Thong Kian Leong

Author: kianleong@sageshield.com

  • ISO 45001 vs bizSAFE STAR: Do You Need Both?

    “We already have bizSAFE STAR — do we still need ISO 45001?” And its twin: “we hold ISO 45001 — why is a tender asking for bizSAFE?” After guiding companies through both, here is the practical answer.

    What each one actually is

    bizSAFE is Singapore’s national WSH capability-building programme, run by the WSH Council. It is tiered — from Level 1 (top management commitment) through Level 3 (risk management implementation, audited) up to STAR. It is the language of local supply chains: main contractors, facilities managers and government tenders specify bizSAFE levels because it is auditable, tiered and local.

    ISO 45001 is the international occupational health and safety management system standard, certified by accredited certification bodies. It is the language of MNCs, regional groups and corporate governance — a full management system with leadership requirements, worker participation, operational controls, internal audit and continual improvement.

    The key fact: STAR is built on the same backbone

    bizSAFE STAR — the top tier — requires a WSH management system audited to the relevant standard, which in practice means SS 651 or ISO 45001. So the two are not parallel tracks; they converge at the top. A company holding ISO 45001 is one audit-and-application step from STAR. A company aiming for STAR from Level 3 will build a management system that is, in substance, most of ISO 45001 anyway.

    So who needs what?

    • Local subcontractor serving main contractors: bizSAFE Level 3 is the ticket to play; STAR helps you stand out on bigger tenders. ISO 45001 is optional.
    • Company serving MNCs or working regionally: ISO 45001 is what their procurement recognises — and since you are building the system anyway, collecting STAR alongside costs little extra.
    • Bidding into government and large-institution tenders: read the tender line by line. Many specify bizSAFE STAR or ISO 45001; some name one specifically. The certificate named in the tender is the one that matters.
    • Growing firm choosing a path: go Level 3 first for immediate eligibility, then decide between STAR and 45001 when a real contract demands it — with the management system designed so either is reachable without rework.

    The “both” answer

    For companies that need both, the efficient route is one integrated management system, one document set, one audit preparation — feeding two certificates. What wastes money is building them as two separate projects with two separate consultants who never talk to each other. If your ISO 9001/14001 cycle is also in play, the same integration logic applies across all of them.

    Thong Kian Leong is the founder and principal consultant of Sage Shield Safety Consultants, a bizSAFE STAR-certified firm delivering bizSAFE programmes and ISO 9001/14001/45001 certifications — separately or as one integrated system. Talk to us about the right route.

  • bizSAFE Renewal: The 3 Mistakes That Delay Your Audit

    Sage Shield handles a few hundred bizSAFE renewals a year, so we see exactly where they go wrong. The good news: it is almost always one of three mistakes, and all three are avoidable with a calendar and an honest look at your documents.

    Mistake 1 — Starting when the certificate expires, not before

    A bizSAFE Level 3 renewal is not a form submission. It is a Risk Management audit by a MOM-approved auditor, on documentation that reflects your current operations, followed by WSH Council processing. Auditors have queues; findings need rectification time; Council processing takes its own time. Companies that start a month before expiry routinely end up with a lapsed certificate — awkward when a main contractor’s portal automatically flags you. Start 3–4 months out. The renewal then happens entirely on your schedule instead of the deadline’s.

    Mistake 2 — Renewing documents that no longer match reality

    The most common audit finding, by far: the risk assessments describe the company as it was three years ago. New machines, new work activities, new sites, staff turnover — none of it reflected in the RA register, the safe work procedures, or the RM team appointments. The auditor is not assessing whether your paperwork exists; they are assessing whether it describes your actual work. A renewal is the natural moment to re-walk your operations: update the inventory of work activities first, and let the risk assessments follow from it. Done in that order, the audit becomes a formality.

    Mistake 3 — Treating the auditor as the enemy (or the rubber stamp)

    Two failure modes, same root. Some companies hide problems from the RM auditor and get caught on evidence gaps; others assume the audit is a formality and turn up unprepared — no briefing records, no implementation evidence, key personnel on leave. The auditor is independent (they must be — that is the point of the scheme), but the audit day is manageable: records compiled, RM team present, site access arranged, prior findings closed. Preparation is the difference between one visit and two.

    What a clean renewal looks like

    1. T-minus 4 months: review scope — activities, sites, headcount, RM team changes;
    2. T-minus 3 months: update documentation — inventory of work activities, risk register, SWPs, appointments;
    3. T-minus 2 months: brief staff, implement, collect evidence;
    4. T-minus 6–8 weeks: RM audit; rectify any findings promptly;
    5. T-minus 1 month: submission to WSH Council — certificate continues without a gap.

    Companies holding bizSAFE STAR should apply the same logic to their management-system audit cycle — the same three mistakes appear there, with higher stakes.

    Thong Kian Leong is the founder and principal consultant of Sage Shield Safety Consultants, a bizSAFE STAR-certified firm that has completed bizSAFE programmes and renewals for hundreds of Singapore companies. Talk to us about your renewal.

  • What an Outsourced DPO Actually Does (and When a ‘Named-Only’ DPO Gets You in Trouble)

    Under the PDPA, every organisation in Singapore is required to appoint a Data Protection Officer. Most have. The uncomfortable question is: does yours actually do anything?

    The “named-only” DPO problem

    A pattern I see constantly: the DPO is the IT vendor, an admin manager, or a director — appointed years ago, listed on ACRA/BizFile, and never heard from since. No data inventory, no policies anyone follows, no breach plan, no training. Everything is technically “appointed” and practically absent.

    That gap stays invisible until the day it doesn’t: a customer complaint escalates to the PDPC, a vendor assessment asks for your data-flow map, or a breach forces you to discover — mid-crisis — that nobody knows what data you hold, where it lives, or who must be notified. The PDPA’s mandatory breach-notification regime has deadlines; “we were still figuring out what we have” is not a defence that ages well.

    What a functioning DPO function actually covers

    The PDPC frames the DPO’s job around the organisation’s obligations. In practice it means:

    • Knowing the data — an inventory and flow map of personal data: what you collect, why, where it is stored, who touches it, when it is disposed of;
    • Policies people actually use — collection, consent, retention, access and correction handling;
    • Breach readiness — a response plan aligned to PDPC’s mandatory notification requirements, and someone who has rehearsed it;
    • Training — staff who can recognise a data incident and know who to call;
    • DPIAs — risk assessments when new systems or processes touch personal data;
    • Being reachable — the registered business contact for data-protection matters.

    In-house or outsourced?

    The law allows either — a DPO can even serve multiple companies. The real question is capability and bandwidth. An in-house appointee works when they are given time and training, not just the title. An outsourced DPO works when you want the function running properly without hiring for it: a setup phase (inventory, policies, breach plan) and then a retainer that keeps it alive — advisory on demand, annual training, reviews when systems change.

    The hybrid is often best of all: keep an internal appointee as the face, with an external specialist doing the heavy lifting behind them. That is precisely the structure that fixes the “listed name only” problem without a headcount.

    Why this is getting less optional

    Three pressures are converging: PDPC enforcement keeps maturing; enterprise customers increasingly audit their vendors’ data protection before signing; and for organisations handling health-related data, the incoming Health Information Bill will raise expectations further. Sectors holding sensitive data — healthcare, education, HR services, renovation firms holding NRIC copies — feel this first.

    A 10-minute self-check

    Ask your appointed DPO three questions: Where is our data inventory? When did we last train staff? What happens in the first 24 hours of a breach? Three confident answers — you are fine. Three pauses — your DPO is a name, and the risk is currently unmanaged.

    Thong Kian Leong is the founder and principal consultant of Sage Shield Safety Consultants, which runs PDPA compliance programmes and an Outsourced DPO service for Singapore SMEs, alongside ISO 27701 and Data Protection Trustmark work. Talk to us about your DPO function.

  • Cyber Essentials First or ISO 27001 First? The Pathway Most Singapore SMEs Get Wrong

    A conversation I have almost weekly: a company wants “the ISO 27001” because a customer asked about their cybersecurity. Halfway through scoping, it turns out what the customer actually asked for was evidence of good cyber hygiene — and there was a faster, cheaper way to give it. Here is how to think about the pathway.

    Two different questions

    Cyber Essentials (CSA’s national mark) answers the question: “has this company done the cybersecurity basics?” Asset inventory, anti-malware, access control, secure configuration, software updates, backups, incident response. It is designed for SMEs and is assessed on declared evidence — practical, fast, affordable.

    ISO 27001 answers a bigger question: “does this company run a management system that continuously governs its information security?” It is an international certification with a risk-based ISMS, internal audits, management reviews, and a certification body audit cycle. It is what MNCs, regulated industries and overseas customers recognise.

    The mistake in both directions

    Overshooting: a 15-person local firm signs up for ISO 27001 because “it sounds more powerful”, spends months and five figures, and discovers their customers would have accepted Cyber Essentials. The ISMS then becomes shelf-ware they dread maintaining.

    Undershooting: a growing tech firm gets Cyber Essentials, then six months later a large client’s vendor assessment demands ISO 27001 anyway — and they start again from scratch, paying twice for overlapping work.

    The honest decision test

    • Who is asking? Local SME customers, government SME programmes → Cyber Essentials usually satisfies. MNCs, financial institutions, overseas clients, formal vendor-assessment questionnaires → ISO 27001 is usually the named requirement. Read the actual contract clause before deciding.
    • What do you hold? If you process sensitive personal data, run client systems, or sit in a critical supply chain, the risk-based depth of 27001 (or Cyber Trust Mark) fits. If your exposure is ordinary office IT, Essentials-level hygiene is genuinely proportionate.
    • Where are you going? If enterprise clients are 12–18 months away in your plan, sequencing matters more than choosing.

    The sequencing secret: the work overlaps heavily

    This is the part most companies never get told: the two are not separate projects. The asset inventories, access-control policies, patching discipline, backup regime and incident-response plan you build for Cyber Essentials map directly onto ISO 27001’s Annex A controls. Done deliberately, Cyber Essentials becomes phase one of a future ISMS — the certificate you can show customers this quarter, while the 27001 foundation quietly accumulates underneath.

    The same logic applies to the Cyber Trust Mark, CSA’s risk-based mark for more digitally mature organisations: its domains overlap substantially with 27001 controls, so a company holding one should never pay full price to build the other from zero.

    Bottom line

    Start from the contract in front of you, not the certificate with the bigger name. If nobody has named a standard yet, Cyber Essentials first is the right default for most Singapore SMEs — provided whoever builds it does so with the 27001 mapping in mind, so nothing is thrown away when you level up.

    Thong Kian Leong is the founder and principal consultant of Sage Shield Safety Consultants, a bizSAFE STAR and CSA Cyber Security Essentials-certified firm that has served 1,300+ organisations, delivering ISO 27001, Cyber Essentials and Cyber Trust Mark end to end. Talk to us about the right pathway.

  • Cyber Trust Mark Tiers Explained: Which One Your Company Actually Needs

    Every week I meet business owners who ask the same question: “Which Cyber Trust Mark tier do we actually need?” It is usually asked with a quotation from some consultant on the table, and almost always the tier on that quotation is wrong — in one direction or the other. Here is the plain-English version I give them over coffee.

    First, what the Cyber Trust Mark actually is

    The Cyber Trust Mark (CTM) is the Cyber Security Agency of Singapore’s certification for organisations with a more mature digital footprint — the bigger sibling of the Cyber Essentials Mark, which covers baseline cyber hygiene for smaller companies. Where Cyber Essentials asks “have you done the basics?”, Cyber Trust asks “does your cybersecurity match your actual risk?”

    That distinction drives everything. CTM is a risk-based certification: you first assess your organisation’s cybersecurity risk profile, and that assessment points you to one of five preparedness tiers. You then implement the domains required for that tier and are audited against them by an appointed certification body.

    The five tiers, in plain English

    Each tier adds domains on top of the previous one — from 10 domains at the entry tier to 22 at the top:

    • Tier 1 — Supporter (10 domains): for organisations with a limited digital footprint and low cyber-risk exposure. Covers the foundations: risk management, asset management, access control, anti-malware, system security, backups, incident response.
    • Tier 2 — Practitioner (12 domains): for companies moderately dependent on digital systems. Adds structure around training and awareness and data protection.
    • Tier 3 — Promoter (16 domains): the first tier where governance enters the picture — documented policies and procedures, leadership oversight, BYOD controls, secure software development where relevant.
    • Tier 4 — Performer (19 domains): for organisations where digital systems are business-critical. Expect scrutiny of your cyber strategy, third-party risk, and exercising — not just having — your incident response.
    • Tier 5 — Advocate (22 domains): the full framework, for organisations with extensive digital reliance and the highest risk exposure — typically larger enterprises and those in sensitive supply chains.

    How to choose — and the two classic mistakes

    Mistake #1: choosing a higher tier for prestige. I have seen SMEs ask for Advocate “because it looks better”. Every extra domain is real work — policies you must live by and evidence you must produce at audit, year after year. If your risk assessment points to Practitioner, certifying at Practitioner is the credible outcome; auditors and enterprise customers know exactly how the tiers work.

    Mistake #2: choosing a lower tier to save cost when a contract demands otherwise. Increasingly, government and enterprise tenders specify a minimum tier. If the contracts you want require Tier 3, certifying at Tier 1 saves you money and wins you nothing. Start from the question: what do my customers and regulators expect of a company holding my kind of data?

    The honest answer usually comes out of the risk assessment itself. When we run one, the tier tends to select itself: your digital dependence, the sensitivity of the data you hold, and who is in your supply chain do the deciding.

    What the journey looks like

    1. Risk assessment — establish your risk profile and confirm the target tier.
    2. Gap analysis — map what you already have against the tier’s domains. Most companies are further along than they think in some areas, and blind in others (backup testing and incident-response exercising are the usual blind spots).
    3. Implementation — close the gaps: policies, technical controls, training, evidence trails.
    4. Certification audit — by a CSA-appointed certification body.

    For a typical SME at the lower tiers this is a matter of weeks to a few months. At the upper tiers — we are currently delivering a Tier 4 implementation for an SGX-listed group, spanning VAPT coordination and awareness training for several hundred staff — it is a structured programme across a quarter or more.

    What it costs, roughly

    Consultancy fees scale with tier and organisation size — from around the price of a bizSAFE package at the entry tier to five figures for Advocate-level engagements. Certification-body audit fees are separate. Two pieces of good news: CSA runs support schemes with co-funding for eligible SMEs, and if you already hold ISO 27001, a large share of your existing controls maps directly onto the CTM domains — you should not be paying to build the same thing twice. The reverse is also true: CTM work done properly becomes a head start on ISO 27001 later.

    The bottom line

    Pick the tier your risk profile and your customers demand — not the one that flatters, and not the one that merely saves. If you are unsure, a one-hour conversation about your data, systems and contracts usually settles it definitively.

    Thong Kian Leong is the founder and principal consultant of Sage Shield Safety Consultants, a bizSAFE STAR and CSA Cyber Security Essentials-certified firm that has served 1,300+ organisations across 30+ compliance schemes, including Cyber Trust Mark, Cyber Essentials and ISO 27001. Talk to us about the Cyber Trust Mark.