Introduction
Critical Information Infrastructure (CII) plays an essential role in supporting Singapore’s economy, national security, and everyday life. Essential services such as banking, healthcare, energy, water, transportation, telecommunications, and government operations depend heavily on secure and reliable digital infrastructure.
As these services become increasingly interconnected, cybersecurity threats pose significant risks to business continuity, public safety, sensitive information, and national security. A successful cyberattack against critical systems could disrupt essential services and create consequences beyond the affected organization.
To address these risks, Singapore has established a comprehensive cybersecurity regulatory framework through the Cyber Security Agency of Singapore (CSA). The framework places specific cybersecurity responsibilities on organizations designated as CII owners, requiring them to maintain appropriate security controls, conduct risk assessments, undergo cybersecurity audits, and perform cybersecurity exercises.
Within this environment, cybersecurity assessments and penetration testing are important activities for identifying vulnerabilities, evaluating security controls, and improving the resilience of essential services.
However, CII organizations must consider more than simply conducting security tests. They must also understand the applicable regulatory requirements, testing frequency, provider qualifications, operational restrictions, and security implications of assessing critical IT and Operational Technology (OT) environments.
This article explores the key CII cybersecurity assessment and penetration testing considerations for organizations supporting Singapore’s essential services, including the relevant regulatory framework and how Cyberintelsys supports organizations in strengthening their cybersecurity posture.
Understanding Singapore’s CII Regulatory Framework
The Cybersecurity Act 2018 establishes the legal framework for protecting Singapore’s Critical Information Infrastructure and strengthening national cybersecurity resilience.
The Cyber Security Agency of Singapore oversees the implementation of this framework and works with CII owners to ensure that critical systems are appropriately protected against cyber threats.
CII refers to computer systems that are necessary for the continuous delivery of essential services. Singapore identifies the following 11 CII sectors:
Government
Infocomm
Energy
Aviation
Maritime
Land Transport
Healthcare
Banking and Finance
Water
Security and Emergency Services
Media
Organizations operating within these sectors are not automatically designated as CII owners. CII designation is determined under the Cybersecurity Act based on the importance of the relevant computer systems to essential service delivery.
1. Key Cybersecurity Responsibilities of CII Owners
Organizations designated as CII owners have specific responsibilities under Singapore’s Cybersecurity Act.
These include:
Maintaining appropriate cybersecurity measures to protect designated CII systems.
Conducting regular cybersecurity risk assessments.
Arranging cybersecurity audits within the prescribed frequency.
Reporting relevant cybersecurity incidents to CSA.
Participating in cybersecurity exercises when required.
Maintaining compliance with applicable cybersecurity Codes of Practice and Standards of Performance.
The requirements are intended to ensure that CII owners proactively identify security weaknesses and maintain the resilience of essential services.
2. Cybersecurity Code of Practice for CII
The Cybersecurity Code of Practice (CCoP) provides technical and organizational requirements for protecting CII.
CSA published the updated Cybersecurity Code of Practice for Critical Information Infrastructure 2026, strengthening the cybersecurity expectations for CII owners.
The updated requirements emphasize areas such as:
Board and senior management accountability for cybersecurity.
Cyber resilience governance and risk oversight.
Improved visibility of interconnected systems.
Stronger threat detection and monitoring.
Cybersecurity exercises and incident response readiness.
Protection of critical infrastructure and supporting technology environments.
CII owners should refer to the applicable 2026 Code of Practice and their specific regulatory directions when planning security assessments and penetration testing.
Importance of Cybersecurity Assessment for Essential Services
CII environments face security challenges that differ from those of conventional enterprise IT infrastructure. They often include interconnected systems, legacy technologies, industrial control systems, and operational platforms that must remain available to support essential services.
A cybersecurity assessment helps organizations identify weaknesses and understand how security risks could affect critical operations.
1. Identify Vulnerabilities in Critical Systems
CII environments may contain outdated operating systems, insecure configurations, exposed network services, and weaknesses in access management.
Regular assessments help identify these vulnerabilities before attackers can exploit them.
Security assessments can cover:
Critical servers and network infrastructure.
Business applications and databases.
Industrial Control Systems (ICS).
Supervisory Control and Data Acquisition (SCADA) environments.
Cloud infrastructure supporting essential services.
Network connections between IT and OT environments.
2. Protect Essential Service Availability
Availability is particularly important for organizations delivering essential services.
A cyber incident affecting healthcare infrastructure, power distribution, water treatment, or transportation systems could disrupt operations and affect public safety.
Security assessments help organizations identify vulnerabilities that could lead to service interruptions and implement appropriate protective measures.
3. Strengthen IT and OT Security
Many CII organizations operate both Information Technology (IT) and Operational Technology (OT) environments.
While IT systems primarily support information processing and business operations, OT systems control or monitor physical processes and industrial equipment.
Assessing the security of these environments helps identify weaknesses in network segmentation, remote access, authentication, monitoring, and system configurations.
4. Support Regulatory and Compliance Requirements
Regular security assessments provide useful information for demonstrating cybersecurity risk management and supporting compliance activities.
They can help CII owners address requirements aligned with:
Singapore’s Cybersecurity Act 2018.
Relevant OT cybersecurity standards and guidance.
Internal security governance and risk management policies.
A security assessment does not independently guarantee compliance. Organizations must address all applicable legal, regulatory, and operational requirements.
5. Improve Cyber Incident Preparedness
Cybersecurity assessments and exercises help organizations evaluate whether their security teams can detect, investigate, and respond to cyber threats.
They also provide opportunities to identify gaps in incident response procedures, security monitoring, communication, and recovery planning.
CII Vulnerability Assessment, Penetration Testing and Adversarial Attack Simulation Requirements
The CSA’s 2026 Cybersecurity Code of Practice establishes specific expectations for vulnerability assessment and penetration testing across designated CII environments.
These requirements are particularly important because CII systems often support essential operations where testing activities must be carefully managed to avoid service disruption.
1. Vulnerability Assessment Frequency
Under Clause 5.14 of the 2026 Code of Practice, CII owners must conduct vulnerability assessments at the following minimum frequencies:
IT-based CII: At least once every 12 months.
OT-based CII: At least once every 24 months.
CII owners must also conduct vulnerability assessments on relevant CII assets after implementing major system changes. These changes include commissioning new systems connected to the CII, implementing new application modules, system upgrades and technology refreshes.
In addition, CII owners must establish processes to identify and track cybersecurity vulnerabilities and remediate them in a timely manner, prioritising vulnerabilities that pose greater risks to CII security or operations.
If requested by the Commissioner of Cybersecurity, CII owners must submit the vulnerability assessment report and corresponding remediation plans within 30 working days of receiving the request.
2. Penetration Testing Frequency
Under Clause 5.15 of the 2026 Cybersecurity Code of Practice for Critical Information Infrastructure, CII owners must conduct penetration testing at the following minimum frequencies:
IT-based CII: At least once every 12 months.
OT-based CII: At least once every 24 months.
Penetration testing must also be conducted on relevant CII assets after major system changes. These include commissioning new systems connected to the CII, implementing new application modules, system upgrades and technology refreshes.
The purpose of penetration testing is to identify exploitable vulnerabilities and evaluate whether existing security controls can withstand potential cyberattacks. Testing activities must be appropriately planned to minimise risks to critical operations and service availability.
3. Industry-Recognised Accreditation and Certification
One of the most important considerations for CII owners is the qualification of the penetration testing provider and the individual testers.
Under Clause 5.15.3 of the 2026 Code of Practice:
Third-party penetration testing service providers must possess industry-recognised accreditation, such as CREST or an equivalent accreditation.
Individual penetration testers must hold industry-recognised penetration testing certifications demonstrating their technical knowledge and practical skills.
The service provider’s accreditation should provide assurance regarding its testing policies, procedures, reporting, data handling, and recruitment practices.
This means that CII owners should evaluate both the company’s accreditation and the individual tester’s qualifications rather than relying on the provider’s credentials alone.
4. Supervision During Penetration Testing
Penetration testing conducted by third-party service providers must be supervised by the CII owner (CIIO).
This requirement helps ensure that:
Testing activities remain within the approved scope.
Critical systems are not exposed to unnecessary operational risks.
Testing does not disrupt essential services.
Any unexpected operational impact can be addressed appropriately.
Testing activities follow the agreed rules of engagement.
Where requested by the Commissioner of Cybersecurity, CII owners must also submit the completed penetration testing report and remediation plans within 30 working days of receiving the request.
5. Red Teaming and Purple Teaming Requirements
CII owners must establish a Red Teaming or Purple Teaming attack simulation plan covering:
Exercise objectives and expected outcomes.
Key stakeholders, including Red Team, Blue Team, and management.
Assessment methodology and attack preparation.
Attack execution, clean-up, and containment.
Blue Team reporting and reconciliation.
Recommendations and remediation.
Rules of engagement for Red Teaming.
Business impact mitigation and recovery planning.
CII owners must conduct Red Teaming or Purple Teaming exercises at least once every 24 months to evaluate the effectiveness of their cybersecurity measures against prevalent threats.
This requirement demonstrates the importance of testing not only technical vulnerabilities but also the organization’s ability to prevent, detect, and respond to sophisticated cyberattacks.
Our Methodology for CII Cybersecurity Assessment and Penetration Testing
At Cyberintelsys, cybersecurity assessments follow a structured, risk-based methodology designed to evaluate critical infrastructure while considering operational availability, system sensitivity, and business continuity.
The assessment approach is tailored to the organization’s IT and OT environments, security objectives, and applicable regulatory requirements.
1. Scope Definition and Assessment Planning
The first stage involves understanding the CII environment and identifying the systems that require assessment.
Activities include:
Identifying critical IT and OT assets.
Reviewing network architecture and system dependencies.
Understanding operational restrictions.
Defining testing objectives and boundaries.
Establishing authorization and rules of engagement.
Coordinating with relevant IT, OT, and security teams.
2. Vulnerability Identification and Security Review
The next stage focuses on identifying potential weaknesses across the approved assessment scope.
This includes reviewing network infrastructure, operating systems, applications, access controls, configurations, and relevant OT components.
Assessment techniques are selected according to the sensitivity and operational characteristics of the systems.
3. Penetration Testing and Security Validation
Where authorized, controlled penetration testing is conducted to determine whether identified weaknesses can be exploited.
Testing focuses on evaluating potential attack paths, access control weaknesses, security configurations, and the effectiveness of existing defensive mechanisms.
For sensitive OT environments, testing techniques must be carefully selected to avoid affecting industrial processes or essential service availability.
4. Risk Analysis and Reporting
Identified vulnerabilities and security weaknesses are analysed according to their severity and potential impact.
The assessment report includes:
Executive summary of findings.
Technical vulnerability descriptions.
Risk ratings and affected assets.
Potential operational and business impact.
Supporting technical evidence.
Recommended remediation measures.
5. Remediation and Retesting
The final stage involves helping organizations understand and address the identified security gaps.
Where included in the engagement, reassessment and retesting help verify whether implemented remediation measures have effectively resolved the reported vulnerabilities.
This supports continuous improvement and helps organizations maintain a stronger cybersecurity posture.
Cyberintelsys CII Cybersecurity Assessment Services
Cyberintelsys offers cybersecurity assessment and testing services to help organizations identify vulnerabilities, evaluate security controls, and strengthen the protection of critical IT infrastructure.
The services can be tailored to the requirements of essential service providers, CII owners, and organizations operating complex technology environments.
1. Vulnerability Assessment
Vulnerability Assessment identifies known security weaknesses across critical IT infrastructure, applications, networks, and systems.
Key activities include:
Network and infrastructure vulnerability scanning.
Server and operating system security reviews.
Identification of outdated software and missing patches.
Detection of insecure configurations.
Vulnerability classification and risk prioritization.
Detailed reporting and remediation recommendations.
2. Penetration Testing
Penetration Testing evaluates whether identified security weaknesses can be exploited by potential attackers.
Depending on the approved scope, services include:
Network Penetration Testing: Evaluates internal and external network security.
Web Application Penetration Testing: Identifies weaknesses in application security and access controls.
API Penetration Testing: Examines API authentication, authorization, and data exposure risks.
Infrastructure Penetration Testing: Assesses vulnerabilities across servers, systems, and supporting infrastructure.
Cloud Penetration Testing: Evaluates security weaknesses in cloud environments.
3. OT Security Assessment
OT Security Assessment focuses on identifying vulnerabilities and security weaknesses in industrial environments that support essential services.
The assessment considers:
Industrial network architecture.
SCADA and Industrial Control Systems.
Network segmentation and communication pathways.
Remote access security.
System configurations and access controls.
Security monitoring and operational risks.
Testing activities are carefully scoped to minimize the possibility of affecting industrial operations.
4. Red Team Assessment
Red Team Assessment simulates realistic cyberattacks to evaluate an organization’s ability to prevent, detect, and respond to sophisticated threats.
It helps identify weaknesses across technology, processes, and security controls that may not be evident through conventional vulnerability assessments.
5. Purple Team Assessment
Purple Team Assessment brings offensive and defensive security teams together to improve detection and response capabilities.
It helps organizations:
Validate security monitoring mechanisms.
Improve threat detection rules.
Evaluate incident response procedures.
Identify defensive security gaps.
Strengthen collaboration between security teams.
6. Cybersecurity Compliance Support
Cyberintelsys helps organizations evaluate their security posture against applicable cybersecurity frameworks and standards.
This includes supporting security improvement initiatives aligned with Singapore’s CII cybersecurity requirements and ISO/IEC 27001:2022.
Why Choose Cyberintelsys for CII Security Assessment?
Selecting a cybersecurity provider for critical infrastructure requires careful consideration of technical capabilities, industry recognition, licensing, and operational experience.
Cyberintelsys combines recognized cybersecurity credentials with structured assessment methodologies to support organizations across multiple sectors.
1. Industry Credentials and Certifications
1. Cybersecurity Service Provider (CSP) Licence – Singapore
Licensed to provide cybersecurity services in Singapore, including penetration testing, as applicable to the scope of the licence.
2. CREST Accreditation
Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognized security testing services for organizations across multiple sectors.
3. ISO/IEC 27001:2022 – UKAS-Accredited Certification
Certified for Information Security Management Systems (ISMS) through Bureau Veritas under UKAS accreditation.
4. ISO/IEC 27001:2022 – SAC-Accredited Certification
Certified through Bureau Veritas under Singapore Accreditation Council (SAC) accreditation.
2. Additional Reasons to Work with Cyberintelsys
Structured Assessment Methodology: Security assessments are planned according to the organization’s infrastructure, objectives, and testing requirements.
Industry-Recognised Credentials: Relevant accreditation and certification support professional security testing engagements.
Risk-Based Reporting: Findings are prioritized according to technical severity and potential business impact.
Operational Awareness: Assessment planning considers system sensitivity and the importance of maintaining essential service availability.
Actionable Recommendations: Detailed reports help organizations understand security gaps and prioritize remediation.
Continuous Security Improvement: Retesting and reassessment can support ongoing cybersecurity improvements.
Contact Cyberintelsys
Protecting Singapore’s essential services requires a proactive and structured approach to cybersecurity.
CII owners must consider the requirements of the Cybersecurity Act 2018 and the applicable 2026 Cybersecurity Code of Practice when planning vulnerability assessments, penetration testing, and adversarial attack simulations.
Choosing an appropriately licensed and accredited cybersecurity provider is equally important, particularly when testing critical IT and OT environments.
Cyberintelsys supports organizations with Vulnerability Assessment, Penetration Testing, Red Teaming, Purple Teaming, and OT Security Assessment services.
Whether your organization needs to evaluate critical infrastructure, identify exploitable vulnerabilities, strengthen operational security, or address CII cybersecurity requirements, the right assessment approach can help reduce cyber risks and improve resilience.
