisations. "Regulations were designed to raise security standards, but the market failed to produce practical tools for small businesses." Gaurav Keerthi, CEO of StrongKeep ## Read the Full Story Read the full feature on Tech in Asia: A startup trying to IKEA-ify cybersecurity for SMEs Gaurav Keerthi CEO & Founder, StrongKeep. Former Deputy Commissioner of Cybersecurity at CSA Singapore, former CIO of the Singapore Air Force, and cyber advisor to Singapore's largest companies. ## Cybersecurity made simple. Get the basics sorted for your business today! Get Started --- ### Singapore Business Cyber Readiness Exercise URL: https://www.strongkeep.com/news/singapore-business-readiness/ Date: 2026-02-03 Author: Channel News Asia Category: Media Coverage StrongKeep was given the immense responsibility of facilitating the national cyber crisis exercise for small businesses as part of Ministry of Defence of Singapore's Exercise SG Ready for Total Defence Day, together with Singapore Business Federation. Media Coverage ## Singapore Business Cyber Readiness Exercise StrongKeep facilitated the national cyber crisis exercise for small businesses as part of Ministry of Defence's Exercise SG Ready, together with Singapore Business Federation. February 3, 2026 Channel News Asia Yesterday, StrongKeep was given the immense responsibility of facilitating the national cyber crisis exercise for small businesses as part of Ministry of Defence of Singapore's Exercise SG Ready for Total Defence Day, together with Singapore Business Federation. ## The 99% That Get Overlooked Small companies are often neglected in conversations on national resilience, but the reality is that 99% of our companies are small, and they form the bedrock of our economy. A total of 91 companies took part, split across 15 groups, each discussing how they would make decisions under gruelling conditions of a power disruption and a cyber incident. "What stood out wasn't technical weakness. It was honesty." Gaurav Keerthi, CEO of StrongKeep ## Overwhelmed, Not Careless Most small companies openly shared that they felt unprepared for a crisis of this nature. Many had very little cyber protection or resilience planning in place. That moment stuck with us. Not because it was careless, but because it was real. Small businesses aren't ignoring cybersecurity. They're overwhelmed by it. They're balancing operations, cash flow, staff, and customers, while being handed tools and frameworks that assume a security team they don't have. They're not looking for best-in-class solutions. They're looking for a practical way to start doing something. Even something as simple (and free) as having a table-top discussion on preparedness was foreign to many of them. Consultants typically take weeks to prepare an exercise and can only support one company at a time. For most SMBs, that pushes crisis preparation out of reach. ## How StrongKeep Did It Differently Using StrongKeep's platform, we ran this very differently: - 20 groups designed and ran tailored cyber crisis exercises in parallel - Scenarios were AI-generated and facilitated within the platform - Decisions, discussions, and gaps were captured as the exercise unfolded - A report, with feedback and advice, was automatically generated for every group No theatrics. No over-engineered playbooks. Just the fundamentals, structured properly. Because small companies don't need to be impressed by fancy slides or pricey consultants: they need the basics sorted. "National resilience isn't built only through large agencies and critical infrastructure. It's built when everyday businesses know how to respond calmly when things stop working." Gaurav Keerthi, CEO of StrongKeep StrongKeep was proud to make cyber crisis preparation achievable and accessible, not intimidating, for the 99% of SMBs without dedicated cyber teams. ## Watch the Full Segment Gaurav Keerthi CEO & Founder, StrongKeep. Former Deputy Commissioner of Cybersecurity at CSA Singapore, former CIO of the Singapore Air Force, and cyber advisor to Singapore's largest companies. ## Make cyber crisis preparation achievable for your business today! Get Started --- ### CNA: Leaked documents suggest 255 Singapore firms linked to critical infrastructure hit URL: https://www.strongkeep.com/news/leaked-documents-singapore-cna/ Date: 2026-02-25 Author: Channel News Asia Category: Media Coverage 'Smaller companies are being more targeted by hackers and yet remain less protected.' StrongKeep CEO Gaurav Keerthi shared his views with Channel News Asia how the cyber landscape is changing rapidly for SMBs due to increasing compliance requirements. Media Coverage ## Leaked documents suggest 255 Singapore firms linked to critical infrastructure hit Smaller companies are being more targeted by hackers and yet remain less protected, and compliance requirements are rapidly reshaping the cyber landscape for SMBs. February 25, 2026 Channel News Asia "Smaller companies are being more targeted by hackers and yet remain less protected." Our CEO Gaurav Keerthi shared his views with Channel News Asia on how the cyber landscape is changing rapidly for SMBs, and how compliance will exponentially reshape cyber hygiene for them: because cybersecurity baselines are now a "recursive standard". "Smaller companies are being more targeted by hackers and yet remain less protected." Gaurav Keerthi, CEO of StrongKeep ## What Does It Mean for Cybersecurity to Be "Recursive"? Cybersecurity is becoming a license to operate, even for the smallest business. We are seeing more SMEs step up their security, not because of fear, but because: - Regulators are raising baseline expectations across supply chains and industries. - Contracts from large customers now include explicit security clauses. The standard being referenced by regulators and customers in Singapore is Cyber Essentials. One of its recommendations states: "The organisation should review the cybersecurity posture of third parties or contractors… to adequately manage supply chain risk." In simple terms: if Company ABC is required by a regulator or a major client to achieve Cyber Essentials, it cannot comply in isolation. To meet that requirement properly, ABC must assess and often impose similar cybersecurity expectations on its own vendors. Those vendors, in turn, must evaluate their third parties. And so the requirement propagates. "It is a standard that calls on itself in order to be true. A classic case of recursion." Gaurav Keerthi, CEO of StrongKeep ## From Internal IT Decision to Ecosystem Obligation This is how cybersecurity moves from being an internal IT decision to an ecosystem obligation: - One contract triggers another. - One certification requirement flows downstream. - One regulator's signal reshapes an entire supply chain. For SMBs, this changes the conversation entirely. Cybersecurity is no longer about whether you think you are a target. It is about whether you want to remain eligible to do business. The companies that understand this early will treat baseline cybersecurity as part of their core business infrastructure. The rest may only realise it when a renewal, tender, or audit forces the issue. "The question is no longer 'Are we likely to be attacked?': it is 'Are we ready when our customers start asking?'" Gaurav Keerthi, CEO of StrongKeep ## Watch the Full Segment Gaurav Keerthi CEO & Founder, StrongKeep. Former Deputy Commissioner of Cybersecurity at CSA Singapore, former CIO of the Singapore Air Force, and cyber advisor to Singapore's largest companies. ## Cybersecurity is now a license to operate. Don't wait to get protected! Get Started --- ### Addressing the Supply Chain Risk URL: https://www.strongkeep.com/news/addressing-supply-chain-risk/ Date: 2026-03-26 Author: Dark Reading Category: Media Coverage CEO Gaurav explains why protecting smaller companies is the key to keeping big enterprises secure, in this article on Dark Reading. Media Coverage ## Addressing the Supply Chain Risk Why protecting smaller companies is the key to keeping big enterprises secure. March 26, 2026 Dark Reading Supply chain cyber risk isn't going anywhere, and even the most secure enterprises can't outrun it. Our CEO Gaurav Keerthi's article in Dark Reading covers this difficult challenge head on. ## Why Is Supply Chain Risk So Hard to Solve? Because the risk often sits with your smallest vendors: the ones that don't have the budget, tools, or time to keep up. Closing that gap isn't about piling on more requirements. It's about making baseline security simple, scalable, and achievable. "Closing the gap isn't about more requirements. It's about making baseline security simple, scalable, and achievable." Gaurav Keerthi, CEO of StrongKeep ## A Systemic Problem, Not an Edge Case Around 40% of SMBs face cyberattacks, yet many still lack the resources to protect themselves. This isn't an edge case: it's systemic. And it's precisely why supply chain risk keeps showing up in boardrooms of even the largest, most mature enterprises. Big enterprises can invest heavily in their own defences, but their security posture is only as strong as the weakest vendor in their supply chain. When that vendor is a small business without dedicated cybersecurity staff, the entire ecosystem is exposed. ## What Needs to Change Our CEO Gaurav Keerthi shares more in Dark Reading on what's holding SMBs back and what needs to change, from making cybersecurity tools genuinely accessible to small businesses, to rethinking how enterprises support their vendors rather than simply demanding compliance. ## Read the Full Article Read the full piece on Dark Reading: Addressing the Supply Chain Risk: Why Protecting Smaller Companies Is the Key to Keeping Big Enterprises Secure Gaurav Keerthi CEO & Founder, StrongKeep. Former Deputy Commissioner of Cybersecurity at CSA Singapore, former CIO of the Singapore Air Force, and cyber advisor to Singapore's largest companies. ## Don't let supply chain risk be your blind spot: fortify your business today! Get Started --- ### Straits Times: Think You're Safe from Cyber Crooks? Why 99% of Companies Are Exposed URL: https://www.strongkeep.com/news/99-percent-companies-exposed/ Date: 2026-05-27 Author: The Straits Times Category: Media Coverage StrongKeep CEO Gaurav Keerthi, former Deputy Commissioner of the Cyber Security Agency of Singapore, explains to The Straits Times why 99% of companies are exposed, and how SMEs can build real cyber resilience without complexity or high cost. Media Coverage ## Think You're Safe from Cyber Crooks? Here's Why 99% of Companies Are Exposed StrongKeep CEO Gaurav Keerthi joined Deputy Opinion Editor Bhavan Jaipragas on The Straits Times podcast to discuss why 99% of companies remain vulnerable to cyber threats and why improving cybersecurity does not have to be expensive or technically complex. May 27, 2026 The Straits Times: Bhavan Jaipragas Listen: The Straits Times "In Your Opinion" Podcast, Season 1 Episode 76 ## The Shift: From IT Problem to Boardroom Issue Cybersecurity has moved from an IT back-office function to a boardroom governance priority in Singapore. Regulatory bodies, corporate boards, and insurers now treat cyber risk on par with financial and legal risk. Companies that still manage it as a purely technical IT matter are structurally behind, and the 99% exposure rate is the result. High-profile breaches have accelerated this shift. The businesses best positioned are not necessarily the largest; they are the ones that have built consistent, practical defences. The challenge is that most solutions on the market were built for enterprise budgets and enterprise IT teams, not for a 15-person clinic or a boutique professional services firm. ## Why SMEs Are the Most Exposed 99% of companies in Singapore have no one on their team with a cybersecurity title or technical background. Without that expertise, most SMEs have no way of knowing whether they have already been compromised. Gaurav notes that well over half of StrongKeep customers arrive with a dormant virus already running on a device, silently logging keystrokes or stealing data, with no visible disruption to daily operations. - No in-house expertise: 99% of Singapore companies have no staff member with a cybersecurity title or technical background - Perceived cost barrier: Most SMEs believe proper cybersecurity requires an enterprise budget and dedicated IT staff. It does not. - False sense of security: Many SMEs assume they are too small to be a target. Most arrive at StrongKeep already compromised. ## SMEs as Supply Chain Entry Points SMEs are targeted not only for their own data but as entry points into the larger organisations they supply or serve. Gaurav's example: breaking into a large bank directly is hard. Breaking into a law firm, accounting firm, or HR software provider that the bank relies on is far easier, and gives an attacker the same access. Boards are beginning to ask which of their vendors could be used as a route in. ## Cybersecurity Risk: AI in the Hands of Attackers AI has not introduced new categories of cyber threat. It has made existing threats faster, cheaper, and more convincing. Gaurav describes it as a productivity tool for attackers: they are building better viruses and more convincing phishing at greater scale and lower cost. When the mouse gets superpowers, the cats need to worry. The clearest example is phishing. A decade ago, the standard advice was to look for typos and grammatical errors in suspicious emails. Today, Gaurav notes, a typo is a sign the email came from a human. AI writes perfect, personalised phishing at scale. Deepfake images and videos have made it harder still to verify what is real. CSA's advisory to boards was specifically about this shift: not that AI is a new threat, but that it has given attackers a significant speed and scale advantage. "Building cyber resilience is not difficult nor does it have to be expensive or overly complex." Gaurav Keerthi, CEO of StrongKeep, on LinkedIn ## What Practical Resilience Looks Like Gaurav frames the SME cybersecurity problem around four things that can go wrong: downloading something malicious, clicking on a fraudulent link, having credentials stolen, and running unpatched or insecure systems. AI exploits all four more effectively, but addressing these four remains the foundation of a defensible business. Solving all four, Gaurav argues, costs less than a nice lunch for an SME that knows where to start. - Protection against malicious downloads across all business devices - Staff training to identify phishing links and fraudulent websites - Strong, unique credentials across all systems and accounts - Keeping all software and systems patched and up to date StrongKeep bundles all of this into a single, affordable platform built specifically for Singapore SMEs, starting from US$39 (S$49) per month, billed annually, for device protection across up to 5 devices. ## Read and Listen to the Full Story The full podcast episode is available on The Straits Times website and Spotify. The episode is part of Season 1 of "In Your Opinion", the ST opinion desk's podcast series exploring Singapore's most consequential issues. Read and listen: Think you're safe from cyber crooks? Why 99% of companies are exposed: The Straits Times Gaurav Keerthi on LinkedIn See the original post and discussion, with 141 reactions → StrongKeep on LinkedIn Follow StrongKeep for cybersecurity insights and updates → Gaurav Keerthi CEO and co-founder, StrongKeep. Former Deputy Commissioner of Cybersecurity at the Cyber Security Agency of Singapore (CSA), former CIO of the Singapore Air Force, and a cyber advisor to Singapore's largest organisations. He built StrongKeep to make enterprise-grade cybersecurity accessible to every Singapore SME. ## Don't be part of the 99%. Protect your business today. Get Started from US$39 (S$49)/month Covers up to 5 devices. No IT team required. Cancel anytime. --- ### Black Hat Stories: Why Doesn't Cybersecurity Expertise Reach Small Businesses? URL: https://www.strongkeep.com/news/black-hat-stories-gaurav-keerthi/ Date: 2026-07-29 Author: Black Hat Category: Media Coverage The deepest security expertise gathers where the budgets are. StrongKeep CEO Gaurav Keerthi makes the point on Black Hat Stories, the conference's own interview series. Media Coverage ## Why Doesn't Cybersecurity Expertise Reach Small Businesses? StrongKeep CEO Gaurav Keerthi features in Black Hat Stories, the conference's own interview series. In under two minutes he makes a point that sits underneath everything we build: the expertise on show at Black Hat is real, and almost none of it reaches the businesses that need it most. July 29, 2026 Black Hat Watch: "Black Hat Stories | Gaurav Keerthi, CEO and Founder of StrongKeep" ## What Did Gaurav Keerthi Say on Black Hat Stories? Black Hat Stories is the conference's own short-form interview series. In this episode, published to the Black Hat channel on 24 July 2026, Gaurav talks about why he keeps going back: the people, the technical depth, and the fact that no two visits have been the same. Black Hat's own description of the episode puts it this way. "With every Black Hat experience offering something different, Black Hat brings together passionate individuals, innovative companies, and deep technical expertise in one place." His practical advice for anyone turning up is the least technical thing in the video, and probably the most useful. Put yourself in the room, sit next to people, and talk. The conversations in the hallway and over coffee are worth as much as the ones on stage. ## How Can a Small Business Get Security Expertise Without Hiring It? One remark in the video is the reason we are writing this up rather than just sharing the link. Gaurav points out that the vast majority of companies in the world never get to listen to the conversations that happen at Black Hat. That is not a complaint about the conference. It is a description of how the industry is shaped. The deepest security expertise gathers where the budgets are, which means it gathers a very long way from a ten-person clinic or a small accounting practice. Those businesses face versions of the same threats, and almost none of that knowledge reaches them in a form they can use. Closing that distance is the whole reason StrongKeep exists. Not by sending small businesses to Black Hat, which was never the point, but by building the expertise into a product they can run without hiring anyone to interpret it. ## Where Can I Watch the Full Video? The episode runs 1 minute 39 seconds and is on Black Hat's official YouTube channel. Watch on YouTube: Black Hat Stories | Gaurav Keerthi, CEO and Founder of StrongKeep ## Related Reading - The Great Cyber Divide, on the gap between organisations that can staff security and those that cannot. - A startup trying to IKEA-ify cybersecurity for SMEs, on building security a non-specialist can actually operate. - Think you're safe from cyber crooks?, Gaurav on The Straits Times podcast on why so many companies remain exposed. ## Frequently Asked Questions What is Black Hat Stories? It is a short-form interview series published on Black Hat's own YouTube channel, in which people from the cybersecurity community talk about their experience of the conference. The episode featuring StrongKeep CEO Gaurav Keerthi was published on 24 July 2026 and runs 1 minute 39 seconds. Who is Gaurav Keerthi? He is the CEO and co-founder of StrongKeep. Before that he was Deputy Chief Executive and Deputy Commissioner for Cyber at the Cyber Security Agency of Singapore, and Chief Information Officer of the Republic of Singapore Air Force. He founded StrongKeep to build cybersecurity for the businesses the industry never designed for. ## What Does StrongKeep Do? StrongKeep is a self-serve cybersecurity platform for small and medium businesses. It bundles endpoint protection, phishing and malicious-link filtering, credential management, staff awareness training and phishing simulations, all run by the business itself from one dashboard. Compliance tooling is available on higher plans. StrongKeep holds the CSA Cyber Essentials Mark. Built for teams without an IT department. Plans are on the pricing page. StrongKeep on LinkedIn Follow StrongKeep for cybersecurity insights and updates → Gaurav Keerthi CEO and co-founder, StrongKeep. Former Deputy Chief Executive and Deputy Commissioner for Cyber at the Cyber Security Agency of Singapore, and former Chief Information Officer of the Republic of Singapore Air Force. He founded StrongKeep to build cybersecurity for the businesses the industry never designed for. ## Enterprise-grade security, built for a business without a security team. Get Started from US$39 (S$49)/month Covers up to 5 devices. No IT team required. Cancel anytime. --- ### CRN Asia: Why Do the Smallest Businesses Get the Least Cybersecurity? URL: https://www.strongkeep.com/news/crn-asia-cyber-inequity/ Date: 2026-07-29 Author: CRN Asia Category: Media Coverage StrongKeep CEO Gaurav Keerthi tells CRN Asia why the smallest businesses hold the least cybersecurity, and what has to be re-engineered before that changes. Media Coverage ## Why Do the Smallest Businesses Get the Least Cybersecurity? Cybersecurity is priced for companies that already employ security specialists. CRN Asia interviewed StrongKeep CEO Gaurav Keerthi about what he calls cyber inequity: the smallest businesses hold the least protection and are hit hardest when something goes wrong. His answer is not a discounted enterprise tool. It is a re-engineered one, bundled and sold at US$39 (S$49) a month. July 29, 2026 CRN Asia ## What Is Cyber Inequity? It is the World Economic Forum's term for the widening gap in cyber capability between larger and smaller organisations. Keerthi uses it to name what he sees in the market: how much protection a company gets still depends on how much it can pay. "For smaller businesses that lack the budget, they have nothing," he told the publication. "And ironically, it's the smallest companies that have the least cybersecurity that are the most affected by cyberattacks." A large firm can usually absorb an incident and recover. A smaller one may not get the chance. We have written about the same split before, in Bank InfoSecurity: The Great Cyber Divide. "You know there's a problem, and you know that you're at risk. But you can't do anything about it. So, StrongKeep sits in that space." Gaurav Keerthi, CEO and co-founder of StrongKeep, speaking to CRN Asia ## Why Doesn't a Cheaper Enterprise Security Tool Work? Because the cost that matters is the person running it. The usual route to a cheaper product is to trim an enterprise tool and wrap a service around it. "That doesn't really work because it still becomes very expensive," he said. "You're paying for consultant's time and it doesn't really fit the needs of a small law firm or accounting firm." His analogy is IKEA. In his telling, hire a carpenter and you get a bespoke table measured to your room; walk into a flat-pack store and you get one you screw together yourself for a fraction of the price. The second is not a discounted version of the first. "I have to fundamentally re-engineer what a table means," Keerthi said. ## Read the Full Interview on CRN Asia Aaron Raj's feature covers more than we have here: the four ways Keerthi says smaller businesses actually get breached, why the IT vendors who look after them started reselling the platform, and how AI lowered the cost of building it. Read StrongKeep brings enterprise-grade cybersecurity within reach of small businesses on CRN Asia, published 20 July 2026. ## Frequently Asked Questions Who is hit hardest by cyber inequity? The smallest businesses. In the CRN Asia interview, Gaurav Keerthi describes protection as priced for companies that already employ security teams, so firms without that budget end up with the least of it while facing the same attackers as everyone else. A large firm can usually absorb an incident and recover. A smaller one often cannot. What does StrongKeep bundle into a plan? Four things, mapped to the four ways a smaller business usually gets caught: enterprise-grade endpoint detection and response on every device, a network-layer DNS filter instead of a hardware box, a team password manager that also holds multi-factor codes, and a scan of the customer's servers during onboarding, run the way an attacker would look at them. How much does StrongKeep cost? The Protection plan starts at US$39 (S$49) a month, billed annually, and covers up to five devices, with a per-device add-on above that. Current plans and prices are on the StrongKeep pricing page. Is StrongKeep a managed security service? No. StrongKeep is a self-serve platform. The dashboard surfaces the alerts and the configuration, and the customer operates it. Separately, some IT vendors and managed service providers build their own services around the platform for their own clients, which is the channel the CRN Asia interview describes. ## What Does StrongKeep Do? StrongKeep is a self-serve cybersecurity platform for small and medium businesses. It bundles endpoint protection, phishing and malicious-link filtering, credential management, staff awareness training and phishing simulations, all run by the business itself from one dashboard. Compliance tooling is available on higher plans. StrongKeep holds the CSA Cyber Essentials Mark. Built for teams without an IT department. Plans are on the pricing page. StrongKeep on LinkedIn Follow StrongKeep for cybersecurity insights and updates → Gaurav Keerthi CEO and co-founder, StrongKeep. Former Deputy Chief Executive and Deputy Commissioner for Cyber at the Cyber Security Agency of Singapore (CSA), former Chief Information Officer of the Republic of Singapore Air Force, and a cyber advisor to some of Singapore's largest organisations. He built StrongKeep to make baseline cybersecurity reachable for every smaller business. ## Cybersecurity should not depend on the size of your budget. Get Started from US$39 (S$49)/month Covers up to 5 devices. Set up yourself. Cancel anytime. --- ### e27: Why Don't Smaller Businesses Have Cybersecurity? URL: https://www.strongkeep.com/news/e27-smb-cybersecurity-supply-gap/ Date: 2026-07-29 Author: Gaurav Keerthi Category: Media Coverage StrongKeep CEO Gaurav Keerthi writes in e27 that demand for small-business cybersecurity is already settled, and that the supply side is what was never built. Media Coverage ## Why Don't Smaller Businesses Have Cybersecurity? Nobody built it for them. StrongKeep CEO Gaurav Keerthi argues in e27 that demand was never the problem. Cyber risk already reaches firms of every size, and regulators, insurers and enterprise customers are all asking harder questions. What has been missing is a supply side. The industry built for large organisations with security teams, and stopped there. July 29, 2026 e27, by Gaurav Keerthi Read on e27: "The demand for SMB cybersecurity is inevitable, the supply was never built correctly" ## Why Doesn't Fixing Cybersecurity One Tool at a Time Work? Because the gap is structural, not a list of separate faults. Gaurav makes that case with 1858 London, where the Thames stank of sewage and the response to the cholera outbreak was to fix contaminated water pumps one at a time. What ended the outbreak was building an urban sewer system. He argues cybersecurity is stuck at the same stage. He puts it in one sentence. "Today, we are still dealing with cybersecurity as a point source problem, when the solution requires an infrastructure change." ## Why Did the Security Industry Design for Specialists? Contract size. "The industry's priorities were set by contract size, and small businesses never made the shortlist," Gaurav writes. A CISO with a multi-million dollar budget is a more attractive customer than a clinic with no IT staff, so the industry designed for complexity and sold that complexity as sophistication. He spent two decades on the other side of that line, at the Republic of Singapore Air Force and then at CSA, where the answer to a hard problem was to hire more specialists and buy more advanced tools. "The cyber industry is full of high-skilled professionals, but there is no IKEA for the masses." Gaurav Keerthi, CEO of StrongKeep, writing in e27 ## Read the Full Article on e27 The article was published on e27 under Gaurav's byline, through e27's contributor programme. The views in it are his own, and e27 carries its standard note to that effect. Not summarised above: what he argues AI has done to the cost of building security a non-specialist can operate, and what he thinks security designed for a small business should actually look like. Read it on e27: The demand for SMB cybersecurity is inevitable, the supply was never built correctly ## Related Reading - A startup trying to IKEA-ify cybersecurity for SMEs, the Tech in Asia profile that picked up the same analogy. - The Great Cyber Divide, on the gap between organisations that can staff security and those that cannot. - Think you're safe from cyber crooks?, Gaurav on The Straits Times podcast on why so many companies remain exposed. ## Frequently Asked Questions What is the argument in Gaurav Keerthi's e27 article? That demand for small-business cybersecurity is already settled and the failure is on the supply side. The security industry set its priorities by contract size, designed for organisations with security teams, and never redesigned for anyone else. His argument is that AI has now lowered the cost of building security a non-specialist can operate, which removes the reason the industry gave for not building it. What does "cyber inequity" mean? It is the World Economic Forum's term for the widening gap in cyber capability between larger and smaller organisations. In its Global Cybersecurity Outlook 2026 the WEF reports that small organisations by revenue are twice as likely as large ones to experience insufficient resilience levels, and that 46% of small organisations report a lack of cybersecurity skills and expertise against 29% of large organisations. Why are smaller professional services firms in Singapore so exposed to ransomware? Because of the data they hold. CSA's Singapore Cyber Landscape 2024/2025 records 159 ransomware cases in 2024, up 21 per cent on 2023, and professional services accounted for 28 of them, with the majority of those attacks targeting SMEs. The report points to the vulnerability of smaller professional service providers, particularly consulting and legal firms, which manage vast amounts of sensitive client data. It was the first time professional services ranked in the top three affected industries since CSA began tracking. Does a cheaper version of enterprise security solve the problem? The article says no, and the reason is staffing rather than price. A stripped-down enterprise tool still has to be configured, tuned and watched by someone who knows what they are looking at. Most small businesses have nobody in that role, so a lower price does not make the product usable. The fix has to change what the product asks of the owner, not just what it costs. ## What Does StrongKeep Do? StrongKeep is a self-serve cybersecurity platform for small and medium businesses. It bundles endpoint protection, phishing and malicious-link filtering, credential management, staff awareness training and phishing simulations, all run by the business itself from one dashboard. Compliance tooling is available on higher plans. StrongKeep holds the CSA Cyber Essentials Mark. Built for teams without an IT department. Plans are on the pricing page. StrongKeep on LinkedIn Follow StrongKeep for cybersecurity insights and updates → Gaurav Keerthi CEO and co-founder, StrongKeep. Former Deputy Chief Executive and Deputy Commissioner for Cyber at the Cyber Security Agency of Singapore, and former Chief Information Officer of the Republic of Singapore Air Force. He founded StrongKeep to build cybersecurity for the businesses the industry never designed for. ## Cybersecurity your business can actually run. Start today. Get Started from US$39 (S$49)/month Covers up to 5 devices. No IT team required. Cancel anytime. --- ### BFM 89.9: What Does the 'IKEA of Cyber Security' Mean for a Smaller Business? URL: https://www.strongkeep.com/news/bfm-ikea-of-cyber-security/ Date: 2026-08-04 Author: BFM 89.9 Category: Media Coverage StrongKeep CEO Gaurav Keerthi on BFM 89.9's Open For Business: what an IKEA model looks like in cybersecurity, and why smaller businesses have never been sold one. Media Coverage ## What Does the 'IKEA of Cyber Security' Mean for a Smaller Business? StrongKeep CEO Gaurav Keerthi joined presenter Audrey Raj on Open For Business, the enterprise programme on Malaysian business station BFM 89.9, to explain what an IKEA model looks like in cybersecurity: standard parts at a standard price, assembled by the business that bought them, rather than a bespoke build that needs a specialist to run it. August 4, 2026 BFM 89.9, Open For Business, presented by Audrey Raj Listen: BFM 89.9, Open For Business, "Building the IKEA of Cyber Security for SMEs" ## What Changes When a Business Can Assemble Its Own Security? The price and the person doing the work both change, and the analogy carries the point. Something bespoke is measured, built and installed for you, and it costs what that takes. A flat pack is standard, affordable, and put together by whoever bought it. Gaurav's argument on the show is that most smaller businesses were only ever offered the first one, and what they actually need is the second. How far that model stretches, and what it takes to make security something a non-specialist can genuinely operate, is the substance of the interview. Also in the conversation: why he left two decades in Singapore's national cyber security and defence organisations for the small-business end of the market. ## Where Can I Listen to the Full Episode? The episode runs 39 minutes and is on BFM's website, alongside the rest of the Open For Business archive. - Building the IKEA of Cyber Security for SMEs, BFM 89.9, 4 August 2026 - Open For Business, the show page, presented by Audrey Raj ## Related Reading - Spotlight: A startup trying to IKEA-ify cybersecurity for SMEs, the Tech in Asia profile built on the same analogy. - Think you're safe from cyber crooks?, Gaurav on The Straits Times podcast on why so many companies remain exposed. ## Frequently Asked Questions Who is the guest on the BFM 89.9 episode about the IKEA of cyber security? Gaurav Keerthi, CEO and co-founder of StrongKeep. Before founding it he was Deputy Chief Executive and Deputy Commissioner for Cyber at the Cyber Security Agency of Singapore, and Chief Information Officer of the Republic of Singapore Air Force. The episode was presented by Audrey Raj on Open For Business, BFM 89.9's enterprise programme, and published on 4 August 2026. What does the phrase "the IKEA of cyber security" actually mean? It is a comparison, not a product specification. Bespoke security is specified, built and operated by specialists, and priced for organisations that employ them. The IKEA comparison points the other way: standard parts, an affordable price, and assembly by the business that bought it. Gaurav sets out the argument in the episode. Are smaller businesses really targeted by ransomware? Yes. Verizon's 2025 Data Breach Investigations Report found ransomware was a component of 88% of breaches at small and medium-sized businesses, against 39% at large organisations. Its authors write that ransomware groups "don’t seem to care what size an organization is; they are quite happy to breach smaller organizations and adjust their ransom demands accordingly." Why did StrongKeep's founder leave a national cyber security role to work with small businesses? Gaurav Keerthi spent more than two decades on security problems, latterly as Deputy Commissioner for Cybersecurity and Deputy Chief Executive at Singapore's Cyber Security Agency, and before that as an Executive Vice President at Ensign InfoSecurity. His own account is that the smallest organisations were consistently the least protected, and that setting up a tech-for-good charity in Singapore showed him how hard it is for a small organisation to protect sensitive data. He founded StrongKeep in 2025, building on work that began at Ensign InfoSecurity in 2023. Which small businesses need this most? Businesses with no dedicated security team, which face the same attacks as large firms without the budget, tools or expertise to answer them. Three situations recur in Gaurav's account: firms pushed into cybersecurity by tender requirements from larger customers; firms holding sensitive client data, such as law, audit and HR practices, that want to show they handle it properly; and regulated sectors, where healthcare is StrongKeep's current focus. Most customers are in Singapore today. How has AI changed the risk for a business with no security team? It cuts both ways, and that is the part Gaurav says gets least attention. AI is what makes it possible to deliver security simply and cheaply enough for a small business to run itself. It has also given attackers more speed and scale, so a business that is not protected is likelier to be found. He names awareness as the harder problem: getting a busy owner to act before an incident rather than after one. ## What Does StrongKeep Do? StrongKeep is a self-serve cybersecurity platform for small and medium businesses. It bundles endpoint protection, phishing and malicious-link filtering, credential management, staff awareness training and phishing simulations, all run by the business itself from one dashboard. Compliance tooling is available on higher plans. StrongKeep holds the CSA Cyber Essentials Mark. Built for teams without an IT department. Plans are on the pricing page. StrongKeep on LinkedIn Follow StrongKeep for cybersecurity insights and updates → Gaurav Keerthi CEO and co-founder, StrongKeep. Former Deputy Chief Executive and Deputy Commissioner for Cyber at the Cyber Security Agency of Singapore, and former Chief Information Officer of the Republic of Singapore Air Force. He founded StrongKeep to build cybersecurity for the businesses the industry never designed for. ## Security your business can assemble itself. Start today. Get Started from US$39 (S$49)/month Covers up to 5 devices. No IT team required. Cancel anytime. --- ### Hospital Management Asia: Why Is Cyber Security Hard for a Small Clinic? URL: https://www.strongkeep.com/news/hma-cyber-resilient-healthcare/ Date: 2026-08-04 Author: Hospital Management Asia Category: Media Coverage Hospital Management Asia reports on a HealthTechX Asia 2026 panel moderated by StrongKeep CEO Gaurav Keerthi, where hospital IT leaders named staffing, not awareness, as the constraint on healthcare cyber resilience. Media Coverage ## Why Is Cyber Security Hard for a Small Clinic? Not because nobody takes it seriously any more. At a HealthTechX Asia 2026 panel moderated by StrongKeep CEO Gaurav Keerthi, hospital technology leaders told Hospital Management Asia that the constraint has moved. Boards now ask whether enough has been done. What is short is people to do it. August 4, 2026 Hospital Management Asia, by Cindy Peh Read on Hospital Management Asia: "Designing cyber-resilient healthcare" ## Is the Barrier Awareness or Staffing? Staffing, on the panel's account. Bruce Leong, Director of Technology and Strategy at Mount Alvernia Hospital, told the session that management now asks IT whether enough has been done on cyber protection, rather than needing to be convinced to invest at all. The harder problem is finding and keeping the people. "The challenge is no longer perception," he said, as reported by Hospital Management Asia. "The challenge is resources and manpower." Aslyn Koh, Chief Information Officer at Thomson Medical, described building the other half: governance, staff awareness programmes and phishing simulations, with training kept short enough to fit a clinician's day. The panel also discussed Singapore's Health Information Act, which Leong described as a useful framework for prioritising effort rather than a compliance burden. ## What Does a Hospital's Risk Have to Do With a Small Clinic? The report puts them in the same picture. It describes hospitals as depending on an ecosystem of vendors, device suppliers, specialist clinics and independent clinicians, and notes that many healthcare breaches now begin with a third party. Hospitals are responding with vendor assessments, access reviews and policies for clinicians who need occasional access to clinical systems. Our own observation, not the panel's: if a hospital with a CISO finds staffing the binding constraint, a six-person clinic in that same ecosystem has nobody in the role at all. That is the gap StrongKeep was built for, and it is why we work with healthcare clinics specifically. ## Read the Full Report on Hospital Management Asia Cindy Peh's report covers more than we have here, including how one hospital spent years removing uncontrolled vendor access to connected medical devices, and why the panel argued cyber resilience cannot sit with the technology team alone. Read it on Hospital Management Asia: Designing cyber-resilient healthcare, regulation as a catalyst for sector-wide change ## Related Reading - Addressing the Supply Chain Risk, on how an attacker reaches a large organisation through a smaller supplier. - Bank InfoSecurity: The Great Cyber Divide, on the gap between organisations that can staff security and those that cannot. ## Frequently Asked Questions Who was on the HealthTechX Asia 2026 panel on cyber-resilient healthcare? It was moderated by Gaurav Keerthi, CEO of StrongKeep and former Deputy Commissioner of Cybersecurity for Singapore. The panellists were Bruce Leong, Director of Technology and Strategy at Mount Alvernia Hospital, and Aslyn Koh, Chief Information Officer at Thomson Medical. Hospital Management Asia reported the session on 6 July 2026. Is the main barrier to healthcare cyber security awareness or staffing? Staffing, according to the hospital leaders on this panel. They described a shift in which boards and management now ask whether enough has been done, rather than needing persuading to spend. The reported difficulty is an ongoing shortage of cyber security talent, and the pressure of keeping up with a threat landscape that changes faster than a team can be hired. How does a hospital's cyber risk reach the clinics and suppliers around it? Through access. The report describes hospitals as dependent on vendors, medical device suppliers, specialist clinics and independent clinicians, with many healthcare breaches now beginning at a third party. Hospitals are responding by assessing suppliers, reviewing who can reach which systems, and writing policies for clinicians who need only occasional access. For a smaller practice, that means a hospital partner is increasingly likely to ask what protection is in place. ## What Does StrongKeep Do? StrongKeep is a self-serve cybersecurity platform for small and medium businesses. It bundles endpoint protection, phishing and malicious-link filtering, credential management, staff awareness training and phishing simulations, all run by the business itself from one dashboard. Compliance tooling is available on higher plans. StrongKeep holds the CSA Cyber Essentials Mark. Built for teams without an IT department. Plans are on the pricing page. StrongKeep on LinkedIn Follow StrongKeep for cybersecurity insights and updates → Gaurav Keerthi CEO and co-founder, StrongKeep. Former Deputy Chief Executive and Deputy Commissioner for Cyber at the Cyber Security Agency of Singapore, and former Chief Information Officer of the Republic of Singapore Air Force. He founded StrongKeep to build cybersecurity for the businesses the industry never designed for. ## Cyber security your clinic can actually run. Start today. Get Started from US$39 (S$49)/month Covers up to 5 devices. No IT team required. Cancel anytime. --- ### CyberSG Voices: Who Is Watching When an AI Agent Acts on Its Own? URL: https://www.strongkeep.com/news/cybersg-voices-agentic-ai/ Date: 2026-08-05 Author: CyberSG R&D Programme Office Category: Media Coverage StrongKeep CEO Gaurav Keerthi joins Nestria's Prity Jha and A*STAR's Dr Dinil Mon Divakaran on the CyberSG Voices vodcast, on autonomy, accountability, and what oversight should mean for a business with no security team. Media Coverage ## Who Is Watching When an AI Agent Acts on Its Own? StrongKeep CEO Gaurav Keerthi joined Prity Jha of Nestria AI and Dr Dinil Mon Divakaran of A*STAR on CRPO's CyberSG Voices vodcast. The question the episode opens with is the one every organisation deploying agents eventually reaches: when software starts acting on its own, who is actually accountable for what it does? August 5, 2026 CyberSG Voices, CyberSG R&D Programme Office Watch: CyberSG Voices, "Agentic AI in CyberSecurity" ## How Much Control Should an Autonomous System Have? Prity Jha framed the trade-off at the centre of the episode. Too much control and the system stops being autonomous at all. Too little and there is no basis on which to trust it. "If we have too much control then it loses its purpose and its objective, the meaning of autonomous. But if we do not have the control systems in place then we really don't have a way to know whether we can truly trust the system. The right way to go forward is to design systems which we can trust from the core, and hence the word for that is controlled autonomy." Prity Jha, co-founder and CEO of Nestria AI, on CyberSG Voices Her practical test is three questions asked of the design, not of the model: is the system governable in the first place, can it be monitored, and is there an ability to act on what the monitoring shows. Human approval, on her account, is one control gate among several rather than the only one worth having. ## Should a Small Business Have to Supervise Its Own AI? This is where the conversation matters most for the businesses we build for, and Gaurav's answer runs against the instinct that more human oversight is always better. He compares it to plumbing: there is a great deal of engineering behind it, and no plumber has ever explained any of it to a customer. "The end user does not need to understand how it works so long as it works. But there is a group of people who need to understand how it works." Gaurav Keerthi, CEO and co-founder of StrongKeep, on CyberSG Voices Asked directly who should be doing the supervising, he was specific about who his customers actually are. "The people that I'm solving a problem for don't have the time, talent, I mean technical talent, or budget to intervene in the oversight of the AI. These are layman users who operate bakeries, clinics, you know, law firms. They're not technical users who want to tune the model and refine how it's learning. They just want the thing to do the job it's paid to do." Gaurav Keerthi on CyberSG Voices The accountability does not disappear in that account. It moves. Governance sits with the people building and operating the system rather than being handed to a clinic owner as a dashboard they never asked for. Prity Jha made the complementary point that at the top of the pyramid there is still a human who has to answer for what an agent did, and that what "human in the loop" means depends entirely on whether you are talking about the builder, the adopter or the regulator. ## What Does a Rogue Agent Actually Look Like? Less cinematic than the phrase suggests, and more plausible. Asked whether his own agents could go rogue, Gaurav described a failure mode that comes from good intentions rather than malice. "It is entirely possible for some malicious person out there to trick my agents, to make it learn the wrong things, to make it confused and be overprotective. I can't destroy their offices. I can't burn down things, but I could fry all their laptops by accident. So that's the fear that I have, that with the best of intentions my systems will perform a set of actions that it thinks is doing the right thing but may end up doing fundamentally wrong things." Gaurav Keerthi on CyberSG Voices That is the near-term risk, on his account, and the killer-robot version is still some distance off. It is also the reason a defensive agent needs bounded permissions rather than unbounded good intentions. ## Are Attackers Moving Faster Than Defenders? Yes, and the panel was unanimous about why. Attackers have every incentive to adopt as fast as possible and no governance slowing them down. Dr Dinil Mon Divakaran put the change in plain terms. "We are going to have a relentless capability that is not tired, is not emotional, as an attacker, versus who was a human previously. What we have here is scale, which means efficiency at which you can create these attacks, and effectiveness." Dr Dinil Mon Divakaran, Senior Principal Scientist, A*STAR Institute for Infocomm Research Gaurav's account of governance frameworks was blunter: there is what we should do, what we can do, and what we actually do. Asked when attackers and defenders reach equilibrium, his answer was that they never do, because every adversarial system behaves like a chess game. ## What Are StrongKeep and A*STAR Building Together? Both Gaurav and Dr Divakaran discussed the research collaboration between StrongKeep and A*STAR, supported by CRPO. The premise is that affordable, continuous security for a small company cannot be reached by outsourcing to cheaper providers. "We have to redesign the very fundamental architecture of delivery and operations of cyber security for small companies. A company like StrongKeep understands this business problem, but we can't solve this problem on our own." Gaurav Keerthi on CyberSG Voices Dr Divakaran's description from the research side is that the two teams framed the problem together before the project was awarded, working from how the user experiences it, and that they continue to meet regularly for technical discussion. Both were clear that the work is early. ## Why This Argument Matters to Us Our own observation, not the panel's. Most of the agentic AI debate assumes an organisation with someone whose job is to supervise the system. The businesses we build for do not have that person, and never will. If the price of using AI safely is employing someone to watch it, then AI repeats the pattern that left smaller organisations unprotected in the first place. The interesting question is not how to give owners better oversight tools. It is how little oversight a system can require and still be safe. Gaurav closed on the same point from the other direction. "Cyber security used to be a luxury good. It's something that only the enterprises and the biggest companies in the world could afford. With AI and agentic AI, we now have a real opportunity to democratise access, to give the smallest guys a chance at using these tools to keep themselves safe." Gaurav Keerthi on CyberSG Voices ## Where Can I Watch the Full Episode? The episode runs 38 minutes and is on the CyberSG R&D Programme Office's YouTube channel. Not covered above: the panel on standards and why a one-year-old ISO standard may already be outdated, observability and attribution across a chain of agents, and the point at which a self-driving car should stop letting a human take the wheel. - CyberSG Voices: Agentic AI in CyberSecurity, CyberSG R&D Programme Office, 27 July 2026 - CyberSG R&D Programme Office, the national programme office at NTU ## Related Reading - Why don't smaller businesses have cybersecurity?, Gaurav in e27 on why the supply side was never built. - What does the 'IKEA of cyber security' mean for a smaller business?, on BFM 89.9, on security a non-specialist can operate. - The Great Cyber Divide, on the gap between organisations that can staff security and those that cannot. ## Frequently Asked Questions Who is on the CyberSG Voices episode about agentic AI? Three guests. Gaurav Keerthi, CEO and co-founder of StrongKeep; Prity Jha, co-founder and CEO of Nestria AI; and Dr Dinil Mon Divakaran, Senior Principal Scientist at the A*STAR Institute for Infocomm Research. The episode was produced by the CyberSG R&D Programme Office at NTU and published on 27 July 2026. It runs 38 minutes. What is controlled autonomy? It is Prity Jha's framing of the central trade-off on the panel. Her point is that too much control defeats the purpose of an autonomous system, while too little leaves no way to know whether the system can be trusted. Her answer is to design systems that are governable from the core, with human approval treated as one control gate among several rather than the only one. Does a small business need to supervise its own AI? Gaurav Keerthi's position on the panel is that in most cases it should not have to. He describes StrongKeep's users as people who run bakeries, clinics and law firms, who have neither the technical talent nor the budget to intervene in how a model behaves, and who want the tool to do the job it is paid to do. His argument is that accountability and governance still matter, but that they belong on the engineering side rather than being handed to the end user. What does a rogue AI agent actually look like in cybersecurity? Less dramatic than the film version, and more plausible. Gaurav's stated concern is a defensive agent that is tricked into learning the wrong things and becomes overprotective, then takes a set of actions it believes are correct that turn out to be damaging, such as disconnecting a company's laptops. He describes this as the near-term risk, and says the industry is still some way from the killer-robot scenario. Are attackers or defenders moving faster with AI? Attackers, on the panel's account, because their incentive is to adopt as fast as possible with no governance to slow them down. Dr Dinil Mon Divakaran describes AI as giving the attacker a relentless capability that does not tire, adding both scale and effectiveness. Asked when the two sides reach equilibrium, Gaurav's answer was that they never do, because an adversarial system behaves like a chess game. Is StrongKeep working with A*STAR on agentic AI? Yes. StrongKeep and A*STAR are collaborating on a research project supported by the CyberSG R&D Programme Office, which both Gaurav Keerthi and Dr Dinil Mon Divakaran discuss on the episode. Gaurav's account is that delivering continuous, affordable security to a small company requires redesigning the architecture of how security is delivered, which is not a problem StrongKeep can solve alone. Both describe the work as early. ## What Does StrongKeep Do? StrongKeep is a self-serve cybersecurity platform for small and medium businesses. It bundles endpoint protection, phishing and malicious-link filtering, credential management, staff awareness training and phishing simulations, all run by the business itself from one dashboard. Compliance tooling is available on higher plans. StrongKeep holds the CSA Cyber Essentials Mark. Built for teams without an IT department. Plans are on the pricing page. StrongKeep on LinkedIn Follow StrongKeep for cybersecurity insights and updates → Gaurav Keerthi CEO and co-founder, StrongKeep. Former Deputy Chief Executive and Deputy Commissioner for Cyber at the Cyber Security Agency of Singapore, and former Chief Information Officer of the Republic of Singapore Air Force. He founded StrongKeep to build cybersecurity for the businesses the industry never designed for. ## Security your business can actually run, without a security team. Get Started from US$39 (S$49)/month Covers up to 5 devices. No IT team required. Cancel anytime. --- ## Company ### About Us URL: https://www.strongkeep.com/about/ We believe that all organisations should be able to afford cybersecurity solutions to safeguard their businesses from cyberattacks. ## This is our story. We are reinventing how cybersecurity is delivered, to provide a cost-effective and scalable offering to small and medium-sized businesses (SMBs) that meets their needs and safeguards their businesses from cyberattacks. The challenges faced by SMBs, including limited budgets and being unable to hire dedicated cybersecurity professionals, inspired us to bridge this gap. Get Started ## Meet the Knights: What makes us different ## Ownership We serve with the duty of loyal stewards, taking initiative and responsibility, charting our course wisely, acting with valour, and bearing both triumph and trial. ## Openness / Transparency We hold honest conversations to high standards, trusting our fellow knights to challenge ideas boldly, voice concerns, and rally on what matters. ## Curiosity We continually question conventional practices, unafraid to thread the unbeaten path, and daring to explore noble quests in pursuit of better solutions. ## About our founder Leadership Gaurav Keerthi CEO (Knight) of StrongKeep Gaurav leads a team focused on making cybersecurity accessible to small businesses. At StrongKeep, he brings depth of experience together with a startup mindset (and a sense of humour) to deliver a unified platform for compliance certification, protection, and cyber insurance, built for speed, scale, and simplicity. His previous roles include Executive Vice President at Ensign InfoSecurity, Deputy Commissioner of Cybersecurity and Chief Executive of Singapore's Cyber Security Agency, and CIO of the Republic of Singapore Air Force (as a Brigadier General). He is currently the co-founder of the national tech-for-good charity better.sg. Gaurav serves as an invited expert to the United Nations on emerging digital threats, a Senior Adjunct Fellow at Nanyang Technological University's S. Rajaratnam School of International Studies, and a former member of the World Economic Forum's Global Futures Council on Cybersecurity. ## Hackers aren't waiting. Protect your business before it's too late! Get Started --- ### Contact Us URL: https://www.strongkeep.com/contact-form/ Get in touch with StrongKeep for cybersecurity solutions. ## Contact Us Have questions about StrongKeep? We'd love to hear from you. Fill out the form below and our team will get back to you shortly. ## Other Ways to Reach Us ## Email support@strongkeep.com ## Location Singapore ## Help Center Visit Help Center ## Follow Us ## Ready to secure your business? Get Started --- ### Partners URL: https://www.strongkeep.com/partners/ Partner with StrongKeep to expand your offerings and drive business growth. ## Grow your business as a StrongKeep Partner Unlock new opportunities to serve your customers with StrongKeep. Partner with us to provide them with seamless cybersecurity solutions, lower your costs, and increase your margins. ## Our Partners ## Why partner with us? ## Drive More Growth Working with StrongKeep will enable you to build a deeper relationship with your customers, driving more revenue to you and more value to them. ## Own Cyber Outcomes Cybersecurity is no longer optional: your clients expect it and regulators require it. With StrongKeep, it's as simple as plug, play, and protect. ## One Platform, Total Control Easily manage your clients' entire cybersecurity lifecycle with StrongKeep's intuitive platform, keeping them compliant, protected, and audit-ready year-round. ## How to partner with us? ## Multi-entity Discount Programme Unlock savings through bulk licensing, giving parent companies or portfolio owners a cost-effective way to equip all subsidiaries or child entities with consistent baseline protection and insurance coverage (to reduce your overall risk exposure). Partner With Us ## How does the program work? - 1Receive your unique discount code after you have been onboarded. - 2Share this discount code with your subsidiaries or child entities. - 3Companies will receive the discounted price upon checkout. - 4As the parent / portfolio company, you will be able to get regular reports on the progress / status of each subsidiary. ## Managed Service Provider Programme For IT Vendors, expand your range of services to include cybersecurity and manage your customers' StrongKeep accounts on their behalf. For CISOaaS providers, go beyond the consulting and help your customers manage their ongoing cyber tasks. Partner With Us ## How does the program work? - 1Apply for a MSP account. - 2Go through our verification process and create a new StrongKeep account on behalf of each customer. - 3As the MSP provider, you can help your customer get cybersecurity compliance, 24/7 protection, and insurance seamlessly. ## Hackers aren't waiting. Protect your business before it's too late! Get Started ---