SQEP-led, independent cyber resilience for Singapore CII and enterprise across APAC
SQEP-led, independent cyber resilience for Singapore CII and enterprise across APAC
A named Chief Information Security Officer on a monthly retainer. Board reporting, regulator-ready evidence and a security programme that runs, for organisations that need the role but not the full-time cost. MAS TRM, CSA Cybersecurity Code of Practice, Cyber Trust mark, PDPA.
A fractional CISO (virtual CISO, vCISO) is an experienced security leader who holds the CISO role for your organisation on a part-time basis: a fixed number of days each month, a named person your board, auditors and regulators can speak to, and a security programme with owners and dates. Singapore now expects the role to exist. MAS TRM asks every financial institution to appoint a CISO or Head of Information Security with the requisite expertise. The CSA Cybersecurity Code of Practice 2026 makes boards answerable for cyber risk and names the CISO as the person who leads incident response. Infracom supplies that person, backed by a certified team, at a fraction of a full-time hire.
The same three jobs a full-time CISO holds: govern, comply and operate. The difference is the cadence. Days are fixed each month, the team behind the CISO is already certified, and nothing waits for a hire.
The CISO sets the security strategy, the risk appetite statement and the policies that follow from it, and reports to the board in plain business terms.
One evidence base that serves MAS TRM, the CSA Cybersecurity Code of Practice, Cyber Essentials and Cyber Trust, PDPA and ISO 27001, so one set of controls answers several audiences.
Security testing scheduled and acted on, incidents led by a named person, staff awareness kept alive, and a monthly review so nothing drifts.
Singapore's regulators have moved from "have controls" to "have an accountable person". These are the situations where a named CISO, part-time, is the right answer.
The MAS Technology Risk Management Guidelines ask the board and senior management to appoint a Chief Information Security Officer or Head of Information Security with the requisite expertise and experience, approved at least by the CEO. MAS does not prescribe a governance structure, so the role can be held by a fractional CISO. Fund managers, brokers, payment institutions, financial advisers and insurers use this route.
The CSA Cybersecurity Code of Practice 2026 was issued on 29 July 2026 with most new obligations due by 29 July 2027. Boards must oversee cyber risk in their terms of reference, receive a briefing every six months and train annually. At least one senior manager, or an equivalent such as a CISO, must have the knowledge to manage cyber risks, and the CISO leads the incident response plan. CII owners must also hold the Cyber Trust mark at Advocate tier by the end of 2027.
From 2026, licensed penetration testing and managed SOC providers must hold the Cyber Trust mark at Promoter tier or an ISO 27001 certification, with a grace period to 31 December 2026. A fractional CISO runs that certification programme so the licence is never at risk.
CSA expanded both marks in April 2025 to cover cloud, AI and operational technology, and is studying whether organisations given access to sensitive data must hold a mark before licensing or bidding for government contracts. A fractional CISO owns the gap assessment, the evidence and the certification body relationship.
The PDPA makes it mandatory to appoint a Data Protection Officer and to be able to show accountability. The fractional CISO designs and runs the Protection and Retention controls, breach assessment and response, and works alongside your named DPO.
CSA's Singapore Cybersecurity Health Report 2025 found that almost nine in ten organisations had at least one incident in the year, while 56 percent cited a lack of knowledge and experience and 37 percent a lack of manpower as the reason basic measures were not in place. The gap is leadership, not tools.
Three retainer shapes, all with a named CISO, the same certified team behind them and a monthly written review. Days per month are agreed at scoping and can change with the programme.
About two days a month. Policy suite, risk register, quarterly board report, audit and regulator liaison. For organisations whose IT team runs the controls and needs an accountable security leader above it.
About four days a month. Everything in Advisory plus supplier risk, testing oversight, awareness training, incident lead and a monthly security review with metrics. The usual fit for MAS-regulated firms and licensed providers.
Six to eight days a month for a defined period. The CISO leads a certification programme such as Cyber Trust, ISO 27001 or a Code of Practice remediation plan, then steps down to Standard or Advisory once it is achieved.
↔ Swipe to compare
| Dimension | Fractional CISO (Infracom) | Full-time CISO hire | Managed security service only |
|---|---|---|---|
| Named accountable person | Yes, appointed in writing, meets the board, auditors and regulators | Yes | No, the provider runs tools and alerts, nobody holds the role |
| Annual cost | A fixed monthly retainer sized to the days needed, typically a fraction of a full-time salary | Commonly S$160,000 to S$300,000 a year in base salary before bonus and benefits, where a candidate can be found | Monthly service fee for monitoring; leadership, policy and audits are extra |
| Time to start | Weeks: health check, then a 90-day plan | Months: Singapore's cybersecurity talent shortage keeps senior roles open for long periods | Weeks for onboarding of tools |
| Independence | Independent of your vendors and your IT team; can say no | Employee of the organisation | Tied to the provider's own platform |
| Continuity | A certified team behind the named CISO; cover is built in | Single person; resignation resets the programme | Provider-dependent |
| Best fit | Most organisations under 500 staff pair a fractional CISO with a managed SOC or an internal IT team: the service runs the controls, the CISO owns the programme and answers for it. Infracom's CISO is backed by its own VAPT and GRC teams, so testing, remediation and evidence sit under one accountable person. | ||
Sources: Monetary Authority of Singapore Technology Risk Management Guidelines, January 2021 (mas.gov.sg); Cyber Security Agency of Singapore, Cybersecurity Code of Practice for Critical Information Infrastructure 2026, Cyber Trust mark and licensing announcements, Singapore Cybersecurity Health Report 2025 (csa.gov.sg); Personal Data Protection Commission (pdpc.gov.sg); published Singapore salary surveys for the full-time cost range. Obligations and dates depend on your designation and sector; confirm with the issuing authority before relying on this comparison.
The same methodology as every Infracom GRC engagement, on a monthly rhythm. The first ninety days build the baseline; after that the programme runs and the board sees it.
Assets, controls, obligations and current evidence reviewed against the framework that applies to you: MAS TRM, the Code of Practice, Cyber Trust, PDPA or ISO 27001.
The CISO is appointed in writing with the CEO's approval, the risk register and policy suite are set, and a prioritised 90-day plan goes to management.
Fixed days each month: review of findings and incidents, supplier and change decisions, testing results, awareness, and a one-page written security review.
Risk posture, open items, spend and regulatory changes in business language, presented by the CISO in person where the board wants it.
Penetration testing, risk assessment, incident exercise and certification renewal scheduled and evidenced, so the audit is a formality.
If you later appoint a full-time CISO, the programme, the register and the evidence pack transfer in full. Nothing is locked to Infracom.
What regulators accept, how the role fits with your DPO and IT team, and what happens when something goes wrong.
Tell us your sector, size and the frameworks that apply. A certified consultant will respond within 1 business day with a scoping call and a proposal.
Your one-stop IT & cybersecurity partner — Singapore HQ since 2008, expanding to Australia in 2026.
506 Chai Chee Lane
Singapore 469026
Mon – Fri
9AM – 6PM SGT