Singapore's Cyber Security Agency (CSA) and Infocomm Media Development Authority (IMDA) have jointly developed a draft technical specification introducing mandatory cybersecurity requirements for home routers. The document is entitled "IMDA TS Home Gateway Security Requirements (April 2026)", also known as IMDA TS RG-SEC Edition 2, and should be read together with Publication No. 4A of the Cybersecurity Labelling Scheme (CLS). The draft aims to strengthen consumer protection against cyber threats, which have increased sharply in recent years.

What the regulation says

Home routers currently have to meet CLS Level 1 requirements, which provide only baseline protection. CSA notes that such measures are now far from sufficient, as cybercriminals have begun widely exploiting routers to gain access to other connected systems in the network or to use them as botnets to attack other systems.

CSA intends to raise the mandatory cybersecurity requirements for routers to CLS Level 2. This means manufacturers will need to implement stronger security measures for such devices.

The draft technical specification sets out mandatory requirements covering the following areas:

1. Minimum password strength;

2. Device setup and management:

- Pre-loaded device settings, where applicable;

- Handling of authentication;

- Handling of credentials;

3. Firmware updates;

4. Data protection;

5. CLS requirements in line with the CLS Level 2 baseline:

- No universal default passwords;

- A vulnerability reporting and management mechanism;

- Maintenance of software updates;

- Secure storage of sensitive security parameters;

- Secure communication;

- Minimisation of the exposed attack surface;

- Provision for the protection of personal data;

- Resilience of the system to failure;

- Easy deletion of personal data by consumers;

- Validation of input data;

- Terms for the protection of consumer data.

Click for more on Singaporean market access regulations:

Singapore expands MEPS and MEL requirements, effective July 2026

A guide to the key points of Singapore's updated CPSR regulations

Singapore's IMDA publishes an update to the cellular mobile terminal technical specification, mandating 2G and emergency broadcast functions be disabled by default

Singapore's IMDA updates the draft cellular mobile terminal technical specification

Safety alert: Singapore mandates recalls of non-compliant consumer goods, with heavy penalties for breaches

Singapore revises minimum energy performance standards and mandatory energy labelling for regulated products