The Singapore Shopper’s Guide to Smart Home Devices, the Cybersecurity Label and Setting Up Plugs, Speakers and Cameras Safely
Description: A practical guide to buying smart home devices in Singapore: what CSA’s Cybersecurity Labelling Scheme means, how to check a product on the official list, what to look for in plugs, speakers and cameras, and how to set them up with good habits.
Primary Keyword: smart home devices cybersecurity label
Secondary Keywords: Cybersecurity Labelling Scheme Singapore, CLS label levels, CSA CLS product list, smart plug SAFETY Mark, IMDA compliance label, smart camera security, router CLS Level 1
Website: wahliao.com
Article Type: Series Guide
Parent Article: How Shopping Works | Electronics Shopping in Singapore
Last checked: 21 October 2026
Quick Answer
Smart home devices are small computers that live in your home.
A smart plug, a smart speaker and a camera all join your Wi-Fi, talk to an app and usually talk to a company’s servers.
The smart home devices cybersecurity label in Singapore is the Cybersecurity Labelling Scheme, run by the Cyber Security Agency of Singapore (CSA).
It rates connected products from Level 1 to Level 4, shown as one to four asterisks.
Residential routers sold here must meet Level 1. For most other smart devices, the label is something the maker chooses to apply for.
A label is a useful signal, but it is not the whole decision.
You still need to check updates, the app, the account, the power safety marks and your own setup.
The smart shopper does not only ask, “Does it work with my phone?” The smart shopper asks, “Who can reach this device, for how long will it be fixed, and what does it know about my home?”
1. A Smart Device Is a Computer With a Job
A normal plug only carries power. A smart one runs software and takes orders from an app. That is the shift worth understanding before you buy smart home devices. The cybersecurity label exists because these products are not just appliances any more. They are connected computers with a narrow job, and computers can have bugs, weak passwords and forgotten settings.
Examples:
a smart plug that switches the water heater or fan on a timer
a smart speaker in the living room that listens for a wake word
an indoor camera that lets you check on a pet from the office
the Wi-Fi router that every one of these devices depends on
Rule: if it connects to the internet, treat it like a computer, not a gadget.
2. The Three Layers of Every Smart Purchase
It helps to see a smart device as three layers stacked together.
The hardware layer — the physical thing. Plug pins, power adaptor, battery, lens, microphone. This is where electrical safety lives.
The network layer — how it talks. Wi-Fi, Bluetooth, sometimes a hub. This is where radio rules and router security live.
The service layer — the app, the account, the cloud servers and the company behind them. This is where updates, privacy and long-term support live.
Different Singapore schemes look at different layers. The SAFETY Mark from the Consumer Product Safety Office (CPSO) is about electrical safety for certain controlled goods. The IMDA compliance label is about telecommunication equipment meeting Singapore’s standards. CSA’s Cybersecurity Labelling Scheme is about how well the device resists attack.
3. What the Cybersecurity Labelling Scheme Is
CSA launched the Cybersecurity Labelling Scheme, often shortened to CLS or CLS(IoT), on 7 October 2020.
It started with Wi-Fi routers and smart home hubs. On 21 January 2021 it was extended to all categories of consumer Internet of Things devices. CSA’s own examples include IP cameras, smart door locks, smart lights and smart printers.
According to CSA, the label shows two things: the product’s cybersecurity level, marked with asterisks, and its registration ID. More asterisks means a higher rating.
Singapore has also signed mutual recognition arrangements on these labels with Finland, Germany and the Republic of Korea. In practice, that means some products tested for those countries’ labels can get Singapore’s label through a simpler route, and the other way round.
As of mid-February 2026, CSA and IMDA said 870 products had attained the CLS label. That sounds like a lot, but it is a small share of everything sold online. Many devices you will see on shopping platforms simply do not carry it.
Rule: the label is evidence, not a guarantee. It tells you what was assessed, at a point in time.
4. The Four Levels, in Plain English
Each level builds on the one below it. Here is how CSA describes them, paraphrased.
Level 1 (one asterisk) — meets basic requirements, such as unique default passwords and providing software updates.
Level 2 (two asterisks) — meets the mandatory requirements of international standards, on top of Level 1.
Level 3 (three asterisks) — built using security-by-design principles, with its software binaries assessed by approved third-party test labs, on top of Level 2.
Level 4 (four asterisks) — has passed structured penetration tests by approved third-party test labs, on top of Level 3.
For a smart plug that only switches a fan, Level 1 or 2 may be a reasonable bar. For a camera that sees into your bedroom, or a lock on your front door, it is fair to want more.
Ask:
How much harm could this device do if someone else controlled it?
Does it have a camera or microphone?
Does it control physical access to my home?
Is the level on the box matched to that risk?
Rule: match the level to the risk. The more a device can see, hear or unlock, the higher the bar.
5. Routers: The One Place the Label Is Required
For most smart devices, the CLS label is something the maker chooses to apply for. Residential routers are different.
IMDA states that all residential routers sold in Singapore must meet CLS Level 1 requirements. That covers unique default passwords, vulnerability management and regular software updates.
On 2 March 2026, CSA and IMDA announced plans to raise this bar from Level 1 to Level 2. The new requirements are expected to take effect by the end of 2027, with details still being worked out. Level 2 adds stronger protection for secure communications, secure storage of sensitive data and robust authentication.
Why the focus on routers? The same announcement said a 2025 international operation found more than 2,700 devices in Singapore, including routers, had been infected and pulled into a botnet that could be used for attacks on other systems.
Rule: fix the router before you add more smart devices.
6. How to Check a Product on CSA’s List
A label printed on a product photo is easy to copy. The official list is harder to fake.
CSA publishes a Cybersecurity Labelling Scheme product list on csa.gov.sg. When we checked in October 2026, each entry showed the status (active or archived), the CLS level, the brand, the model and description, the category, an issued date and an expiry date. You can filter by status, level, brand, category and year.
First, the exact model. A brand can have a labelled router and an unlabelled one with almost the same name. Match the model number on the box or listing, not just the brand.
Second, the dates and status. Labels have an expiry date, and CSA keeps a separate archived list. An archived or expired entry tells you the product was once assessed, not that it still holds the label today.
Ask:
Does the exact model number appear on CSA’s list?
Is its status active?
Is the expiry date still in the future?
Does the level on the list match the level shown on the box or listing?
Rule: trust the list, not the product photo.
7. Smart Plugs: Power Safety Comes First
A smart plug sits between your wall socket and an appliance. Before it is a security question, it is an electrical one.
CPSO regulates 33 categories of Controlled Goods that must carry the SAFETY Mark before they can be supplied in Singapore. The list includes 3-pin mains plugs, multi-way adaptors, portable socket-outlets and AC adaptors. CPSO says it is illegal to advertise or supply Controlled Goods without the SAFETY Mark.
“Smart plug” is not named as its own category on CPSO’s list. Whether a particular product falls under one of the listed categories depends on its design, so this is a question for CPSO, not a guess. What you can check yourself is whether the product carries a SAFETY Mark and whether that mark is real.
CPSO describes the SAFETY Mark as a safety logo with the words “SAFETY MARK”, plus a unique 8-digit registration number. You can enter that number, or the model number, into the Register of Registered Controlled Goods at go.gov.sg/safety-mark, then check the result matches your product and has not expired.
Examples:
a smart plug for a desk lamp or a fan
a smart plug used to schedule a water heater (check the rating carefully)
a smart power strip with several sockets
a smart plug bought from an overseas listing with a non-Singapore plug type
Ask:
Does it have a 3-pin plug made for Singapore sockets?
Is there a SAFETY Mark with an 8-digit number I can look up?
What is its rated current, and what will I connect to it?
If I am unsure whether it is a Controlled Good, have I asked CPSO?
Rule: a smart plug that is unsafe to plug in is not worth securing.
8. Smart Speakers: The Microphone Question
A smart speaker is built to listen. That is its whole job.
On the safety side, CPSO’s Controlled Goods list includes “audio and video products” designed to be fed from the mains. A mains-powered speaker may fall here. Its power adaptor may also be a Controlled Good. Look for the SAFETY Mark and check it on the register.
On the security side, CSA’s IoT advisory suggests switching off features you do not need, such as cameras or microphones, where possible. Many speakers have a physical mute switch. That is worth more than a setting buried three menus deep.
Ask:
Is there a physical microphone mute?
Can I review and delete voice recordings in the app?
Which account does it tie to, and who else in the household can use it?
Can it make purchases by voice, and can I turn that off?
Does it still work for basic tasks if the company’s servers are down?
Rule: a speaker that listens should have an off switch you can see.
9. Cameras: The Highest-Stakes Device in the Home
An indoor camera points into your private life. A door camera points at a shared corridor. Both deserve more care than a plug.
IP cameras are one of the categories CSA names under the CLS. CSA has also issued alerts over the years about vulnerabilities in specific camera models. That is a reminder that cameras are a target, and that updates matter.
Access: who can view the live feed, and how do they log in? Look for support for multi-factor authentication on the account.
Storage: are clips saved on a memory card in the device, on a home recorder, or in the company’s cloud? Cloud storage is convenient, but it may come with a subscription and puts your footage on someone else’s servers.
Lifespan: how long will the maker keep fixing it? A camera that stops receiving updates is still watching your living room.
If you live in an HDB flat and are thinking about a camera facing the common corridor, there are separate rules to check before you install. Our guide to digital locks and door cameras covers that side.
Examples:
a pet camera on a shelf facing the sofa
a baby monitor with app access for both parents
a video doorbell at the main door
a camera kept for a helper’s room or a bedroom (think hard about privacy and consent first)
Rule: buy a camera as if a stranger might one day see what it sees.
10. Updates and Support: The Hidden Expiry Date
Every smart device has two lifespans. One is how long the hardware lasts. The other is how long the maker keeps sending security fixes.
CSA’s advice is to turn on automatic updates where available, check with the manufacturer for devices that do not update on their own, and consider upgrading once a device reaches end-of-life and stops getting security updates.
CSA also suggests buying from reputable manufacturers and looking at how quickly a maker discloses and fixes vulnerabilities. That is something you can actually research: does the brand have a support page, a security page, a list of firmware versions with dates?
Ask:
Does the maker publish how long this model will get security updates?
When was the last firmware update for this model?
Does the device update automatically?
Is this model already old stock, sold cheaply because a newer one replaced it?
Rule: a cheap device with no updates is expensive in a different currency.
11. The App, the Account and the Cloud
Most smart devices are only as good as the app that runs them.
Before you buy, look up the app in your phone’s app store. Check when it was last updated, the permissions it asks for and its privacy section.
Then think about where the device does its thinking.
Cloud-dependent devices send commands through the company’s servers. They are easy to set up and work from anywhere. But if the service changes, gets more expensive or shuts down, the device may lose features.
Local-control devices can work within your home network, sometimes through a hub. They can keep working when the internet is down, and send less data out. They may need a bit more setup.
Personal data is part of this too. Our guide to shopping accounts and personal data explains how the PDPA treats organisations that collect it.
Ask:
Does the device need an account to work at all?
Does the app support multi-factor authentication?
What happens to the device if the app or service is discontinued?
Can I delete my account and data when I stop using it?
Rule: you are not just buying a device. You are signing up to a service.
12. The Singapore Layer
Singapore shoppers have a few local checks that are worth knowing.
The CLS label (CSA). The cybersecurity rating. Required at Level 1 for residential routers; something makers apply for on most other smart devices.
The IMDA compliance label. Telecommunication equipment is registered with IMDA before sale and use, with the supplier declaring that it meets IMDA’s standards. IMDA says its compliance label shows the equipment meets IMDA requirements, is compatible with Singapore’s public networks and should not cause harmful radio interference. It also identifies the registering supplier. IMDA describes it as assurance at the point of purchase.
The SAFETY Mark (CPSO). Electrical safety for the 33 categories of Controlled Goods. Check the 8-digit number on the register. CPSO notes that appliances with a 3-pin plug need two marks, one on the appliance and one on the plug.
There is also the route. A local retailer or official brand store usually sells the Singapore version, with a local plug and support. An overseas listing may be a different variant that is on no Singapore list.
Ask:
Is this the Singapore version, sold by a local seller?
Does it show the IMDA compliance label?
Does it carry a SAFETY Mark where needed?
Is the exact model on CSA’s CLS list?
Rule: three marks, three different questions. Check each one for what it actually covers.
13. Strong Signs and Weak Signs
Strong signs that a smart device is a sound buy:
exact model on CSA’s CLS list, active and unexpired
level matched to the device’s risk
SAFETY Mark that checks out on the register, where relevant
IMDA compliance label on the device or packaging
automatic updates and a recent firmware history
an app that is actively maintained and supports multi-factor authentication
a local seller with a clear warranty and return route
Weak signs:
label shown only in a product photo, not on the official list
an app with no recent updates
the same default password for every unit
no information on updates at all
a non-Singapore plug with a bundled adaptor
a seller who moves the chat to Telegram or asks for PayNow outside the platform
14. A Practical Method: From Shelf to Setup
A simple sequence for any smart device, whether you are at a mall electronics store or scrolling on the MRT.
1. Decide what the device really needs to do
Write the job in one line. “Turn the fan off at 2am.” “See the cat while at work.” If the job does not need the internet, a non-smart timer or product may be simpler and safer.
2. Shortlist by model, not brand
Note the exact model numbers. Check each one on CSA’s CLS product list. Note the level, status and expiry date.
3. Check the power and radio marks
For anything that plugs into the wall, look for the SAFETY Mark and check its number on go.gov.sg/safety-mark. Look for the IMDA compliance label on the device or box.
4. Read the app before you buy
Check the last update date, the permissions, the privacy section and whether an account is required. Look for multi-factor authentication.
5. Choose the seller and route
Prefer a local retailer or official store with a clear warranty. Keep the payment on the platform. Keep the receipt and the box until the return period is over.
6. Set up with good habits
Follow the setup hygiene in the next section. Do it on day one, while you still have the box and the energy.
Rule: the best time to secure a device is the first ten minutes after you open the box.
15. Setup Hygiene: What CSA Recommends
CSA has published advisories on protecting IoT devices and home routers. The habits below are paraphrased from that guidance.
Replace default credentials. Default logins are often posted online. CSA suggests passphrases of at least 12 characters mixing upper- and lower-case letters, numbers and symbols, and turning on multi-factor authentication where offered.
Turn on automatic updates. For devices without them, check the maker’s site and install updates when released.
Switch off what you do not use. Keep a device offline if you do not need its connected features. Disable cameras or microphones you do not need.
Control physical access. Keep devices and their ports away from people who should not be fiddling with them.
For the router specifically, CSA’s advice includes changing the default password, enabling automatic firmware updates and turning off remote management unless you really need it. If a technician sets up a new router, CSA suggests asking them to set a password of your choice and making sure they do not keep access. For a second-hand router, factory reset it first, then set new credentials. CSA also suggests restarting the router every month or two as routine maintenance.
Ask:
Did I change every default password, including the router’s?
Are automatic updates switched on for each device?
Is remote management on the router switched off?
Do I know which account controls each device?
16. When Something Feels Wrong
If a device behaves oddly, start calm and mechanical. Change the account password and turn on multi-factor authentication. Check the app for unknown users or shared access. Update the firmware. If you suspect the router is compromised, CSA notes that a factory reset is more effective than a simple restart, followed by new credentials.
Be careful, too, with anyone who contacts you about your device. A call or message claiming your router is “infected” and asking you to install software or transfer money is a classic scam pattern. CSA and IMDA remind the public that government officials will never call to ask you to transfer money or disclose bank login details. If unsure, call the ScamShield Helpline at 1799.
Rule: fix the device through its own app and the maker’s official site, never through a stranger’s instructions.
Final Summary
Smart home devices are small computers with a narrow job.
CSA’s Cybersecurity Labelling Scheme rates them from Level 1 to Level 4.
Residential routers must meet Level 1, and the bar is planned to rise to Level 2.
For other devices, the label is a choice the maker makes, so its presence is a useful signal.
Check the exact model on CSA’s list, with its status and expiry date.
Check the SAFETY Mark for anything that plugs into the wall, and the IMDA compliance label for anything with a radio.
Then look past the labels to updates, the app and your own setup.
The key question is not “Is this smart?” It is “Can I keep this device safe for as long as I plan to use it?”
Simple Checklist
- Do I know the exact model number?
- Is that model on CSA’s CLS product list, active and unexpired?
- Is the CLS level matched to what the device can see, hear or control?
- If it plugs into the wall, does it have a SAFETY Mark that checks out on the register?
- Does it carry the IMDA compliance label?
- Does the maker say how long it will receive security updates?
- Is the app recently updated, with multi-factor authentication?
- Do I know whether it relies on the cloud or can work locally?
- Am I buying the Singapore version from a seller with a clear warranty?
- Will I change the default password and turn on updates on day one?
If the answer is unclear, pause. A smart device can wait a day. A weak one stays in your home for years.
Where the Facts Come From
CSA: About the Cybersecurity Labelling Scheme for IoT
CSA: CLS(IoT) for Consumers
CSA: CLS(IoT) Updates
CSA: CLS(IoT) Product List Archive
CSA: Government to Raise Cybersecurity Labelling Requirements for Residential Routers
IMDA: Factsheet on Raising Cybersecurity Labelling Requirements for Residential Routers
CSA Advisory: Protecting Your IoT Devices
CSA Advisory: How to Protect Your Router from Hackers
IMDA: Equipment Registration Framework
IMDA: Telecommunication Equipment Labels and Advertisement
CPSO: List of Controlled Goods
CPSO: Look for the SAFETY Mark
Prices, rules and platform features change. We last checked this page on 21 October 2026. General information, not financial, legal or medical advice.
Continue Reading
How Shopping Works | Electronics Shopping in Singapore
How Shopping Works | The Big Picture
Digital Locks and Door Cameras: Costs and the HDB Rules
Shopping Accounts and Your Personal Data: PDPA, Marketing Consent and the Do Not Call Registry
Energy Labels and Climate Vouchers: What the Ticks Mean and How to Spend S$400
Robot Vacuums and Cordless Vacuums: What to Check Before You Buy
Buying Headphones and Earbuds: Wired, Wireless and Noise-Cancelling
Buying an Air-Conditioner in Singapore: System Types, Energy Ticks and Installation
smart home devices cybersecurity label, Cybersecurity Labelling Scheme Singapore, CLS label levels, CLS Level 1, CLS Level 4, CSA CLS product list, CSA smart device label, IoT security Singapore, smart plug Singapore, smart plug SAFETY Mark, smart speaker privacy, smart speaker microphone mute, home camera security, IP camera Singapore, video doorbell security, baby monitor security, pet camera app, router CLS requirement, residential router Level 2, home router security tips, change default password, firmware updates, end-of-life devices, IMDA compliance label, IMDA equipment registration, SAFETY Mark register, Controlled Goods CPSO, multi-way adaptor SAFETY Mark, cloud vs local control, smart home app permissions, multi-factor authentication, factory reset second-hand device, HDB smart home, mesh Wi-Fi HDB, Singapore version electronics, parallel import smart device, ScamShield 1799, smart home setup checklist, electronics shopping Singapore
