Your clinic's HIA cybersecurity plan, with up to 70% co-funding for eligible SMEs

CISOaaS for Health Information Act (HIA) Cybersecurity and Data Security Essentials. StrongKeep is a CISO-as-a-Service (CISOaaS) consultant onboarded by the Cyber Security Agency of Singapore (CSA).

From S$2,448 for 1 to 5 endpoints, before funding. As little as S$734 for eligible SMEs, subject to CSA approval.

Get briefed

Nothing is paid and no work starts until CSA approves.

A smiling healthcare professional in scrubs holding a clipboard in a clinic, with a laptop showing the StrongKeep logo on the desk beside her

Your deadline depends on your licence

MOH sets a deadline to put the Cybersecurity and Data Security (CS/DS) measures in place for each type of Healthcare Services Act (HCSA) licence. Check your HCSA licence to see which applies.

  1. Sep 2027 GP clinics Outpatient Medical Service
  2. Sep 2028 Specialist outpatient Also licensees not listed in Table 1
  3. Mar 2030 Dental clinics Outpatient dental

Deadline to put the CS/DS measures in place, by HCSA licensed service type. Source: MOH circular MOH-MHC-Cir-0018/2026, Table 1.

What you get, and who decides

What you get

A cybersecurity health plan for your clinic

A consultancy service, with CSA funding support, pre-scoped to align to the measures in the HIA Cybersecurity and Data Security Essentials. StrongKeep develops a cybersecurity health plan to help your clinic comply with these requirements.

Source: IMDA's SMEs Go Digital listing. The package is consultancy and the plan only. It does not include StrongKeep's security tools.

Who decides

MOH, not StrongKeep

Only MOH decides whether a clinic meets the HIA. The CS/DS Essentials allow self-assessment, and certification is not required. The plan helps you put the measures in place and know where you stand.

How it works

Four steps. Nothing is paid and no work starts until CSA approves.

  1. 1

    You + StrongKeep

    Get briefed

    The briefing explains the scheme, checks you are likely to qualify and finds your package.

    Get briefed
  2. 2

    You

    Apply on SMEs Go Digital

    Select our package and submit the CISOaaS declaration form, in one sitting. It cannot be saved as a draft.

  3. 3

    CSA

    Wait for approval

    Do not accept a quote, pay or let any work start until CSA approves. Starting early can void your funding.

  4. 4

    StrongKeep

    Receive your cybersecurity health plan

    Once CSA approves, StrongKeep delivers the plan, aligned to MOH's CS/DS Essentials.

Packages

CISOaaS for Health Information Act (HIA) Cybersecurity and Data Security Essentials, one package per endpoint range, listed on SMEs Go Digital. Prices are the list price before funding. Eligible SMEs can get up to 70% co-funding, cited to MOH circular MOH-MHC-Cir-0018/2026 para 10(b). CSA sets the funded amount when it approves your application.

An endpoint is each laptop, desktop, server, phone or tablet your clinic uses for work.

Endpoints List price before funding
1 to 5 endpoints S$2,448
6 to 10 endpoints S$2,802
11 to 20 endpoints S$3,630
21 to 50 endpoints S$6,114
51 to 100 endpoints S$10,254
101 to 200 endpoints S$18,534
More than 200 endpoints Talk to us

Go through the briefing before you apply. StrongKeep needs to brief you first.

Already using StrongKeep, or want the tools now?

The Protection Plan is our subscription for the security tools. CSA co-funding covers this one-time consultancy only, not monthly plans.

See how the Protection Plan helps clinics get HIA-ready

Used by Singapore clinics including

  • Neumark Surgery
  • Apex Heart Clinic
  • WC Ong Plastic Surgery
  • Skin Health Singapore

Trusted by clinics and the people who brief them

"I now have a robust solution in place. This goes well beyond basic antivirus protection."
Dr HarishNeumark Surgery
Read the Neumark Surgery case study
Speaking

Briefing clinics, hospitals and medical associations

Gaurav Keerthi, CEO of StrongKeep and former Deputy Commissioner of Cybersecurity for Singapore, has been invited to brief SingHealth, Farrer Park Hospital, Mount Elizabeth Hospital, HealthTechX, AsiaMD and the GP+ Cooperative on the Health Information Act and clinic cyber risk.

Questions clinics ask us

Does this mean my clinic meets the HIA?

No. You get a cybersecurity health plan aligned to MOH's CS/DS Essentials, which helps your clinic put the measures in place. Only MOH decides whether a clinic meets the HIA.

Do I need certification?

No. The CS/DS Essentials allow self-assessment (measure C.7), and certification is not required.

When is my deadline?

It depends on your HCSA licensed service type. The deadline to put the CS/DS measures in place is September 2027 for GP clinics (Outpatient Medical Service), September 2028 for specialist outpatient, and March 2030 for outpatient dental. Licensees not in Table 1 have until September 2028 (MOH circular MOH-MHC-Cir-0018/2026). Check your HCSA licence.

Can I pay or start before CSA approves?

No. Nothing is paid and no work starts until CSA approves. Do not accept a quote or sign anything before then. Starting early can void your funding.

Who applies, you or us?

Your clinic applies. StrongKeep briefs you first, then you select our package on SMEs Go Digital and submit the CISOaaS declaration form in one sitting. CSA decides on the application.

What counts as an endpoint?

Each laptop, desktop, server, phone or tablet your clinic uses for work. Packages are priced by endpoint count.

What if we have more than 200 endpoints?

There is no listed package above 200 endpoints. Talk to us and we will go through the options with you.

Questions first?

If the briefing has not answered your question, leave your details and we will email you. Tell us roughly how many devices your clinic uses.

Your HIA CISOaaS briefing

StrongKeep needs to brief you before you apply. This is that briefing: how the scheme works, in plain English, ending with the SMEs Go Digital application. Confirm each point to move on. Nothing you answer is sent to us or stored.

Step 1 of 7

1 What CISOaaS is and what CSA funds

CISOaaS means CISO-as-a-Service: a provider such as StrongKeep does the work a chief information security officer would do for you, without hiring one. Under CSA's scheme, that work gives your clinic a cybersecurity health plan aligned to MOH's Cybersecurity and Data Security (CS/DS) Essentials under the Health Information Act (HIA).

Eligible SMEs can get up to 70% co-funding from CSA. Funding is subject to CSA approval, and CSA sets the funded amount, so you will not know it until CSA approves.

Funding is up to 70% for eligible SMEs, subject to CSA approval.

2 Who qualifies

These conditions come from CSA's declaration form. You need a Yes to all four to continue.

Is your company registered and operating in Singapore?
Is your group annual turnover S$100 million or less?
Is your group employment size 200 or fewer?
Do Singaporeans or Singapore PRs hold at least 30% of your company's shares?

3 Independence

CSA does not fund a project where the customer and the provider are connected through ownership or family ties. For example, a director or shareholder of your company is a relative of a StrongKeep director or shareholder, or StrongKeep (or its directors or shareholders) owns shares in your company.

Is there any such connection?

4 Timing: wait for CSA approval

Do not accept a quote, sign anything, pay or let any work start before CSA has approved your application. If you do, the project counts as started, which can void your funding.

Nothing starts until CSA approves.

5 What the application asks

You apply on SMEs Go Digital by selecting our package, signing in and submitting the CISOaaS declaration form. It must be done in one sitting and cannot be saved as a draft, so have these ready:

  • Company type
  • Group annual turnover and employment size
  • Local shareholding percentage
  • Mailing address and company email
  • The applicant's name, designation and contact details

You will also be asked to make declarations. In summary, these include that:

  • You are not receiving other government funding for this project.
  • You will keep records for 5 years.
  • You will use the services in Singapore for at least 12 months after.
  • You will cooperate with CSA audits and surveys.
  • You will pay the full cost if you are found ineligible.

Read the exact wording on the form itself before you submit.

Application details and declarations understood.

6 What happens after approval

Your cybersecurity health plan. Once CSA approves, StrongKeep delivers a cybersecurity health plan aligned to MOH's CS/DS Essentials. It helps your clinic put the measures in place.

Who decides. Only MOH determines whether a clinic meets the HIA. The CS/DS Essentials allow self-assessment, and StrongKeep does not certify you.

StrongKeep delivers the health plan. Only MOH decides whether a clinic meets the HIA.

7 Your summary and package

An endpoint is each laptop, desktop, server, phone or tablet your clinic uses for work. Packages are priced by endpoint count.

Still have questions? Contact us before you apply.