How SQEP Competency Is Verified and Deployed on Singapore Cybersecurity Engagements

Direct answer: Genuine SQEP (Suitably Qualified and Experienced Personnel) assurance is demonstrated, not asserted. A credible Singapore provider verifies its corporate CSA CSRO licence, maintains a documented competency matrix mapping each named individual to the specific engagement role they will perform, and applies a formal deliverable sign-off process with a named accountable reviewer. A CV list attached to a proposal proves none of this — it shows qualifications exist somewhere in the organisation, not that the right person with the right currency of skill is the one doing the work on your engagement.

Procurement teams comparing cyber security service providers in Singapore face a real information gap. Certifications, past-project logos and confident CVs are easy to present and hard to verify before contract award. The result is that competency claims are frequently taken on trust, at exactly the point in the buying cycle when trust should be earned through evidence.

What "SQEP" Means in a Singapore Engagement Context

SQEP is not a certification in itself. It is a discipline: the practice of ensuring that everyone performing a security service — penetration testing, SOC monitoring, GRC advisory, incident response — is qualified for that specific task, has demonstrable relevant experience, and is deployed with oversight proportionate to the risk of the work. In a regulated market, SQEP sits alongside, and is partly evidenced by, several external frameworks that a buyer can independently check.

What Regulators and Frameworks Expect

Singapore does not yet regulate individual security practitioners directly for most services, but it does regulate the organisations that deploy them, and the frameworks that exist give buyers concrete verification points.

CSA licensing under the Cybersecurity Act

CSA licenses only two types of cybersecurity service, namely penetration testing and managed SOC monitoring services, as specified under the Cybersecurity Act. Providing a licensable service without a licence after 11 October 2022 can carry a fine of up to S$50,000, imprisonment of up to two years, or both. Importantly for buyers assessing personnel claims, individual employees of a licensed cybersecurity service provider who deliver licensable services on behalf of their employer are not required to hold a personal licence. The licence sits with the company, not the individual — which is precisely why a provider's internal competency verification process matters so much: the CSA framework does not itself vet each practitioner.

A cybersecurity service provider's licence is not transferable and is unique to the licensee's registration number, such as its UEN, as recorded on the e-licence. Buyers can and should check the published list of licensed providers and are encouraged to verify a valid licence before engaging any provider. This is a two-minute check that most procurement teams still skip.

The framework is also tightening. CSA's recent consultation confirmed several changes that raise the bar further: mandatory certification requirements, an extended five-year licence validity, and streamlined notification processes. Separately, CSA has announced that licensed cybersecurity service providers will need to attain Cyber Trust Mark Level 3 certification by end-2026, alongside tiered CTM requirements for CII owners and CII auditors, to raise baseline national cybersecurity standards and address supply chain risks. The Cyber Trust Mark itself was enhanced to account for newer risks in cloud, operational technology and AI security. For buyers, this means CTM status is becoming a genuine differentiator, not a nice-to-have.

ISO/IEC 27001 and management-system competence controls

ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining and continually improving an information security management system, including requirements for the assessment and treatment of information security risk. A provider's ISO 27001 certificate is only meaningful to an SQEP question if the certification scope explicitly names the services in question — a certificate that covers general IT operations but excludes the SQEP or delivery function tells a buyer very little about how testers or analysts are vetted, trained and supervised. Buyers should always ask to see the statement of applicability and confirm scope, not just the certificate.

CREST: understand the stage, not just the badge

CREST accreditation is often quoted as shorthand for quality, but the pathway has stages that buyers need to distinguish. Stage One, Pathway, is a baseline for organisations in the early stages of cybersecurity maturity, representing an agreement to work toward meeting CREST accreditation standards, with a requirement to advance within two years. Stage Two, Pathway+, builds on this by requiring a self-assessment against CREST standards and at least one other cybersecurity standard, with CREST providing tools to help the organisation prepare for the next stage. Only Stage Three, full CREST Member status, involves independent reviews of company processes, service methodologies and data security practices. A provider describing itself as "CREST Pathway+" has completed a structured self-assessment and is working towards accreditation; it has not yet been independently reviewed to CREST's full standard. Buyers should always ask which stage a provider holds and treat the distinction as material, not cosmetic.

← Swipe to compare →

How to Prepare: Verifying SQEP Before Contract Award

Security leads and procurement teams can apply a repeatable checklist rather than relying on trust. The following steps distinguish evidence-based SQEP assurance from a persuasive proposal document.

1. Verify the licence independently. Do not accept a licence number on a letterhead — check it directly against the CSRO's published list before shortlisting a provider for penetration testing or managed SOC monitoring work.
2. Request a role-mapped competency matrix, not a CV pack. A matrix should map each named individual likely to work on the engagement against the specific role (lead tester, reviewer, SOC analyst), years of relevant experience, current certifications with expiry dates, and prior engagement types.
3. Confirm certification scope, not just certificate existence. Ask which services are within the ISO 27001 statement of applicability, and whether SQEP or delivery functions are explicitly covered.
4. Ask which CREST stage applies, and to which discipline. A provider should state this plainly rather than allowing "CREST" to be read as full accreditation when it is not.
5. Establish named-resource and substitution clauses in the contract. If a named lead tester or analyst is replaced mid-engagement, the contract should require notice and evidence that the replacement meets equivalent competency criteria.
6. Require a defined deliverable sign-off process. Reports and findings should be reviewed and signed off by someone other than the person who performed the work, with the reviewer's basis of competency documented.
7. Check currency, not just historical qualification. Certifications lapse and threat landscapes move; ask when competency records were last refreshed and how ongoing CPD is tracked.

← Swipe to compare →

How Infracom Helps

Infracom operates an all-Singaporean SQEP team, with competency verification built into engagement setup rather than treated as a proposal-stage formality: CSA CSRO licence status, role-mapped competency matrices, and independent deliverable sign-off are standard practice, not optional extras, and our ISO 27001 certification scope explicitly covers SQEP services. As a CREST Pathway+ Organisation, we are transparent about where we stand on the accreditation journey rather than allowing the label to imply more than it does. For SMEs and mid-sized enterprises evaluating providers ahead of a GRC push, CSA Cyber Trust Mark certification, or Cyber Essentials readiness, our SQEP methodology page sets out how we document and deploy personnel on Singapore engagements at rates accessible to SME budgets.