Introduction

Singapore’s CII Cybersecurity Assessment Framework focuses on protecting Critical Information Infrastructure (CII), which is fundamental to Singapore’s national security, economic stability, and delivery of essential services. Industries such as energy, water, banking and finance, healthcare, transportation, telecommunications, media, and government rely on interconnected information technology and operational technology systems to maintain continuous operations.

As critical infrastructure becomes increasingly digitalised, the cybersecurity risks associated with these environments continue to grow. Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA) platforms, enterprise networks, cloud services, remote access technologies, and third-party connections create a complex technology landscape that requires continuous security oversight.

A cybersecurity incident affecting these environments can have consequences beyond financial losses. It may interrupt essential services, compromise sensitive information, disrupt industrial processes, and affect public safety.

Singapore has established a regulatory framework through its Cybersecurity Act 2018 and the Cybersecurity Code of Practice for Critical Information Infrastructure (CII) to strengthen the cybersecurity and resilience of essential services. The framework establishes responsibilities for CII owners, including cybersecurity risk assessments, compliance audits, incident reporting, and the implementation of appropriate security controls.

The updated Cybersecurity Code of Practice for Critical Information Infrastructure, effective from 29 July 2026, further strengthens expectations around cybersecurity governance, asset visibility, vulnerability management, threat detection, incident response, and operational technology security.

For infrastructure operators, understanding these requirements is essential to maintaining operational resilience and managing cybersecurity risks effectively.

A structured CII Cybersecurity Assessment helps organisations evaluate their existing security posture, identify vulnerabilities, address compliance gaps, and strengthen protection across interconnected IT and OT environments.

Understanding Singapore’s CII Cybersecurity Assessment Framework

Singapore’s CII cybersecurity requirements are primarily established through the Cybersecurity Act and the Cybersecurity Code of Practice for Critical Information Infrastructure issued by the Cyber Security Agency of Singapore (CSA).

The framework establishes minimum cybersecurity requirements that designated CII owners must implement to protect their critical systems and interconnected infrastructure.

The framework covers several essential areas:

• Cybersecurity Governance: Establishing management accountability, cybersecurity policies, risk ownership, and oversight.

• Asset Identification: Maintaining visibility of critical IT and OT assets, dependencies, and network connections.

• Risk Management: Identifying cybersecurity threats, analysing potential consequences, and implementing appropriate mitigation measures.

• Security Protection: Implementing access controls, network segmentation, system hardening, vulnerability management, and secure remote access.

• Threat Detection: Monitoring infrastructure, analysing security events, and identifying suspicious activities.

• Incident Response and Recovery: Establishing procedures for incident management, crisis communication, business continuity, and disaster recovery.

• OT Security: Protecting industrial control systems, field controllers, communication networks, and operational processes.

The CII sectors covered by Singapore’s framework include energy, water, banking and finance, healthcare, transport, infocomm, media, security and emergency services, and government.

Importantly, the framework is not limited to individual critical systems. It also addresses interconnected systems owned, operated, or controlled by CII owners that communicate with or connect to designated CII.

This broader approach helps prevent attackers from exploiting less-protected connected systems as entry points into critical infrastructure.

Key Regulatory Requirements for CII Operators in Singapore

The Cybersecurity Act establishes statutory responsibilities for designated CII owners, while the CII Cybersecurity Code of Practice specifies the security controls and operational practices required to meet those responsibilities.

1. Cybersecurity Risk Assessment

CII operators must conduct cybersecurity risk assessments at least annually, identifying potential vulnerabilities, evaluating the likelihood and consequences of cyber threats, and determining appropriate risk treatment actions.

The assessment should consider:

• Critical infrastructure assets and their dependencies.

• Potential cybersecurity threats and vulnerabilities.

• Likelihood of exploitation and operational consequences.

• Existing security controls and residual risks.

• Risk mitigation plans and responsible personnel.

The findings should be documented and maintained through an appropriate cybersecurity risk register.

2. Cybersecurity Compliance Audits

CII owners are required to arrange cybersecurity compliance audits at least once every two years, subject to the applicable statutory requirements and any higher frequency directed by the Commissioner of Cybersecurity.

These audits evaluate compliance with the Cybersecurity Act and applicable codes of practice and standards of performance.

Organisations must engage auditors approved or appointed under the applicable requirements. Audit findings should be addressed through documented remediation plans and appropriate management oversight.

3. Vulnerability Assessment and Penetration Testing

The updated CII Code of Practice establishes specific vulnerability assessment and penetration testing expectations.

Key requirements include:

• Vulnerability Assessment of IT-based CII at least once every 12 months.

• Vulnerability Assessment of OT-based CII at least once every 24 months.

• Penetration Testing of IT-based CII at least once every 12 months.

• Penetration Testing of OT-based CII at least once every 24 months.

• Additional assessments following major system changes, where applicable.

The Code also requires CII owners to engage appropriately accredited penetration testing service providers and competent, certified penetration testers. Testing must be supervised by the CII owner to ensure that activities remain within scope and do not disrupt operations.

4. Incident Reporting and Response

CII operators must establish appropriate mechanisms to detect cybersecurity threats and incidents and fulfil applicable incident notification obligations.

The framework also emphasises incident management, crisis communication, cybersecurity exercises, and recovery planning.

5. Governance and Management Accountability

Cybersecurity is not solely an IT responsibility. The framework places accountability on the Board and senior management to oversee cybersecurity risks, establish appropriate governance structures, allocate resources, and maintain cyber resilience.

These requirements make cybersecurity a continuous organisational responsibility rather than an isolated technical activity.

Implications for Critical Infrastructure Operators

The CII cybersecurity requirements have important operational, technical, and management implications for organisations responsible for essential services.

1. Greater Accountability at Management Level

Infrastructure operators must establish clear cybersecurity responsibilities across executive management, technical teams, and operational departments.

Boards and senior management need visibility into cybersecurity risks, remediation progress, resource requirements, and operational resilience.

This requires documented governance processes and regular reporting.

2. Increased Investment in Security Assessments

Organisations must allocate resources for recurring cybersecurity risk assessments, vulnerability assessments, compliance audits, and penetration testing.

Operators with complex infrastructure may also require specialised OT security assessments to evaluate industrial systems without affecting operational availability.

3. Stronger IT and OT Integration Security

Modern infrastructure environments increasingly connect corporate IT networks with industrial control environments.

This creates opportunities for attackers to move between networks if appropriate segmentation and access controls are not implemented.

Operators must evaluate network boundaries, communication pathways, remote access connections, and security controls across interconnected systems.

4. Improved Third-Party Risk Management

External vendors, maintenance contractors, equipment manufacturers, and technology service providers may have access to critical infrastructure.

Operators need stronger oversight of third-party access, contractual security obligations, remote maintenance arrangements, and supplier-related cybersecurity risks.

5. Continuous Monitoring and Incident Preparedness

Meeting cybersecurity requirements involves more than conducting periodic assessments.

Infrastructure operators must strengthen threat detection, logging, security monitoring, incident response procedures, and recovery capabilities.

This enables organisations to identify suspicious activities and respond before incidents significantly affect essential services.

6. Compliance Readiness and Documentation

Organisations must maintain appropriate documentation to demonstrate that cybersecurity controls are implemented and operating effectively.

This includes asset inventories, risk registers, security policies, assessment reports, remediation records, incident response procedures, and audit evidence.

Our Methodology for CII Cybersecurity Assessment Framework

Cyberintelsys follows a structured and risk-based methodology to evaluate cybersecurity weaknesses, assess infrastructure exposure, and help organisations strengthen their security posture in line with applicable CII requirements.

1. Scope Definition and Infrastructure Review

The assessment begins with identifying critical infrastructure components, understanding operational dependencies, and defining the assessment scope.

Activities include:

• Reviewing IT and OT architecture.

• Identifying critical systems and supporting assets.

• Understanding operational processes and dependencies.

• Reviewing existing cybersecurity policies and documentation.

• Establishing testing boundaries and operational limitations.

2. Asset Discovery and Network Mapping

A comprehensive asset inventory helps identify exposed systems and potential attack pathways.

The assessment reviews servers, network devices, industrial controllers, engineering workstations, applications, communication systems, and external connections.

Network mapping also identifies IT/OT connectivity, third-party access pathways, and potential weaknesses in network segmentation.

3. Cybersecurity Risk Assessment

Cyberintelsys evaluates potential threats and vulnerabilities based on their likelihood and possible consequences.

The assessment considers:

• Asset criticality and operational importance.

• Threat scenarios and potential attack vectors.

• Existing security controls.

• Business and operational impact.

• Risk prioritisation and mitigation requirements.

For OT environments, process safety considerations and applicable non-digital engineering controls are also taken into account.

4. Vulnerability Assessment

Vulnerability assessments identify security weaknesses across infrastructure components, including operating systems, network devices, applications, servers, and industrial environments.

Findings are classified according to severity, exploitability, and operational impact to support effective remediation.

5. Penetration Testing and Security Validation

Controlled penetration testing evaluates whether identified vulnerabilities can be exploited to gain unauthorised access or compromise critical systems.

Depending on the approved scope, testing may include external, internal, network, web application, and specialised OT security testing.

All activities are planned with appropriate authorisation and safeguards to avoid unnecessary operational disruption.

6. Security Control and Compliance Review

Existing controls are reviewed against applicable CII cybersecurity requirements.

The review covers access management, privileged accounts, network segmentation, remote access, system hardening, patch management, logging, monitoring, incident response, and recovery procedures.

7. Reporting and Remediation Planning

The final assessment report documents identified vulnerabilities, risk ratings, affected assets, potential operational consequences, and recommended corrective measures.

Remediation activities are prioritised according to risk severity and infrastructure criticality.

8. Retesting and Security Improvement

Following remediation, retesting can help verify whether identified vulnerabilities have been resolved and security controls are functioning as expected.

This supports continuous improvement and strengthens long-term infrastructure resilience.

Cyberintelsys Services for CII Cybersecurity Compliance

Cyberintelsys offers specialised cybersecurity services to help infrastructure operators identify weaknesses and improve their security posture.

1. OT Security Assessment

Evaluates the cybersecurity of ICS, SCADA, PLCs, engineering workstations, and industrial communication networks. The service identifies weaknesses in OT architecture, configurations, access controls, and network connectivity while considering operational safety and availability.

2. Vulnerability Assessment

Identifies known security vulnerabilities across networks, servers, endpoints, applications, and industrial systems. Findings are prioritised to help organisations address high-risk weaknesses and maintain a stronger security posture.

3. Penetration Testing

Uses controlled attack simulations to evaluate the effectiveness of security controls and determine whether vulnerabilities can be exploited. Testing may cover external infrastructure, internal networks, applications, and approved OT environments.

4. Network Security Assessment

Reviews network architecture, firewall configurations, access restrictions, network segmentation, and communication pathways to identify weaknesses that could expose critical infrastructure.

5. Web Application Security Testing

Examines applications, portals, and administrative interfaces for authentication weaknesses, access control issues, injection vulnerabilities, and insecure configurations.

6. Third-Party Security Assessment

Evaluates external vendor access, remote maintenance connections, supplier dependencies, and third-party security controls to reduce supply chain risks.

7. Cybersecurity Consulting and Remediation Support

Provides technical guidance on addressing assessment findings, strengthening security controls, improving risk management, and preparing for applicable cybersecurity compliance requirements.

Why Choose Cyberintelsys?

Selecting a qualified cybersecurity partner is important when assessing systems that support essential services.

Cyberintelsys combines cybersecurity testing expertise with an understanding of IT and OT environments.

Key credentials include:

• Cybersecurity Service Provider (CSP) Licence – Singapore: Licensed to provide cybersecurity services in Singapore, including penetration testing, as applicable to the scope of the licence.

• CREST Accreditation: Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognized security testing services for organizations across multiple sectors.

• ISO/IEC 27001:2022 – UKAS-Accredited Certification: Certified for Information Security Management Systems (ISMS) through Bureau Veritas under UKAS accreditation.

• ISO/IEC 27001:2022 – SAC-Accredited Certification: Certified through Bureau Veritas under Singapore Accreditation Council (SAC) accreditation.

Additional strengths include:

• Expertise in IT and OT cybersecurity assessment.

• Risk-based testing methodologies.

• Practical and actionable remediation recommendations.

• Security assessments designed around infrastructure criticality.

• Support for organisations seeking to strengthen cybersecurity and compliance readiness.

Contact Cyberintelsys

Singapore’s CII cybersecurity requirements highlight the importance of proactive security assessments, effective risk management, and continuous operational resilience.

For infrastructure operators, addressing cybersecurity weaknesses is essential to protecting critical systems, maintaining essential services, and meeting applicable regulatory obligations.

Cyberintelsys helps organisations strengthen their security posture through OT Security Assessment, Vulnerability Assessment, Penetration Testing, Network Security Assessment, and specialised cybersecurity consulting.

Strengthen your critical infrastructure security with Cyberintelsys.

Contact us to discuss your CII cybersecurity assessment requirements and take proactive steps towards improving infrastructure security, operational resilience, and compliance readiness.