Singapore’s Cyber Security Agency describes the Cybersecurity Labelling Scheme as a tiered program for consumer IoT devices. It has expanded beyond routers an
Official source publication date: . AndroidSBC review date: 2026-10-26.
What is Singapore’s Cybersecurity Labelling Scheme?
The Cyber Security Agency of Singapore operates a tiered Cybersecurity Labelling Scheme to help consumers compare the cybersecurity provisions of consumer IoT devices and encourage manufacturers to build security into products.
Key points from the official publication
- The scheme began with Wi-Fi routers and smart-home hubs and has been extended to other consumer IoT categories, including cameras, smart locks, lighting and printers.
- Products are rated by cybersecurity level under the scheme’s applicable requirements and evaluation process.
- The official program describes mutual-recognition arrangements with selected overseas cybersecurity labels for specified product categories and levels.
- Singapore announced in 2026 that mandatory cybersecurity requirements for residential routers are planned to rise from CLS Level 1 to Level 2 by 2027.
- A generic Android board does not itself establish eligibility for a finished consumer product label.
Practical actions for an Android product project
- Determine the finished product category and target CLS level before hardware and software freeze.
- Map credentials, update mechanisms, exposed services and vulnerability handling to the current criteria.
- Preserve testable firmware builds and exact wireless configuration evidence.
- Confirm current CSA and IMDA requirements for the finished product at the time of application.
What does this mean for Android board and embedded-device projects?
Product teams should identify the applicable CLS category and level before design freeze. Maintain evidence for secure configuration, software updates, vulnerability management and the exact wireless finished product; do not infer finished-device labeling from a generic board specification.
What should buyers and engineering teams verify?
- The exact board, PCB revision, SoC, BSP branch, kernel and Android build.
- The finished product’s intended use, wireless modules, enclosure and destination market.
- Security-update ownership, vulnerability contact, support period and incident process.
- Which controlled report, declaration or certificate applies to the exact configuration.
This article is an engineering summary, not legal or conformity-assessment advice. Requirements can change; confirm the current official text and obtain qualified local advice for the finished product.
Buyer FAQ
Common procurement and engineering questions related to this update are answered below. Project decisions must use the current official requirements and the exact product configuration.
Which Singapore CLS level should an Android IoT product target?
It depends on the finished product category, procurement requirement and desired assurance level. Review current CSA requirements before design freeze and testing.
Can a labeled wireless module make the complete Android device CLS compliant?
No. Module evidence may support part of the assessment, but the scheme evaluates the applicable finished IoT product and its security provisions.
What should be frozen before CLS testing?
Freeze the product model, PCB and radio configuration, firmware build, credentials and setup flow, network services, update mechanism, vulnerability process and supporting documentation.
Official primary source
Primary source
Cyber Security Agency of Singapore
Read the original official publication
Source URL: https://www.csa.gov.sg/our-programmes/certification-and-labelling-schemes/cybersecurity-labelling-scheme/about/
Editorial note: This is an original AndroidSBC engineering summary of the cited official publication. It is not legal advice and does not claim that every Android board or finished device is certified for the named market.
