Singapore: New Security Standards for Home Gateways

Singapore will adopt TS RG-SEC Issue 2, setting new security standards for residential gateways, following IMDA regulations published in June 2026.

Technical Specification TS RG-SEC Issue 2 will take effect in December 2026. Therefore, manufacturers or importers who are not yet aware of this should pay special attention to this matter.

This article will explain the details of the new regulations for security requirements for residential gateways as outlined in TS RG-SEC Issue 2.

Who Issued This Regulation?

New security requirements for residential gateways have been issued by the Infocomm Media Development Authority (IMDA). This is Singapore’s national regulatory agency for the communications and media sector. 

IMDA is responsible for establishing technical standards, ensuring compliance, and protecting the country’s digital infrastructure. Therefore, the authority has issued TS RG-SEC Edition 2 to strengthen its role in protecting consumers.

Additionally, IMDA is also educating manufacturers to enhance the security of their products by implementing stricter cybersecurity practices.

What Has Changed in TS RG-SEC Issue 2?

Essentially, the changes in TS RG-SEC Issue 2 relate to the establishment of basic requirements for residential gateways under the Cybersecurity Labeling Scheme (CLS) Level 2. There are three notable changes in these regulations: revisions to the Security Requirements section, a new CLS Level 2 clause, and updated appendices.

• Revisions to the “Security Requirements” Section: Several security clauses have been removed or revised, and a data protection clause has been added as clause 4.4.
• New CLS Level 2 Clauses: Residential gateways must now comply with the basic requirements of CLS Level 2.
• Updated Appendices: Appendix A (compliance checklist) has been updated to align with the new clauses. Appendix B (corrections and additions) has been added as a supplementary appendix.

Strengthening Home Networks

Until now, home network security has been a vulnerable sector. The rise in cyberattacks targeting private home networks has caused significant concern. 

The new regulations for security requirements for residential gateways, implemented by IMDA, are intended solely to strengthen residential network security and prevent cyberattacks. Additionally, these regulations ensure that connected IoT devices meet higher minimum security standards.

Why Are These Regulations Important?

Singapore remains committed to strengthening its digital ecosystem. The implementation of TS RG-SEC Edition 2 is a concrete step toward that goal. This regulation addresses the rapid growth of IoT devices in households, which are increasingly vulnerable to cyberattacks. 

IMDA seeks to protect its citizens by enforcing stricter requirements. This regulation safeguards consumers from unauthorized access, data breaches, and evolving cyber threats.

Furthermore, this regulation also builds trust in connected technologies. Singapore aims to maintain its position as a leader in cybersecurity standards in the region.

This new regulation is not only important for Singapore but also has implications for its neighboring countries, given the rapid adoption of smart home technology in Southeast Asia as well.

These countries may well look to the framework that Singapore has already established. These standards could serve as a reference for strengthening their own cybersecurity standards.

These clear benchmarks position Singapore as a model of digital resilience in the region. As a result, the harmonization of security practices across the ASEAN market will be naturally driven forward.

What Do Manufacturers and Importers Need to Know?

These regulatory changes naturally require manufacturers and importers to adapt. In response to this, devices must undergo a conformity assessment in accordance with TS RG-SEC Issue 2.

There are several technical requirements that devices must meet, including:

• Complex, non-default passwords: Passwords must be at least 10 characters long and include complex components: uppercase letters, lowercase letters, numbers, and special characters (must meet at least 2 of these components). Additionally, the login ID and password must not be the same.
• Secure firmware updates: Manufacturers must ensure that no sensitive data, such as credentials, is embedded in the code and that updates are transmitted via a secure connection.
• Data and credential encryption: The encryption must be replaceable to allow for the adoption of stronger algorithms without significant changes to the device.
• Disabling default IPv6 tunneling: Residential gateways must disable by default any features that send network statistics back to the manufacturer.

Failure to comply with these new specifications may result in restrictions on market access. Early adaptation will ensure that manufacturers and importers can continue to market their residential gateways in Singapore without disruption.

New Regulatory Timeline

Following the publication of TS RG-SEC Issue 2 in June 2026, new regulations regarding security requirements for residential gateways will take effect in early December. Device registration may still use the final Issue 1 until December 7, 2026.

On December 8, 2026, all new models must comply with Issue 2. This requirement is in effect for one year, until December 31, 2027. After that, all residential gateways sold in Singapore must comply with Issue 2.

Therefore, it is important for manufacturers and importers to comply with these latest regulations from the outset. This will facilitate smooth market access and ensure long-term competitiveness in Singapore.