Singapore's Cybersecurity Labelling Scheme for IoT (CLS(IoT)), explained

Singapore's Cybersecurity Labelling Scheme for IoT (CLS(IoT)) is a consumer smart-device security rating run by the Cyber Security Agency of Singapore (CSA): a four-level, asterisk-based label that tells a buyer how much cybersecurity assurance a product has earned, from basic password/update hygiene up to independent penetration testing. CSA describes it as "the first of its kind in the Asia-Pacific region." It was announced on 6 October 2020 as part of Singapore's Safer Cyberspace Masterplan 2020 — under the strategic thrust to secure "our core digital infrastructure... devices and endpoints" — and started with Wi-Fi routers and smart home hubs before extending to "IP cameras, smart door locks, smart lights and smart printers."

The four levels, each building on the last

CSA publishes two parallel descriptions of the same four levels — a short consumer-facing version and a more technical manufacturer-facing one. Combined:

Level (asterisks)	Consumer-facing requirement	Manufacturer-facing assessment tier
1	Unique default passwords; software updates provided	Tier 1 — baseline requirements based on ETSI EN 303 645, eliminating "common mistakes" (default passwords, missing update mechanism, no vulnerability-reporting channel)
2	All mandatory requirements of an international standard, plus Level 1	Tier 2 — adherence to "all mandatory requirements within ETSI EN 303 645"
3	Developed using Security-by-Design, software binaries assessed by an approved third-party lab, plus Level 2	Tier 3 — secure development lifecycle per the IMDA IoT Cyber Security Guide (March 2020) plus automated binary analysis for "known critical software weakness, vulnerabilities, or malware"
4	Structured penetration testing by an approved third-party lab, plus Level 3	Tier 4 — third-party penetration test for "a basic level of resistance against common cybersecurity attacks"

Tiers are completed strictly in sequence — a manufacturer targeting Level 3 "undergo[es] assessments at Tiers 1, 2, and 3," not Tier 3 alone.

Mandatory for one category: Wi-Fi routers

CLS is largely a voluntary, market-differentiation label — CSA's framing is to "encourage manufacturers to prioritise cybersecurity," not to compel it. The one explicit exception is Wi-Fi (residential gateway) routers: CSA's registration guidance states plainly that "it is a requirement for all Wi-Fi routers that are to be sold for local use in Singapore to comply with the [IMDA Technical Specification for Security Requirements for Residential Gateways (IMDA TS RG-SEC)] and attain minimally CLS Level 1 by 2 May 2022." The two frameworks share a registration portal (GoBusiness), and a compliant router must carry both the IMDA compliance label and the CSA Cybersecurity Label.

Mutual recognition: four bilateral deals, four different levels

CSA has negotiated recognition arrangements that let a label earned under a partner scheme count directly toward a CLS level, without a separate full assessment:

Partner scheme	Country/region	Recognised CLS level
Traficom Cybersecurity Label	Finland (MoU, 2021)	Level 3
IT Security Label (BSI)	Germany (MRA, 2022)	Level 2
Certification of IoT Cybersecurity (CIC), Basic Level	South Korea (MRA, KISA)	Level 3
Product Security and Telecommunications Infrastructure (PSTI) Act compliance	United Kingdom	Level 1

Each arrangement runs both ways — a CLS Level 3 (or 4) label is in turn recognised as meeting Finland's requirements, and so on for the other three. CSA's own manufacturer page adds a one-way restriction worth noting: a label obtained through mutual recognition cannot be used to then apply for a third scheme — "a developer who has attained the Cybersecurity Label from Traficom would be eligible to attain the CLS Cybersecurity label through the mutual recognition partnership. However, the developer shall not use the granted CLS label to apply for Germany's IT Security Label."

How it compares to other IoT labelling schemes

CLS's Tier 1/Tier 2 split maps directly onto ETSI EN 303 645's baseline provisions, the same standard underlying the UK's PSTI regime and the US Cyber Trust Mark — which is precisely why CSA can recognise UK PSTI compliance as meeting CLS Level 1. Where CLS goes further than a single-tier pass/fail scheme is the explicit Level 3/4 escalation to independent binary analysis and penetration testing, placing a self-declared Level 1 and a lab-tested Level 4 product on the same visible asterisk scale rather than treating "certified" as one undifferentiated outcome.

A workable starting point

1. Check whether your category has a mandatory floor. Wi-Fi routers sold in Singapore must clear IMDA TS RG-SEC and CLS Level 1 together — treat that as a market-access gate, not an optional label.
2. Start from ETSI EN 303 645 regardless of target level, since Tiers 1 and 2 are defined directly against it — work already done for EU/UK conformance (EN 303 645, PSTI) carries over.
3. Decide your target level by audience, not by default. Level 1-2 is a self-assessed baseline; Level 3-4 requires an approved third-party test lab and buys more credibility with enterprise or export buyers.
4. If you already hold a Finnish, German, Korean or UK label, apply for the matching CLS level through mutual recognition before commissioning a fresh assessment — but don't plan on using the resulting CLS label to bootstrap a fifth scheme.

SoftWSP's device and firmware assessments can be scoped against the CLS Tier 1-4 ladder — from an EN 303 645 baseline review through binary analysis — alongside the CVE and SBOM evidence a labelling assessment doesn't itself cover: see Device & Firmware Security.

This guide summarises the public CSA Singapore CLS(IoT) documentation current as of this guide's last-updated date; it is not a substitute for CSA's current scheme rules and does not constitute compliance or legal advice.