PSG Cybersecurity Grant Singapore 2026: SME Funding Guide

What Is the PSG Cybersecurity Grant?

The Productivity Solutions Grant (PSG) is a government co-funding initiative designed to help Singapore SMEs adopt pre-scoped, proven IT solutions and equipment that enhance productivity, efficiency, and resilience. Within the PSG framework, cybersecurity solutions occupy a dedicated category, reflecting the government’s recognition that digital security is foundational to business continuity and competitiveness in today’s economy.

Under the PSG cybersecurity stream, eligible companies can claim funding support for:

• Pre-approved cybersecurity solutions listed on the IMDA Solutions Map, spanning endpoint protection, network security, email security, managed detection and response (MDR), and more.
• Qualifying hardware and software bundled within approved solution packages, provided they meet IMDA’s technical and vendor criteria.
• Implementation and training costs directly tied to the deployment of the approved solution, ensuring your team can operate and maintain the technology effectively.

Importantly, PSG cybersecurity funding is not a loan—it is a grant that does not require repayment, making it one of the most accessible financing mechanisms for SMEs looking to close security gaps quickly and affordably.

Eligibility Criteria for PSG Cybersecurity Grant Singapore

To qualify for PSG support for cybersecurity solutions, your business must meet the following baseline requirements:

Business Registration and Operations

• Registered and operating in Singapore: Your company must be registered with the Accounting and Corporate Regulatory Authority (ACRA) or the relevant Unique Entity Number (UEN) issuance agency.
• At least 30% local shareholding: Singapore Citizens or Singapore Permanent Residents must collectively hold at least 30% of the company’s shares at the point of application.
• Purchase and use the solution in Singapore: The cybersecurity solution must be deployed and utilised within Singapore for business operations conducted in Singapore.

Company Size and Revenue

• Group annual sales turnover not exceeding S$100 million or group employment size not exceeding 200 employees (whichever threshold is met first qualifies the company as an SME).
• Turnover and headcount are assessed at the group level, including related entities and subsidiaries.

Financial Standing

• The company must be in a financially viable position to co-fund and sustain the solution beyond the grant period.
• Companies under judicial management, in receivership, or undergoing winding-up proceedings are typically ineligible.

Solution-Specific Requirements

• The cybersecurity solution must be sourced from an IMDA pre-approved vendor and listed on the official PSG Solutions Map (accessible via the Business Grants Portal).
• The solution package, pricing, and scope must align with the pre-scoped parameters published by IMDA—customisations beyond the approved scope may not qualify for funding.

Pro tip: If your business operates multiple entities or subsidiaries, consolidate your cybersecurity procurement under the most appropriate entity to streamline grant administration and maximise co-funding efficiency.

IMDA Pre-Approved Cybersecurity Solution Categories

IMDA curates a dynamic list of PSG-supported cybersecurity solutions, updated periodically to reflect emerging threats and technology advancements. As of 2026, the major solution categories include:

Important: Not all cybersecurity products on the market qualify for PSG funding. Only solutions listed on the IMDA PSG Solutions Map—offered by pre-approved vendors at pre-negotiated pricing—are eligible. Always verify a solution’s PSG eligibility on the Business Grants Portal before committing to a purchase.

How to Apply for the PSG Cybersecurity Grant: Step-by-Step

Applying for PSG cybersecurity funding is a structured, online process. Follow these steps to ensure a smooth application experience:

Step 1: Identify Your Cybersecurity Needs

Conduct an internal security assessment or engage a qualified consultant to pinpoint your most critical vulnerabilities. Prioritise solutions that address high-impact risks—such as ransomware protection, email security, or network segmentation—and align with your broader cybersecurity compliance and certification roadmap.

Step 2: Search the PSG Solutions Map

Visit the Business Grants Portal and navigate to the PSG Solutions Map. Filter by “Cybersecurity” to browse pre-approved solutions. Review solution descriptions, vendor profiles, indicative pricing, and grant support levels. Shortlist 2–3 solutions that match your requirements and budget.

Step 3: Request Quotations from Pre-Approved Vendors

Contact the vendors offering your shortlisted solutions. Request detailed quotations that itemise hardware, software, implementation, training, and any recurring subscription fees. Ensure the quotation references the PSG solution package code and confirms eligibility for grant support.

Step 4: Submit Your PSG Application Online

Log in to the Business Grants Portal using your CorpPass credentials. Complete the PSG application form, providing:

• Company details (UEN, shareholding structure, financial standing)
• Solution details (vendor name, solution package code, quotation)
• Project timeline and deployment plan
• Supporting documents (e.g., ACRA business profile, vendor quotation, proof of local shareholding)

Double-check all information for accuracy—incomplete or inconsistent applications may be rejected or delayed.

Step 5: Await Grant Approval

IMDA and Enterprise Singapore typically process PSG applications within 4–8 weeks, though timelines vary based on application volume and complexity. You will receive an approval letter via email, specifying the approved grant amount, validity period, and any conditions.

Step 6: Procure and Deploy the Solution

Once approved, proceed to purchase and implement the solution within the grant validity period (usually 6–12 months from approval date). Work closely with your vendor to ensure timely deployment and user training.

Step 7: Submit Claims and Documentation

After implementation, submit a claims package via the Business Grants Portal, including:

• Proof of payment (invoices, receipts, bank statements)
• Proof of delivery and installation (vendor sign-off, deployment reports)
• Training records (attendance sheets, training completion certificates)

Upon verification, the grant disbursement will be credited to your company’s bank account, typically within 4–6 weeks of claims approval.

How PSG Cybersecurity Complements ISO 27001, Cyber Trust Mark, and EDG

PSG cybersecurity funding does not operate in isolation—it integrates strategically with other government schemes and industry certifications to create a holistic security and compliance framework for SMEs.

PSG + ISO 27001 Certification

Many SMEs pursue ISO 27001 certification in Singapore to demonstrate robust information security management to clients, partners, and regulators. PSG-funded solutions—such as endpoint protection, network security, and IAM—directly support the technical controls required under ISO 27001 Annex A. By deploying PSG-approved technologies, you build the infrastructure necessary to meet ISO 27001 audit requirements, reducing the time and cost to certification.

Strategic tip: Engage an ISO 27001 consultant early in your PSG planning process to ensure your chosen solutions align with the standard’s control objectives and evidence requirements.

PSG + CSA Cyber Trust Mark

The Cyber Security Agency of Singapore’s Cyber Trust Mark is a consumer-facing certification that signals your organisation’s commitment to cybersecurity best practices. Achieving the Cyber Trust Mark often requires implementing specific security controls—many of which are available as PSG-supported solutions (e.g., email security, endpoint protection, vulnerability management). Leveraging PSG funding to deploy these controls accelerates your path to Cyber Trust Mark certification while minimising upfront investment.

PSG + Enterprise Development Grant (EDG)

While PSG covers pre-approved, off-the-shelf solutions, the Enterprise Development Grant (EDG) supports customised projects, including bespoke cybersecurity consultancy, security architecture design, and incident response planning. SMEs often combine PSG and EDG strategically:

• Use PSG to fund core technology deployments (firewalls, EDR, email security).
• Use EDG to fund consultancy services that design your overall security strategy, conduct risk assessments, or develop incident response playbooks.

This dual-grant approach maximises government co-funding while ensuring both technology and governance layers are addressed comprehensively.

Common Mistakes to Avoid When Applying for PSG Cybersecurity Grants

Even experienced IT managers and business owners can stumble during the PSG application process. Avoid these pitfalls to improve your approval odds and streamline disbursement:

1. Purchasing Before Approval

Critical rule: Do not purchase or deploy the solution before receiving official PSG approval. Retrospective claims are not permitted—any costs incurred prior to the approval date are ineligible for grant support.

2. Choosing Non-Pre-Approved Solutions

Only solutions listed on the IMDA PSG Solutions Map qualify for funding. Even if a vendor offers a superior or cheaper alternative, it will not receive grant support unless it appears on the official list. Always verify eligibility before committing.

3. Incomplete or Inconsistent Documentation

Missing documents, mismatched company names, or inconsistent financial data can trigger application rejections or delays. Prepare a checklist of required documents and cross-verify all details before submission.

4. Ignoring Grant Validity Periods

PSG approvals come with a validity window (typically 6–12 months). If you fail to procure and deploy the solution within this period, your approval lapses, and you must reapply. Plan your procurement and implementation timeline realistically.

5. Underestimating Training and Change Management

PSG funding often includes training costs—yet many SMEs skip or rush user training, leading to poor adoption and security gaps. Allocate sufficient time and resources for training to ensure your team can operate the solution effectively.

6. Overlooking Recurring Costs

PSG covers upfront costs (subject to current IMDA cap), but many cybersecurity solutions involve ongoing subscription or maintenance fees. Budget for these recurring costs to avoid financial surprises post-deployment.

Maximising ROI from Your PSG Cybersecurity Investment

Securing PSG funding is just the beginning. To extract maximum value from your cybersecurity investment:

• Integrate solutions with existing systems: Ensure your PSG-funded tools integrate seamlessly with your IT environment (e.g., Active Directory, cloud platforms, SIEM) to avoid siloed security.
• Establish clear security policies: Technology alone cannot protect your business—pair your PSG solutions with documented policies, user awareness training, and incident response procedures.
• Monitor and tune continuously: Cybersecurity is not “set and forget.” Regularly review logs, alerts, and reports from your PSG-funded solutions, and adjust configurations to address evolving threats.
• Leverage vendor support: Most PSG-approved vendors offer post-deployment support, health checks, and updates. Engage proactively with your vendor to stay current on patches, threat intelligence, and best practices.
• Plan for scalability: As your business grows, your cybersecurity needs will evolve. Choose PSG solutions that scale with your organisation, and revisit the PSG Solutions Map periodically for new offerings.

Frequently Asked Questions (FAQ)

Take the Next Step: Secure Your PSG Cybersecurity Funding Today

The PSG cybersecurity grant Singapore programme represents a rare opportunity for SMEs to deploy enterprise-grade security solutions at a fraction of the cost, backed by government co-funding and pre-vetted vendor expertise. Whether you’re addressing immediate threats like ransomware and phishing, building toward ISO 27001 certification, or pursuing the CSA Cyber Trust Mark, PSG funding can accelerate your journey while preserving capital for other strategic investments.

Yet navigating the PSG application process—from solution selection and vendor engagement to documentation and claims—requires careful planning and domain expertise. A misstep at any stage can delay funding, disqualify your application, or leave you without the protection you need.