The Infocomm Media Development Authority (IMDA) and the Cyber Security Agency of Singapore (CSA) announced an update to the Cybersecurity Labelling Scheme (CLS), introducing stricter mandatory security requirements for residential routers. The regulation will raise the minimum required level from Level 1 to Level 2 by the end of 2027.

This measure is intended to address increasing cybersecurity threats targeting home networks, where routers are frequently exploited as entry points or incorporated into botnets for large-scale cyberattacks. The updated Level 2 requirements will mandate stronger safeguards, including secure communications, enhanced authentication mechanisms, and improved protection of stored data.

The CLS currently helps consumers identify the security level of connected devices through a labeling system. By strengthening the baseline requirements, authorities aim to improve the overall cybersecurity posture of household networks and reduce risks associated with vulnerable devices.

While the measure does not immediately impose new obligations, it provides a transition period for manufacturers and suppliers to comply with the enhanced standards. The initiative reflects Singapore’s broader strategy to strengthen IoT security and protect digital infrastructure at the consumer level.

The regulatory update issued by the Infocomm Media Development Authority and the Cyber Security Agency of Singapore strengthens mandatory cybersecurity requirements for residential routers under the Cybersecurity Labelling Scheme (CLS), raising the baseline from Level 1 to Level 2 by 2027. While the implementation timeline provides industry with a transition period, the measure introduces clear future compliance obligations for manufacturers and suppliers, particularly in terms of secure communications, authentication, and data protection. The impact is moderate as requirements are confirmed but not immediate, allowing time for adaptation while signaling stricter enforcement ahead.

• Introduces higher mandatory cybersecurity requirements for residential routers (Level 2 CLS).
• Establishes a clear compliance timeline (by end of 2027) for manufacturers and suppliers.
• Requires implementation of enhanced security features (secure communication, authentication, data protection).
• Strengthens baseline security expectations for consumer networking devices.
• No immediate enforcement, allowing transition and product redesign cycles.
• May increase development, certification, and compliance costs for device manufacturers.
• Enhances consumer trust and security awareness through improved labeling standards.
• Signals broader regulatory tightening for IoT and connected devices in Singapore.

Who?

• Router manufacturers: Must redesign or upgrade products to meet Level 2 security requirements.
• IoT device vendors: Indirectly impacted due to stricter network security environments.
• Importers and distributors: Need to ensure compliant products are supplied to the Singapore market.
• Telecommunications operators / ISPs: May need to align customer premises equipment with new standards.
• Retailers: Must ensure only compliant devices are marketed over time.
• Consumers: Benefit from improved cybersecurity protection in home networks.
• Regulators (IMDA and CSA): Responsible for implementation, oversight, and enforcement of the scheme.

Conclusion

This measure represents a medium-impact regulatory development. Although it does not impose immediate obligations, it introduces confirmed and more stringent cybersecurity requirements that will become mandatory within a defined timeframe. Its significance lies in raising the security baseline for widely used consumer devices and signaling a broader shift toward stricter IoT cybersecurity regulation. Stakeholders should begin early compliance planning to meet the 2027 deadline and mitigate potential cost and supply chain impacts.