Cybersecurity Labelling Requirements for Residential Routers
The Cyber Security Agency of Singapore (CSA), in collaboration with the Infocomm Media Development Authority (IMDA), oversees the cybersecurity standards for Internet-of-Things (IoT) devices. This includes the mandatory Cybersecurity Labelling Scheme (CLS) for residential routers sold in Singapore.
Regulatory Update and Transition
The Singapore government has announced an upgrade to the mandatory cybersecurity requirements for residential routers. The requirement will transition from CLS Level 1 to CLS Level 2. This modification is intended to address sophisticated cyber threats targeting encryption, authentication, and data storage.
Effective Date: The new requirements are expected to come into force by the end of 2027.
Scope: All residential routers intended for sale in the Singapore market.
Requirements for Testing and Conformity
To obtain certification and the corresponding CLS label, devices must undergo assessment based on the tiered labelling system. Manufacturers must ensure routers meet the following criteria:
Level 1 (Existing Requirements): Includes unique default passwords, active vulnerability management processes, and provision of regular software updates.
Level 2 (Upcoming Mandatory Requirements): In addition to Level 1 criteria, devices must incorporate:
Secure communications protocols.
Secure storage of sensitive data.
Robust authentication mechanisms to protect user data and privacy.
Application and Submission
Manufacturers must apply through the CSA to have their products rated and labeled under the tiered system. While Level 1 is currently the baseline for market entry, manufacturers are encouraged to begin aligning production with Level 2 standards ahead of the 2027 deadline. The process involves demonstrating that the device meets the technical security measures defined by the CSA.
Contact Information
For further information on the Cybersecurity Labelling Scheme and submission procedures, manufacturers may contact the relevant authorities:
Regulatory Body: Cyber Security Agency of Singapore (CSA).
Collaboration Partner: Infocomm Media Development Authority (IMDA).
Online Resources: The CSA Internet Hygiene Portal and official press releases for updated technical guidelines.
