SQEP-led, independent cyber resilience for Singapore CII and enterprise across APAC
SQEP-led, independent cyber resilience for Singapore CII and enterprise across APAC
Independent first-party and second-party audits, as a single engagement or an annual programme. A readiness assessment where nothing is written down yet, an internal audit where a management system is running, and supplier audits carried out on your behalf. Cyber Trust mark, Cyber Essentials, ISO/IEC 27001, ISO/IEC 42001, MAS TRM, PDPA.
A first-party audit (internal audit) is carried out by, or on behalf of, the organisation itself to check its own controls. A second-party audit (supplier audit) is carried out by a party with an interest in the organisation, such as a customer, or by someone acting for that customer. A third-party audit is carried out by an independent certification body or a regulator. Infracom delivers the first two. Its auditors check your controls against a named standard, contract or policy, report what they find to your management, and take no part in fixing what they audit. Infracom is not a certification body: where you want a mark or a certificate, Infracom gets you ready for the body that awards it. Audit is the independent review tier of Infracom's three-tier model: the auditor reads the advice and the test evidence but produced neither.
An audit is the last of three stages: build, validate, assure. It gives an independent opinion on work that other people built and tested. On its own it finds the gaps. With the other Infracom services, the gaps are closed, tested and then audited.
Set the rules, close the gaps and keep the programme running.
GRC consulting →Policies, risk and the framework your customer or regulator names.Fractional CISO →Runs your whole security programme.Fractional Chief AI Officer →Runs the governance of your AI.Data Protection Officer →Holds the personal data part, under the PDPA.SQEP →Endorses the security design of Government and critical infrastructure systems.Prove on the real systems that the controls hold.
VAPT →Certified testers attack your systems and report what they find, then retest the fixes.SQEP testing and go-live endorsement →For Government and critical infrastructure systems, the test scope and the go-live are endorsed.An independent opinion your board, customers and regulators can rely on.
One rule holds from start to end: the people who build do not test, and the people who build or test do not give the opinion. See how Infracom keeps the three apart →
Three kinds of work, chosen by where you are today. An audit needs something to audit against, so the first question is always the same: which standard, contract or policy are the controls being checked against?
For organisations with no policies and no management system. The auditors look at how things are really done and assess that against a published standard chosen with you. The result is a list of gaps and a plan, not a pass or a fail. The gaps are then closed through GRC consulting or by a fractional CISO, and the finished work comes back for an internal audit.
For organisations that already operate a management system or a control framework. An audit programme, sampled evidence, nonconformities and observations, and a report that feeds your management review. The auditor reads the latest penetration test report as evidence, and checks the work of whoever runs the programme, your own team or an Infracom fractional CISO, Chief AI Officer or Data Protection Officer.
For organisations that depend on vendors, outsourcers or system integrators. Infracom audits the supplier for you against your contract, your questionnaire or a named standard, and gives you a rated report you can act on. Where the supplier handles personal data for you, the report also goes to your Data Protection Officer.
Most requests start with someone else asking for proof: a customer, a tender, a regulator or a certification body. These are the situations Infracom is asked into most often.
A customer questionnaire or a tender asks for evidence of security, and nothing is documented. An audit cannot begin without criteria, so the work starts as a readiness assessment against a published standard such as Cyber Essentials, a tier of the Cyber Trust mark or ISO/IEC 27001. You learn where you stand and what the shortest route to the evidence is.
The Cyber Trust mark is set out in Singapore Standard SS 712:2025 and has five tiers, from Supporter with ten preparedness domains to Advocate with twenty-two. It is valid for three years with an audit every year. Cyber Essentials is the baseline mark and is valid for two years. Both are awarded by certification bodies appointed by the Cyber Security Agency of Singapore. Infracom assesses you against the tier you are aiming for before that body arrives.
Both standards require internal audits at planned intervals, carried out by auditors chosen for their objectivity and impartiality, with the results reported to management. A small team cannot audit its own work. An outside auditor on an annual programme meets the requirement and gives the certification body a clean audit trail to read.
Licensed penetration testing and managed security operations centre providers must hold the Cyber Trust mark at Promoter tier or an equivalent, with a grace period to 31 December 2026. A readiness assessment against the Promoter tier, followed by an internal audit each year, keeps the licence condition met.
Owners of critical information infrastructure are audited under the Cybersecurity Act and must hold the Cyber Trust mark at Advocate tier by the end of 2027. They pass those expectations down to the vendors who touch their systems. A supplier audit before the owner's own audit finds the gaps while there is still time to close them.
The Monetary Authority of Singapore expects financial institutions to keep the right to audit their material service providers and to obtain independent assurance over them. Under the Personal Data Protection Act an organisation stays accountable for personal data it hands to a data intermediary. A second-party audit turns a vendor's questionnaire answers into verified evidence.
Three shapes, all with the criteria, the scope and the sample agreed in writing before the work starts. Effort is sized at scoping on the sites, systems and tier in scope.
A readiness assessment, an internal audit or one supplier audit as a defined engagement. Scoping, fieldwork, a rated report and a closing meeting with management. The usual start for an organisation meeting a customer or tender deadline. What the report finds is built through GRC consulting and tested by VAPT before the next audit.
An annual contract. Infracom holds your internal audit programme: the plan for the year, the audits on their dates, follow-up of earlier findings and the input to your management review. For certified organisations and those holding a mark that is audited yearly. The audit dates are set after the year's penetration test, so the audit reads fresh evidence, and before the certification body's visit.
An annual contract for a list of suppliers. Each supplier is placed in a level by risk, from desk review to site visit, audited on a schedule against one consistent method, and reported in one register your procurement and risk teams can use.
↔ Swipe to compare
| Dimension | Readiness assessment | Internal audit (first-party) | Supplier audit (second-party) |
|---|---|---|---|
| Starting point | Little or nothing documented | A management system or control framework already in operation | A supplier you depend on |
| Checked against | A published standard chosen with you, at a stated tier or scope | Your own policies and the standard you follow | Your contract, your questionnaire or a named standard |
| Who it is for | Your management, to plan the work | Your management and, later, your certification body | You, the customer; the supplier receives its findings |
| What you receive | Gap register and a prioritised plan | Audit report with nonconformities and observations | Risk-rated supplier report and an action list |
| How often | Once, before the programme is built | At planned intervals, usually every year | At onboarding, at renewal or on a yearly schedule |
| Not included | None of the three is a certification audit. A certificate or a mark is awarded only by a certification body or a regulator, which is a third-party audit. Penetration testing is a separate service delivered by Infracom's VAPT team, and independent review of a system before it goes live sits with the SQEP service. Fixing the findings is not part of an audit: the auditors who report them do not design the remedy. | ||
Sources: ISO 19011:2018 Guidelines for auditing management systems; ISO/IEC 27001:2022 and ISO/IEC 42001:2023, clause 9.2; Singapore Standard SS 712:2025 and the Cyber Security Agency of Singapore's Cyber Trust mark and Cyber Essentials pages (csa.gov.sg); Cybersecurity Services Regulation Office licence conditions (csro.gov.sg); Monetary Authority of Singapore outsourcing and technology risk requirements (mas.gov.sg); Personal Data Protection Commission (pdpc.gov.sg). Obligations and dates depend on your designation and sector; confirm with the issuing authority before relying on this comparison.
The method follows ISO 19011, the international guideline for auditing management systems, whatever the standard being audited against. Independence is part of the method: the auditors who examine a control are never the people who designed it. It is the same rule that separates the three tiers of Infracom's delivery model.
The standard and its version, the tier or clauses, the sites, the systems and the sample sizes are fixed before any work begins, so both sides know what the report will and will not say.
A dated plan names who will be interviewed and what records are needed. Where little is documented, the request is for what exists: system settings, logs, contracts and the people who know.
Interviews, a walk-through of how the work is really done, sampled records and configuration checks on the systems in scope, on site or by remote session.
Each finding is tied to the clause or requirement it relates to, supported by the evidence seen, and rated so that management knows what to deal with first.
One written report, presented to management in plain business terms. For a supplier audit, the supplier is given its findings and the customer receives the full report.
Agreed actions are checked at a follow-up audit or at the next audit in the annual programme, and the record shows what was closed and when. Closing them is build work: your own team, GRC consulting or your fractional CISO does it, never the auditor.
What an audit is, what it is not, and how independence is kept when the same firm also advises.
Tell us what triggered the request, the standard or contract involved and roughly what is in scope. A certified auditor will respond within 1 business day with a scoping call and a proposal.
Your one-stop IT & cybersecurity partner — Singapore HQ since 2008, expanding to Australia in 2026.
506 Chai Chee Lane
Singapore 469026
Mon – Fri
9AM – 6PM SGT