The Infocomm Media Development Authority (IMDA) has published Issue 2 of its Technical Specification for Security Requirements for Residential Gateways (IMDA TS RG-SEC), dated June 2026. The new issue replaces TS RG-SEC Issue 1 from October 2020 and reflects the uplift from Cybersecurity Labelling Scheme (CLS) Level 1 to CLS Level 2. It sets minimum security requirements for the design and management of residential gateways, the home networking devices that connect household and IoT devices to an internet access service provider’s network. The specification must be read together with the CLS for IoT Publication No. 4A, and its controls apply in addition to, not in place of, the CLS baseline requirements.
What Changed in TS RG-SEC Issue 2
Issue 2 now references the CLS for IoT Publication No. 4A, which sets the baseline requirements for home gateways under CLS Level 2. Clauses already covered by Publication No. 4A have been removed, while clauses not covered there have been kept in TS RG-SEC. The main changes include:
- Section 4 revisions: Several security clauses were removed or revised, and the former data protection clause was renumbered as clause 4.4.
- New CLS Level 2 clause: Residential gateways must now comply with the CLS Level 2 baseline requirements.
- Updated annexes: Annex A (conformance checklist) was updated to match the new clauses, and Annex B (corrigendum and addendum) was added.
Password, Authentication and Credential Requirements
- Minimum password strength: Passwords for the administrative login page and configuration settings must be unique, at least 10 characters long and meet at least 2 of 4 complexity rules (uppercase, lowercase, digit, special character). Passwords must not contain consecutive identical characters, and the login ID and password must not be the same.
- Authentication handling: Unprotected access to the management webpage is prohibited. Login accounts must be blocked after a fixed number of failed attempts, with a secure alternative authentication mechanism available when an account is blocked.
- Credentials handling: Password fields must prevent their contents from being copied, passwords must always be masked, and network management credentials, such as TR-069 remote login credentials, must not be displayed on the management web page.
Device Settings, Firmware Updates and Data Protection
- Pre-loaded settings: Where these features exist, residential gateways must disable by default any feature that sends network statistics back to the manufacturer, as well as IPv6 tunnelling mechanisms such as Teredo, 6to4 and ISATAP.
- Firmware updates: Manufacturers must ensure patches do not contain sensitive data such as hardcoded credentials and are transmitted over a secure connection.
- Data protection: Encryption algorithms must be replaceable, so stronger algorithms can be adopted without significant changes to the device.
- CLS Level 2: Residential gateways must comply with the CLS Level 2 baseline requirements in the CLS for IoT Publication No. 4A.
Conformance Checklist and Supplier's Declaration of Conformity
Annex A of TS RG-SEC provides a conformance checklist to support the Supplier’s Declaration of Conformity. All requirements are mandatory, except the pre-loaded settings in clause 4.2.1, which are conditional on the features being available in the residential gateway. For the supporting documents needed to show compliance during equipment registration, suppliers should refer to IMDA’s RG Equipment Registration Security Validation Guide.
For this article’s source information and any product certification guidance, please contact Global Validity.
Quick Country Facts
Singapore
Certification Body: Infocomm Media Development Authority (IMDA)
Certification Type: Mandatory
License Validity: 60 Months
Application Language: English
Legal License Holder: Local Representative
In-Country Testing Requirement: Testing Not Required
The regulatory information above is based on radio type approval certification. Access additional certification requirements in over 200 countries and territories with Global Validity’s free proprietary product certification management software, Access Manager. Learn more about the platform here or fill our quick contact form!
Global Validity is your partner for global certification success
Want to learn more about regulatory compliance and how we can help? Simply fill out the form below and we’ll be in touch!