PSG Cybersecurity Grant: 4 Pre-Approved Vendor Categories SMEs Should Know in 2026

If you’ve heard about the PSG cybersecurity grant but find the IMDA pre-approved solutions list overwhelming, you’re not alone. Singapore SMEs routinely tell us they gave up halfway through the Business Grants Portal because the categories felt too technical or too vague.

This explainer breaks the cybersecurity portion of the Productivity Solutions Grant into the four vendor categories that actually matter for most SMEs — what each one solves, who needs it most, and how it stacks against your Cyber Trust Mark or ISO 27001 goals.

1. Email Security and Anti-Phishing Platforms

Phishing remains the #1 entry vector for ransomware in Singapore SMEs. The PSG-eligible solutions in this category typically scan inbound email for malicious attachments, suspicious links, and impersonation attempts before they hit your team’s inbox.

Who needs it most: Any business with public-facing email addresses (info@, sales@, hello@) or staff handling supplier invoices. Office 365 and Google Workspace built-in filters catch the obvious stuff, but business email compromise scams routinely slip through.

Typical PSG-supported spend: S$3,000–8,000/year per organisation, with up to 50% subsidy.

2. Endpoint Detection and Response (EDR)

Traditional antivirus relied on known-malware signatures. EDR is the modern replacement — it watches what’s actually happening on every laptop and server (process behaviour, registry changes, network calls) and isolates anomalies in real time. PSG-pre-approved EDR solutions usually include managed monitoring, so you’re not on the hook for analysing alerts yourself.

Who needs it most: Any business with more than 5 endpoints, especially if you handle client data, payment information, or proprietary IP. EDR is also a near-mandatory control under ISO 27001 Annex A and the Cyber Trust Mark Tier 2+.

Typical PSG-supported spend: S$5,000–15,000/year, depending on endpoint count.

3. Backup and Disaster Recovery

If ransomware encrypts your file server tomorrow, can you restore everything in under 24 hours without paying? If the answer is “I’m not sure,” PSG-eligible backup-and-DR solutions are the most cost-effective subsidy you’ll find this year. The pre-approved vendors offer immutable backups (the kind ransomware can’t overwrite), automated daily snapshots, and tested restore procedures.

Who needs it most: Any business storing client records, financial data, or operational documents on local servers, NAS devices, or cloud platforms. SMEs in regulated industries (healthcare, finance, professional services) face additional retention obligations under PDPA and sector-specific rules.

Typical PSG-supported spend: S$2,500–6,000/year for cloud backup; higher for full-disaster-recovery-as-a-service.

4. Cybersecurity Gap Assessments and Audits

This is the consultancy-flavoured category and often the least understood. PSG covers gap-assessment work where a qualified consultant maps your current controls against a recognised framework (Cyber Trust Mark, ISO 27001, NIST CSF), then produces a remediation roadmap with prioritised action items.

Who needs it most: SMEs preparing for client audits, tender submissions requiring cybersecurity attestation, or pursuing Cyber Trust Mark certification. A proper gap assessment is also the foundation document insurers increasingly request before issuing cyber liability cover.

Typical PSG-supported spend: S$4,000–12,000 per engagement (one-time, not annual).

How to combine PSG with Cyber Trust Mark or ISO 27001

The single biggest leverage move SMEs miss: PSG can fund the controls you need to achieve certification, not just operational tools. A common stack we recommend for businesses pursuing Cyber Trust Mark Tier 2:

• Email security platform (PSG-funded) — addresses phishing controls
• EDR with managed monitoring (PSG-funded) — addresses malware and incident detection controls
• Cloud backup with immutability (PSG-funded) — addresses data protection and recovery controls
• Gap assessment (PSG-funded) — produces the documentation auditors expect

Roughly S$15,000–35,000 of cybersecurity investment, half of which is recoverable through PSG, that simultaneously builds the evidence trail for certification.

What PSG does NOT cover

To save you time digging through portal terms:

• One-off penetration tests or VAPTs (these are usually billable separately to clients/auditors anyway)
• In-house staff salaries, even for cybersecurity roles
• Hardware purchases beyond what’s bundled with the pre-approved software solution
• Non-pre-approved vendors, even if they’re highly rated — vendor must be on IMDA’s list
• Renewals beyond the first claim cycle (one PSG claim per solution, per business)

Frequently asked questions

Can a sole proprietor or partnership claim PSG cybersecurity grant?

Yes. Singapore-registered SMEs across all entity types qualify, provided they meet the size thresholds (group annual sales ≤ S$100M or group employment ≤ 200) and have at least 30% local shareholding.

How long does the PSG application typically take?

Most cybersecurity-category applications are processed within 4–6 weeks from submission to approval. Disbursement happens after the solution is implemented and the claim form is submitted with proof of payment. Build a 2–3 month timeline if you’re sequencing this around a Cyber Trust Mark audit.

Do I need a Cyber Trust Mark to apply for PSG cybersecurity?

No. PSG applies independently. Many SMEs use PSG-funded tools as the first step toward later Cyber Trust Mark certification, but the grant doesn’t require any prior certification.

Can I claim PSG twice for the same vendor?

No — IMDA’s rule is one claim per pre-approved solution per business. If you outgrow your initial subscription tier and upgrade with the same vendor, the upgraded portion isn’t separately claimable.

What happens if my PSG-funded solution is later discontinued by the vendor?

Your claim isn’t reversed. You’re free to migrate to another solution at your own cost or apply PSG to a different category that you haven’t yet claimed.

Next step

If you’re already evaluating cybersecurity tools for your business, getting the PSG layer right can mean the difference between a S$30,000 budget and a S$15,000 net cost. Sage Shield runs no-cost initial scoping calls to map which categories your business should claim against your wider cybersecurity or compliance roadmap.

Talk to us: WhatsApp +65 8332 8220 or call +65 8332 8220. Mention “PSG cybersecurity” and we’ll start with the eligibility-and-categories scoping conversation, no obligation.