Opening Remarks by SMS Tan Kiat How at the Singapore International Cyber Week SG Cyber Safe for Enterprises

Stronger Together, Secure as One

Distinguished guests,

Ladies and gentlemen

1. Good afternoon. It is a pleasure to be here with our partners from across Singapore's business and cybersecurity community.

Cyber resilience is an enabler of digitalisation and business growth

2. Singapore is on an ambitious digital journey. Our businesses are adopting cloud technologies, AI and digital services to improve productivity, serve customers better and create new opportunities.

3. But as our dependence on technology grows, so does the importance of being able to rely on it. Cyber resilience is not just about protecting a business from attack. It is about giving businesses the confidence to digitalise, innovate and grow.

4. This is becoming more important as the threat landscape evolves. Almost nine in ten organisations surveyed in CSA's Cybersecurity Health Report 2025 reported encountering at least one cybersecurity incident in 2025. SMEs and non-profit organisations also continue to face barriers such as limited resources, expertise and awareness.

5. AI is also changing the threat landscape. It can help defenders detect and respond to threats more quickly, but it can also give attackers greater speed and scale. As businesses become more interconnected, an incident in one organisation can also affect its customers, suppliers and partners and the rest of the ecosystem.

6. The answer is not to slow down digitalisation or AI adoption because that would mean foregoing opportunities. It is to make our digitalisation more resilient. We want our businesses to embrace technology boldly, with safeguards that keep pace with their ambitions.

Cyber readiness is a business credential

7. Increasingly, cyber resilience is becoming an important business credential. Customers want confidence that their information is protected. Larger organisations are paying greater attention to the security of their supply chains. Government, too, needs assurance when vendors are entrusted with critical systems and sensitive data.

8. As I shared at the Committee of Supply debates earlier this year, CSA will require critical entities and cybersecurity service providers supporting essential services to meet Cyber Trust Mark requirements. GovTech will similarly require government vendors that manage critical systems and sensitive government data to meet Cyber Essentials and/or Cyber Trust Mark requirements by end 2027.

9. For businesses, the message is simple: cybersecurity protects the business you have today - and can help you win the business you want tomorrow. Strong cyber readiness builds trust and can open up opportunities where greater assurance is required. It is increasingly part of being ready to do business.

Businesses should focus on getting cybersecurity fundamentals right

10. Fortunately, strengthening cybersecurity does not always require sophisticated technology. It starts with the basics: keeping systems patched, protecting important accounts, controlling access, backing up critical data, training your staff, and knowing what to do when something goes wrong.

11. For SMEs in particular, the challenge is often not knowing that cybersecurity matters. It is knowing where to start, what to prioritise, and, importantly, where to get help. This is why we launched the Cyber Resilience Centre, or CRC, last year, to make practical support easier to access. Its cybersecurity health clinics and workshops have benefited close to 500 companies. We are also piloting "Cyber Essentials in a Day" to help businesses strengthen their baseline more quickly.

12. We also recognise the important role of our ecosystem partners, including CISO-as-a-Service providers and certification bodies, in helping businesses turn best practices into action.

13. This year, we will also present the Pioneer Adopter Award to healthcare organisations that were among the first in Singapore to attain Cyber Essentials certification, going beyond the cybersecurity requirements under the Health Information Act.

14. I congratulate all our award recipients, and thank our ecosystem partners for their contributions.

Businesses can act before an incident occurs

15. We also want to recognise businesses that act before an incident occurs. Alles Autos Credit Pte Ltd is a good example, represented here today by its Managing Director, Mr Johnson Lim.

16. When a cyberattack affected others in his industry and exposed sensitive customer data, Johnson did not assume that his business was too small to be affected. He worked with Contfinity Pte Ltd, a CISO-as-a-Service provider, to address cybersecurity gaps and work towards Cyber Essentials certification. Alles Autos Credit became the first company in Singapore's licensed moneylending industry to attain the Cyber Essentials mark.

17. I commend Johnson and his team for recognising the risk early. Their experience shows that businesses do not have to wait for an incident before taking action.

Support is available when incidents occur

18. But even strong defences cannot prevent every incident. For a small business, the first few hours after something goes wrong can be particularly difficult, and this is the most critical window. You have to intervene, do something, protect yourself and build trust with your customers and clients.

19. We have to ask ourselves very difficult questions; What happened? How serious is it? And most importantly: who do we call? Taking the right steps early can help contain an incident and manage its impact, but SMEs may not know where to start or who to turn to.

20. Today, we want to make that question easier for businesses to answer. I am pleased to announce the launch of the Cyber Incident Helpline.

21. The Helpline will provide businesses with an accessible first point of assistance when they face a cyber incident. It will help them understand their next steps and connect them to further support where needed.

22. The goal is simple: to help businesses move quickly from uncertainty to action, respond effectively and recover with as little disruption as possible. Because when an incident happens, time matters.

Cyber resilience requires collective effort

23. The initiatives we have highlighted today reflect a broader principle: cyber resilience is a collective effort. Government has a role in setting the baseline, providing support and building capabilities that businesses may not be able to build on their own. Cybersecurity providers and certification bodies help businesses put those standards into practice. Trade associations and chambers can help businesses, especially our SMEs, learn from one another and access support and resources.

24. And businesses themselves must take ownership of their cyber risks. I encourage all businesses to understand your risks, get the fundamentals right, put safeguards in place before an incident, and know where to turn when one occurs.

25. Cybersecurity should not be something we think about only after something goes wrong. It should be part of how we operate, how we build trust, and how we grow. The businesses that prepare today will be better placed to seize the opportunities of tomorrow. Together, we can build a stronger and more resilient business community - and a safer digital Singapore.

Thank you.