General information, not legal advice. Rules change — verify against the live agency source (linked throughout) before relying on any figure or date. Facts current as of 2026.
Free Singapore RFQ builder
Build a procurement-ready RFQ.
Choose the project category, tailor the evidence you need, then download the RFQ or share it with up to three category-matching vendors already in your comparison shortlist.
Governance, SLA, escalation, incident-notification fit with your 3-calendar-day PDPA clock, and a handover/exit plan.
SLA checklist
Pressure-test uptime, support, measurement, exclusions, credits, and exit.
Availability target and exactly how it is measured.
Support hours, response time, restoration time, and escalation tiers.
Maintenance windows, exclusions, and customer responsibilities.
Service credits, reporting cadence, and the evidence required to claim credits.
Change management, incident postmortems, and incident-notification timelines that fit your 3-calendar-day PDPA breach clock.
Termination assistance, data export, and a documented handover.
Security diligence
Ask for PDPA posture, licensing, access control, and audit evidence.
PDPA handling: the 11 obligations, a named Data Protection Officer (DPO), and a breach plan that reaches you fast enough for your 3-calendar-day PDPC notification.
Licensing: a current CSA licence (via CSRO) for any penetration testing or managed-SOC work — the only two licensable service types.
Access control: MFA, privileged-access management, and a joiner-mover-leaver process.
Infrastructure security: patching, vulnerability scans, endpoint controls, and tested backups.
Certifications as signals, not proof: ISO/IEC 27001, Cyber Essentials, Cyber Trust (2025) — verify them.
Subprocessors and data residency: cloud regions, third parties, audit rights, and where personal data goes.
Category-specific diligence
Every category carries its own licences, certifications, and red flags. Jump to the cluster that fits your project.
Telecom & Connectivity
What to demand
Local network delivery proof — installed base, coverage, and response times in Singapore.
Link and uptime SLA with clear measurement, plus a PSTN-to-SIP or number-portability migration plan where relevant.
Spectrum and coverage evidence for any wireless or IoT service, and equipment that meets IMDA registration rules.
Licences & certifications to verify
Which IMDA licence covers the service: FBO (owns/operates facilities) vs SBO (resells), and Individual vs Class.
IMDA-registered/approved equipment for anything imported or deployed.
For a public IoT network in licensed spectrum, the vendor’s FBO or Class-licence position.
Red flags
Cannot state which IMDA licence class covers what they sell.
Reselling telco lines with no SBO position, or deploying facilities with no FBO position.
Coverage or uptime claims with no measurement or evidence.
Selling to Singapore government runs through GeBIZ (run by AGD, under the Ministry of Finance). The mechanics differ from private-sector buying — here is the track.
Mode
Typical value
What to know
Small Value Purchase (SVP)
Up to ~S$6,000
Direct purchase; minimal bid effort.
Invitation to Quote (ITQ)
~S$6,000–90,000
Open quotation on GeBIZ (or a Limited Quotation to selected suppliers). Price-led, but the lowest quote does not automatically win.
Tender Lite
~S$90,000–1,000,000
Simplified tender conditions; covers ICT goods and services from end April 2026.
Invitation to Tender (ITT)
Above ~S$90,000
Detailed spec; often two-envelope / price-quality method. Selective tenders pre-qualify via an EOI first.
Period Contract
Multi-year
Standing contract for repeated drawdowns.
Request for Information (RFI)
Pre-procurement
Shapes the eventual tender; no award.
From registration to payment
Register as a GeBIZ Trading Partner (free) with your UEN and CorpPass.
Complete every mandatory declaration (anti-bribery, conflict of interest, debarment) — they are pass/fail gates.
Use the agency’s price schedule format exactly, and raise problems during clarifications — silence on the Conditions of Contract counts as acceptance.
Never vary the Conditions of Contract in place. Submit a compliant base offer, then put any proposed change in a separate alternative offer — an in-place deviation reads as non-compliance.
Mind the mechanics: 35 MB per uploaded file, no amendments or extra information after closing, and late bids are simply not accepted.
After award: Letter of Acceptance, then Purchase Order — quote the PO number on everything; any scope change needs a Variation Order.
Invoice through InvoiceNow (Peppol), now the default government channel, with Vendors@Gov being phased out; the default payment term is 30 days unless your contract agrees otherwise.
Protect your standing: poor delivery or missed SLAs can lead to debarment from future government procurement.
Phased GST InvoiceNow mandate — new voluntary GST registrants from 1 Apr 2026, existing businesses 2028–2031; onboarding grant up to S$1,000 (SME) / S$5,000 (larger).
Your business’s mandate date (IRAS notifies pre-2026 registrants by mid-2026) and your Peppol Access Point.
Copy these into your RFQ or a first call. Each group is one click to copy.
Scope & delivery
What comparable Singapore projects have you delivered in the last 24 months, with reachable references?
Who is on the delivery team, and are they local or offshore?
What does your project governance, milestone sign-off, and handover look like?
Singapore fit & licensing
What is your UEN, and which IMDA or CSA licence covers this specific service?
Can you show the current licence and its validity?
Which vendor/partner certifications are relevant here, and can we verify them?
Security & PDPA
Who is your Data Protection Officer, and what is your breach-notification process and timeline back to us?
For any penetration testing or managed-SOC work, can you show your current CSA licence?
Which certifications do you hold (ISO/IEC 27001, Cyber Essentials, Cyber Trust, MTCS), and what is their scope and validity?
Data location & exit
Where is our data stored and processed, and who can access it?
What is the data-export format and handover process if we terminate?
Which subprocessors do you use, and where are they?
Commercial & SLA
What is the pricing model, what is excluded, and how is GST handled?
What are the SLA targets, exactly how are they measured, and what service credits apply?
What happens to price on renewal or in a multi-year term?
Copy-paste contract clauses
These are template clauses to start a conversation, not legal advice. Adapt them to your contract with qualified legal advice.
PDPA data-processing
The Vendor shall process Personal Data only on the Customer’s documented instructions and solely to provide the Services, maintain reasonable security arrangements, and assist the Customer with access and correction requests. The Vendor shall notify the Customer without undue delay, and in any case within [24] hours of becoming aware of a data breach, providing enough detail for the Customer to meet its 3-calendar-day PDPC notification obligation.
Audit rights & supervisory access
On reasonable notice, the Customer (and, where the Customer is regulated, its auditors and the Monetary Authority of Singapore) may audit the Vendor’s controls, records, and premises relevant to the Services. For any material outsourcing, the Vendor shall support annual reviews and preserve regulatory supervisory access for the term and any exit period.
Incident-notification SLA
The Vendor shall notify the Customer of any security incident affecting the Services within [X] hours of detection, with a severity classification, initial impact assessment, and evidence retention. The Vendor shall provide updates at agreed intervals and a written post-incident review within [Y] business days.
Data location & access
The Vendor shall store and process Customer Data only in [approved locations] and shall not relocate or grant access outside those locations without the Customer’s prior written consent. The Customer, its auditors, and its regulators shall retain access to the data and the Vendor for as long as the arrangement and applicable rules require.
Exit & handover
On expiry or termination the Vendor shall, at the Customer’s election, return or securely delete all Customer Data in an agreed machine-readable format, provide transition assistance for up to [X] days, and certify deletion in writing. The Vendor shall not withhold data or handover pending any dispute over fees.
IP ownership & source-code escrow
All deliverables and custom-developed materials shall vest in the Customer on payment. Pre-existing Vendor IP is licensed to the Customer to the extent needed to use the deliverables. For business-critical custom software, the Vendor shall place source code and build instructions in escrow with [escrow agent], released on defined trigger events.
Procurement FAQ
Do I need to check a vendor’s IMDA or CSA licence?
Only for specific services. Telecom services need an IMDA FBO or SBO licence; penetration testing and managed-SOC monitoring need a current CSA licence (via the CSRO). Most other IT services are not licensable, so the absence of a licence is only a red flag for those specific service types.
What must a vendor prove about PDPA compliance?
A named Data Protection Officer, a grasp of the 11 PDPA obligations, and a breach-notification process that gets information to you fast enough to meet your own 3-calendar-day PDPC notification window. Ask before you hand over any personal data.
Which grant can I use for a tech purchase?
Today, the Productivity Solutions Grant (PSG) funds up to 50% of qualifying pre-approved solutions — but you must apply before committing to purchase. From 2H 2026, EDGE consolidates PSG, EDG and MRA into one grant of up to S$100,000/year, extended to non-SMEs.
Do I need to be on InvoiceNow?
Increasingly, yes. The GST InvoiceNow requirement is phasing in: new voluntary GST registrants from 1 April 2026, and existing GST-registered businesses between 2028 and 2031 by turnover band. IRAS will notify pre-2026 registrants of their date. Connect through a Peppol Access Point.
What certifications should I look for?
ISO/IEC 27001, the CSA Cyber Essentials or Cyber Trust (2025) marks, MTCS SS 584 tier for cloud, and ISO/IEC 42001 for AI management. Treat them as maturity signals to verify (scope and validity), not as proof of a good fit.
How is buying from government different?
Public-sector buying runs through GeBIZ, with defined modes (SVP, ITQ, ITT, period contracts), CorpPass registration, pass/fail mandatory declarations, invoicing via Vendors@Gov and InvoiceNow, 30-day payment from a valid invoice, and debarment risk for poor delivery.
Updates without email
Newsletter signup is paused
We are not accepting email addresses while the operator identity, email processor, retention schedule, confirmation process, and unsubscribe lifecycle remain unpublished.