Cybersecurity Labelling Scheme Singapore: routers and cameras

The Cybersecurity Labelling Scheme (CLS) in Singapore rates the cybersecurity of connected devices in four levels, with Level 4 the highest. It is voluntary except for routers: the Ministry of Digital Development and Information (MDDI) says routers “must meet CLS Level 1 requirements to be sold in Singapore” (written parliamentary reply, 13 January 2026). For IP cameras, MDDI’s 2026 statements say it is reviewing or exploring a requirement, and none had been announced in the pages we read.

A label is only part of MDDI’s advice to households. The same reply says individuals should buy CLS-labelled devices for home use and adopt “good cyber hygiene practices, such as updating software promptly and not using universal default passwords”. Below: what the pages say is required, planned and voluntary, what they leave out, and a day-one checklist that is ours, not MDDI’s.

What does the label tell you about a router or camera?

In his Committee of Supply speech of 2 March 2026, SMS Tan Kiat How compares CLS to “the energy efficiency tick label you see on household appliances”, but “instead of showing energy use, it tells you how cybersecure the device is”. (For that other label, see our energy label running-cost comparison.) Levels run from 1 to 4, and Level 1 is “the most basic standard”.

The factsheet says routers must meet Level 1 requirements “such as having unique default passwords, vulnerability management processes and keeping software updated”. Those are examples. We could not open CSA’s pages, so we have not read the level definitions and cannot say what each example requires or how it is tested. The factsheet says Level 1 “provides basic security protections” but is “insufficient against more sophisticated attacks that exploit weaknesses in data encryption, authentication mechanisms, and secure storage”, and that Level 2 requires “stronger security measures such as secure communications, secure storage of sensitive data and robust authentication mechanisms”.

Our reading: treat Level 1 as a minimum, not a guarantee of security.

Which devices must meet it, and what does “sold” cover?

Routers. The pages use different words: “routers” (13 January), “all residential routers sold in Singapore” (factsheet), “home routers” (speech) and “gateway devices (i.e. home routers)” (7 April). None defines “residential” or “home”, so we cannot say how a router sold for business use is treated. The speech gives the reason: routers “are the gateways to networks and transmit sensitive information”.

What “sold” covers. The pages say “to be sold in Singapore” and do not define it. They do not say whether the rule covers a router a telco supplies with a broadband plan or one an individual imports for their own use, whether a router must show a label, or when the Level 1 requirement began. For imports, and for IMDA’s own registration and labelling documents, see buying a phone or router overseas.

Cameras and doorbells. The 13 January question asked about “consumer IP cameras and smart doorbells with video recording functions”. The reply says MDDI is reviewing whether “more digital devices, such as IP cameras” should require CLS assessment. The pages do not define “IP camera”, so we cannot say which consumer products, such as a video doorbell, it would cover. The speech says threat actors exploit IP cameras “to spy on individuals”, and lists baby monitors and routers among over 2,700 Singapore devices infected in 2025.

Because the scheme is voluntary for cameras in those statements, a camera on a shelf may or may not carry a label. Our reading: an unlabelled camera has not attained a label, which is not the same as being unsafe; the pages do not say why a given product is unlabelled.

What should you do on day one with a new router or camera?

1. Passwords (ours, following MDDI’s “not using universal default passwords”). Our reading, which the pages do not confirm: a universal default password is the same on every unit, and the factsheet’s first Level 1 example, “unique default passwords”, means each unit has its own. Our action: before connecting anything else, change the admin password on the router or camera, and the password of any camera or doorbell app account, to one only you know and use nowhere else.
2. Updates (ours, following MDDI’s “updating software promptly”). Our action: run the update check in the admin page or app as soon as setup finishes, install what it finds and switch on automatic updates if offered. If not, set a calendar reminder to check again.
3. Security notices (ours only, not from MDDI’s advice). The factsheet lists “vulnerability management processes” among its Level 1 examples but does not say what they involve or what an owner would see. Our action: find the maker’s support page, note where it announces security updates and, if it offers notices by email or in an app, register the device. Not every maker does.

Our suggestion: note the date and result of the first update check beside the receipt. If the seller offers a return window, the check can go in the first-week test plan for home trials.

What do MDDI’s pages not say about the label?

• Whether a product is labelled. This page cannot confirm that any router, camera or doorbell holds a label, and lists no products. MDDI gives no breakdown of the 870 products by type, and we have read no product list.
• How long updates continue. The pages do not say how often products are reassessed or how long a maker must keep issuing updates. Asking the maker is our suggestion.
• The level definitions. CSA’s pages and the Government licensing page linked from the factsheet were not opened, so the definition of each level and the design of the label are not covered.

What changes next: Level 2 for routers and a possible camera rule?

Routers. The factsheet says the requirements are to rise from Level 1 to Level 2 “by 2027” and are “expected to come into force by end 2027”. The speech says CSA and IMDA “intend to raise the minimum cybersecurity requirements for all routers sold in Singapore to the equivalent of CLS Level 2”. We use “end 2027” as the more specific wording and found no firmer date. The pages do not say what happens to routers already sold or in use when the new requirements start, so do not assume either way.

Cameras. On 13 January 2026 MDDI said it is “reviewing if more digital devices, such as IP cameras, should require CLS assessment, and will announce any changes when ready”. On 2 March the speech said CSA “will explore requiring IP cameras to meet CLS Level 2, similar to home routers”, and on 7 April MDDI said “We will also explore introducing similar standards for IP cameras”. None gives a date or says a requirement has been decided. Our reading: “review” and “explore” are not yet a commitment to require it.

Recheck before relying on this page: any camera announcement, any change to the Level 2 timing and any published start date for Level 1. The latest statement we found is dated 7 April 2026; we checked on 17 October 2026. Dated entries are collected on our calendar of consumer rule changes.

What to check before you buy a router or camera

Our checklist, not an official one.

1. Router: ask the seller whether it meets CLS Level 1 and how you can tell. MDDI’s pages do not say whether this is shown as a label or how a buyer can check it. If it is an imported or marketplace listing and the seller cannot say, ask before you pay.
2. Camera or doorbell: ask whether it carries a CLS label and at which level. The statements we read do not require one for IP cameras; they do not cover any other rule.
3. Updates: ask how they arrive, where the maker posts them and how long it says it will keep issuing them for this model. The pages give no official figure.
4. Online: save the listing, the model number and anything the seller says about the label, as Before you check out suggests.
5. In a shop: ask staff to open the update page during any demo (how to plan a useful product demo).
6. Second-hand: add the second-hand hand-over test, and ask whether the maker still issues updates for that model.

More on life after a purchase is under After the purchase.

Common questions