How Missed Cybersecurity Requirements Eat Into Profit of Government Projects

In Singapore’s competitive government project scene, winning the tender often feels like the hardest part.

But for many M&E vendors, the real challenge — and the real cost — comes after the win.

Time and again, we see vendors discover after signing the contract that the project includes strict government cybersecurity compliance requirements.

These requirements aren’t optional — and meeting them often means buying additional hardware, software and security services they never budgeted for.

The result?

Your project margin shrinks… sometimes to the point where it feels like you’re doing the work for free.

Why This Happens

There are three main reasons why M&E vendors get caught off guard:

1. Tucked away from the main scope

Cybersecurity specifications are often in other annexes of the tender, not in the main scope.

2. Assumption That It’s the Main Contractor’s Job

Many assume the main contractor or IT subcontractor handles compliance. In reality, the M&E scope often includes specific network, device and access security obligations.

3. Last-Minute Realisation During Project Kick-off

Many M&E vendors underestimate security requirements, assuming they’re not mandatory or that the scope is small enough to handle internally — only to find out later that compliance is far more demanding

Where the Additional Security Budget Goes

Government projects in Singapore often follow IM8, GovTech or CSA cybersecurity frameworks.

Common additional spending include:

Firewalls are needed between network segments but wasn’t planned for in the design
Additional hardware is required to segment OT and IT networks
Intrusion Detection System (IDS) is required to identify and flag anomalies
A syslog server is required for 1 year-long log retention and analysis
Multi-factor authentication (MFA) required for workstations
WSUS setup for OT and air-gapped environments for Windows Patching
Independent assessor to evaluate cybersecurity compliance and/or conduct VAPT

Each of these can cost anywhere from a few thousand to tens of thousands of dollars—expenses that directly reduce your profit if not accounted for in the tender.
Even more critical, failing to meet these requirements can delay project delivery, impact payment milestones and in the worst case, lead to penalties and damage to your reputation.

How to Avoid This

The good news: these costs are avoidable if you plan cybersecurity compliance from Day 1.

Here’s what successful M&E vendors do:

Review the Tender for IT & Cybersecurity Clauses
- Don’t only focus on the main technical specs — review the Cyber Security annexes and government security requirements to understand which apply based on the assets within your project scope.
Engage a Cybersecurity Compliance Partner Early
- A specialist can guide you on the necessary compliance measures before you finalize your quote. They can also streamline the network design to reduce the chances of incurring extra costs for additional hardware.
Include Compliance Costs in Your Tender Price
- This safeguards your profit margin and helps you avoid difficult “we need more budget” discussions with the client. Typically, once the contract is awarded, you won’t be able to raise your price to cover unexpected cybersecurity costs.
Standardise a Compliance Checklist for Your Projects
- Having a ready reference means your team won’t miss requirements in future bids.

The Competitive Edge

When you factor cybersecurity into your tender from the start, you:

Avoid margin erosion
Prevent project delays from last-minute procurement
Win client trust by demonstrating you understand and can deliver on government standards
Stand out from competitors who still treat cybersecurity as “someone else’s problem”

How Perennial Helps

Perennial can be engaged during the presales stage of a tender to guide M&E vendors on cybersecurity requirements and network design. By addressing these considerations early, we help ensure compliance, reduce design rework and minimize unexpected costs that can erode project profitability.