Introduction
Singapore’s Critical Information Infrastructure (CII) supports essential services across sectors including energy, water, banking and finance, healthcare, transport, infocomm, media, security and emergency services, and government. These sectors depend on interconnected Information Technology (IT) and Operational Technology (OT) systems to maintain service availability, manage essential processes, and support national economic activities.
As digital transformation accelerates, CII environments are becoming increasingly interconnected with cloud platforms, third-party service providers, virtual infrastructure, and external networks. While these technologies improve operational efficiency, they also introduce additional cybersecurity risks. Attackers may exploit insecure configurations, compromised supplier connections, vulnerable applications, or weaknesses in remote access systems to gain unauthorized access to critical infrastructure.
Recognizing these developments, Singapore introduced amendments to its Cybersecurity Act 2018 through the Cybersecurity (Amendment) Act 2024. The amendments were passed in Parliament on 7 May 2024, with key provisions commencing on 31 October 2025. They strengthen the existing regulatory framework and expand the Cyber Security Agency of Singapore (CSA)’s oversight to address emerging cybersecurity threats and changing technology environments.
The amendments are significant for CII owners because they extend cybersecurity responsibilities beyond traditional infrastructure boundaries. Organizations must consider additional system ownership arrangements, supply chain dependencies, virtual infrastructure, incident reporting obligations, and evolving regulatory expectations.
For organizations operating essential services in Singapore, understanding these amendments is important for maintaining cybersecurity resilience, identifying compliance gaps, and protecting critical systems against evolving cyber threats.
Understanding Singapore’s Cybersecurity Act Amendments
The original Cybersecurity Act established a regulatory framework for protecting designated CII systems and maintaining national cybersecurity resilience.
However, technological developments have changed how essential services operate. Organizations increasingly depend on cloud computing, outsourced infrastructure, third-party technology providers, and interconnected digital platforms.
The amendments address these developments by:
Updating existing cybersecurity requirements for CII owners.
Expanding regulatory oversight to cover additional categories of systems and entities.
Strengthening cybersecurity incident reporting obligations.
Addressing risks associated with third-party-owned infrastructure.
Providing CSA with additional regulatory and oversight powers.
Improving visibility into cybersecurity risks across essential service ecosystems.
These changes recognize that protecting critical infrastructure requires a broader approach that considers not only directly owned systems but also external dependencies that support essential services.
Major Amendments and Their Impact on CII Protection
1. Expanded Protection of Provider-Owned Critical Information Infrastructure
One important amendment expands the regulatory framework to cover qualifying provider-owned Critical Information Infrastructure (CII).
Modern essential services may rely on virtual computers, cloud-based environments, virtual machines, and externally hosted platforms rather than conventional physical infrastructure.
The amendments empower the Commissioner of Cybersecurity to designate qualifying computer systems as provider-owned CII when the applicable statutory criteria are met.
Impact on organisations:
Virtual infrastructure supporting essential services may fall within the regulatory framework if formally designated.
Organisations must understand which systems support their designated CII.
Cloud-based infrastructure requires appropriate security controls and oversight.
System owners must maintain visibility into infrastructure dependencies.
Cybersecurity assessments should consider relevant virtual and hosted environments.
This development helps ensure that qualifying critical systems remain protected as organisations adopt modern infrastructure and technology delivery models.
2. Stronger Cybersecurity Incident Reporting Requirements
The amendments to Singapore’s Cybersecurity Act 2018 expand incident reporting obligations to help the Cyber Security Agency of Singapore (CSA) monitor threats affecting CII and essential services.
The expanded requirements cover additional incident categories, including:
Suspected Advanced Persistent Threats (APTs): Incidents suspected to be caused by APT activity.
Non-interconnected systems: Prescribed incidents affecting other computer systems under the CII owner’s control, including incidents that disrupt or degrade essential service delivery.
Supplier-controlled systems: Prescribed incidents affecting supplier-controlled systems interconnected with or communicating with the CII.
Third-party-owned CII: Prescribed incidents for which the designated provider responsible for the CII’s cybersecurity has reporting obligations to CSA.
For applicable incidents subject to immediate reporting, initial notification is required within two hours, followed by supplementary details within 72 hours and a final report within 30 days after the supplementary submission. Certain other prescribed incidents may be subject to consolidated quarterly reporting, depending on the applicable requirements.
Impact on organisations:
CII owners need effective incident detection, escalation, and reporting procedures.
Organisations should strengthen:
Security Information and Event Management (SIEM) capabilities.
Endpoint Detection and Response (EDR) monitoring.
Network intrusion detection.
Incident classification and escalation procedures.
Communication between IT, OT, suppliers, and management teams.
Incident documentation and reporting processes.
Early detection and accurate reporting help organisations respond to threats more effectively and support coordinated cybersecurity responses.
3. Regulation of Systems of Temporary Cybersecurity Concern (STCC)
The amendments introduce a regulatory category known as Systems of Temporary Cybersecurity Concern (STCC).
These are computer systems that may present significant cybersecurity risks because of temporary events or specific operational situations.
Examples include systems supporting government election processes or vaccine distribution during a pandemic.
CSA can designate qualifying systems as STCCs for a limited period based on the applicable statutory criteria and cybersecurity risks.
Owners of designated STCCs must fulfil applicable cybersecurity measures and incident reporting obligations during the designation period.
Impact on organisations:
Organisations operating systems that may be designated as STCCs should be prepared to address additional cybersecurity requirements within the applicable timeframe.
Practical considerations include:
Identifying temporary infrastructure and system dependencies.
Conducting cybersecurity risk assessments.
Implementing appropriate access restrictions.
Monitoring suspicious activities.
Establishing incident response procedures.
Maintaining relevant cybersecurity documentation.
The introduction of STCC provides greater flexibility for addressing temporary but significant cybersecurity risks.
4. Regulation of Entities of Special Cybersecurity Interest (ESCI)
The amendments introduce another regulatory category known as Entities of Special Cybersecurity Interest (ESCI).
These are entities formally designated by the Commissioner of Cybersecurity based on the applicable statutory criteria, recognising their significance to Singapore’s national interests and cybersecurity.
CSA can impose applicable cybersecurity obligations on designated ESCIs, even when they are not traditional CII operators.
Impact on organisations:
Entities designated as ESCIs may need to strengthen their cybersecurity governance, security controls, and incident reporting arrangements.
Organisations should evaluate:
Sensitive information protection.
Access control and privileged account management.
Network security.
Vulnerability management.
Incident detection and response.
Cybersecurity risk governance.
This expansion helps address cybersecurity risks associated with entities that play important roles in Singapore’s national interests.
5. Regulation of Foundational Digital Infrastructure (FDI)
The amendments introduce regulatory oversight of Foundational Digital Infrastructure (FDI), covering cloud computing services and data centre facility services that support Singapore’s digital economy.
Under Part 3D of the Cybersecurity Act 2018, the Commissioner of Cybersecurity may designate qualifying providers as major FDI service providers when the applicable statutory criteria are met. Designated providers must comply with relevant cybersecurity requirements, including applicable codes of practice, directions, and prescribed incident reporting obligations.
Impact on organisations:
The inclusion of FDI highlights the importance of securing the digital infrastructure that supports essential services and business operations.
Organisations should pay attention to:
Cloud infrastructure security.
Data centre security controls.
Virtualisation and network architecture.
Identity and access management.
Infrastructure monitoring.
Third-party risk management.
Business continuity and disaster recovery.
CII operators should also understand how their cloud and infrastructure providers support the security and availability of designated systems.
6. Greater Oversight of Third-Party-Owned CII
Another significant development is the introduction of requirements addressing third-party-owned CII used to provide essential services.
In some operating models, an organisation responsible for delivering an essential service may depend on infrastructure owned or operated by another organisation.
The amendments establish a framework for designated providers responsible for third-party-owned CII. These providers must obtain legally binding commitments from the infrastructure owners concerning cybersecurity responsibilities, applicable security standards, information sharing, incident notification, and other relevant requirements under the Act.
Impact on organisations:
Organisations must understand cybersecurity responsibilities across their external infrastructure dependencies.
Important considerations include:
Identifying third-party infrastructure supporting essential services.
Establishing clear cybersecurity responsibilities.
Reviewing vendor security controls.
Evaluating external connectivity and access permissions.
Assessing supplier vulnerabilities.
Maintaining incident communication and escalation procedures.
This helps reduce security gaps that may arise when critical infrastructure responsibilities are distributed across multiple organisations.
Importance of Cybersecurity Assessments Under the Amended Act
The expanded regulatory framework makes cybersecurity assessments increasingly important for organizations operating CII and supporting infrastructure.
A cybersecurity assessment helps organizations identify weaknesses, evaluate security controls, and determine whether existing protection measures adequately address potential threats.
1. Identifying Vulnerabilities Across Critical Systems
CII environments may contain outdated operating systems, insecure network services, vulnerable applications, and improperly configured infrastructure.
Vulnerability assessments help identify these weaknesses before attackers can exploit them.
The assessment may cover:
Network devices and infrastructure.
Servers and operating systems.
Web applications and APIs.
Cloud and virtual environments.
Industrial control systems.
Remote access infrastructure.
Third-party connections.
Identifying vulnerabilities helps organizations establish remediation priorities and reduce their overall attack surface.
2. Evaluating IT and OT Network Security
Many CII environments combine enterprise IT systems with industrial OT infrastructure.
A weakness in corporate IT networks may create an opportunity for attackers to access operational environments if network segmentation and access restrictions are inadequate.
Cybersecurity assessments evaluate:
IT and OT network separation.
Firewall configurations.
Industrial network communication pathways.
Remote engineering access.
Privileged account permissions.
Security monitoring capabilities.
These activities help identify potential pathways through which attackers could compromise critical operational systems.
3. Strengthening Third-Party and Supply Chain Security
The amended regulatory framework places greater emphasis on infrastructure dependencies and third-party cybersecurity risks.
Organizations should evaluate the security of vendors, cloud service providers, technology partners, and external maintenance providers.
Assessments can help identify weak authentication, insecure vendor connections, excessive privileges, inadequate monitoring, and vulnerabilities in externally managed systems.
4. Improving Incident Detection and Response
Expanded incident reporting obligations make effective threat detection and response processes essential.
Security assessments help determine whether organizations can identify suspicious activities, classify cybersecurity incidents, and escalate reportable events within the required timeframes.
Testing should evaluate:
Incident detection and monitoring.
Security alert management.
Incident response procedures.
Internal escalation mechanisms.
Communication between technical teams and management.
Evidence collection and reporting readiness.
5. Supporting Cybersecurity Governance and Compliance
Technical security controls must be supported by appropriate governance, policies, and management oversight.
Cybersecurity assessments help organizations evaluate whether their security procedures are documented, implemented, and consistently maintained.
This includes reviewing cybersecurity policies, risk registers, vulnerability management processes, incident response plans, third-party security procedures, and remediation tracking.
Our Methodology for Cybersecurity Assessment and Penetration Testing
Cyberintelsys follows a structured and risk-based methodology to evaluate cybersecurity weaknesses across critical infrastructure.
The approach considers the amended regulatory requirements, infrastructure architecture, operational dependencies, and potential consequences of cybersecurity incidents.
1. Scope Definition and Regulatory Review
The assessment begins by understanding the organization’s infrastructure, regulatory responsibilities, and cybersecurity objectives.
Activities include:
Reviewing applicable Cybersecurity Act obligations.
Identifying designated CII and supporting infrastructure.
Understanding IT, OT, cloud, and virtual environments.
Identifying third-party dependencies.
Defining assessment boundaries and testing permissions.
This establishes a clear foundation for the assessment.
2. Asset Discovery and Attack Surface Analysis
The next stage identifies systems, applications, network services, and external connections that could expose the organization to cyber threats.
The assessment examines internet-facing assets, internal networks, remote access infrastructure, cloud environments, and interconnected systems.
This helps identify potential entry points and areas requiring deeper investigation.
3. Vulnerability Assessment
A systematic vulnerability assessment is conducted to identify security weaknesses across the defined infrastructure.
Testing may include:
Network vulnerability scanning.
Operating system security assessments.
Application and API vulnerability testing.
Security configuration reviews.
Authentication and access control assessments.
Patch and software version analysis.
Identified vulnerabilities are prioritized based on severity, exploitability, and potential impact.
4. Controlled Penetration Testing
Penetration testing validates whether identified vulnerabilities can be exploited through controlled attack simulations.
Activities may include:
Testing authentication weaknesses.
Evaluating privilege escalation opportunities.
Assessing network segmentation.
Identifying potential lateral movement pathways.
Testing application security controls.
Evaluating remote access security.
For OT environments, testing activities are carefully planned to avoid affecting industrial operations, equipment, and system availability.
5. Cybersecurity Risk Evaluation
The findings are evaluated to determine their potential consequences for the organization.
The assessment considers unauthorized access, sensitive information exposure, operational disruption, third-party compromise, and risks to essential service delivery.
This helps organizations understand the relationship between technical vulnerabilities and broader business risks.
6. Compliance Gap Analysis and Reporting
Assessment findings are mapped against relevant regulatory requirements and applicable cybersecurity controls.
The report includes:
Identified vulnerabilities and security weaknesses.
Relevant compliance gaps.
Risk severity and potential impact.
Evidence of validated vulnerabilities.
Recommended corrective measures.
Remediation priorities.
This provides management and technical teams with actionable information for improving cybersecurity protection.
7. Remediation Validation and Retesting
After corrective measures are implemented, retesting verifies whether the identified weaknesses have been addressed effectively.
This helps confirm the effectiveness of security improvements and supports continuous cybersecurity risk management.
Cyberintelsys Cybersecurity Services for CII Protection
Cyberintelsys provides cybersecurity testing and assessment services to help organizations identify technical weaknesses, evaluate security controls, and strengthen their infrastructure against evolving cyber threats.
These services can support CII owners in addressing technical security risks and improving their cybersecurity readiness.
1. Vulnerability Assessment and Penetration Testing (VAPT)
VAPT identifies security vulnerabilities and evaluates whether they can be exploited by potential attackers.
The assessment covers:
Internal and external network infrastructure.
Operating systems and servers.
Security configurations and exposed services.
Authentication and access control mechanisms.
Application and API vulnerabilities.
Potential attack paths and privilege escalation.
The findings help organizations understand their actual security exposure and prioritize remediation.
2. OT Security Assessment
OT Security Assessment focuses on industrial infrastructure responsible for supporting essential operational processes.
The assessment may cover:
Supervisory Control and Data Acquisition (SCADA) systems.
Programmable Logic Controllers (PLCs).
Distributed Control Systems (DCS).
Engineering workstations.
Industrial communication networks.
Remote monitoring and maintenance infrastructure.
The objective is to identify vulnerabilities that could affect industrial process integrity, operational availability, and system safety.
3. Network Penetration Testing
Network penetration testing evaluates internal and external network infrastructure through authorized attack simulations.
It identifies weak network segmentation, exposed services, insecure firewall configurations, unauthorized access opportunities, and potential lateral movement pathways.
This service helps organizations strengthen security boundaries between corporate IT, OT, and external environments.
4. Web Application and API Security Testing
Digital platforms and application interfaces may introduce vulnerabilities into critical infrastructure environments.
Cyberintelsys evaluates applications and APIs for:
Authentication weaknesses.
Broken access controls.
Injection vulnerabilities.
Insecure data handling.
Session management weaknesses.
Security misconfigurations.
The assessment helps reduce application-level risks and protect sensitive operational information.
5. Cybersecurity Risk Assessment
Cybersecurity risk assessment evaluates threats, vulnerabilities, existing security controls, and potential business consequences.
It helps organizations understand their overall risk exposure and establish remediation priorities.
The assessment can also support regulatory gap analysis, risk registers, security governance, and management reporting.
6. Compliance and Security Gap Assessment
This service examines existing cybersecurity practices against applicable regulatory requirements and industry security standards.
Activities may include:
Reviewing cybersecurity policies and procedures.
Evaluating vulnerability management processes.
Assessing incident response arrangements.
Reviewing third-party security controls.
Identifying technical and governance gaps.
Developing remediation recommendations.
The results help organizations establish a structured improvement plan for their cybersecurity programme.
Why Choose Cyberintelsys?
CII protection requires specialized cybersecurity expertise, structured assessment methodologies, and an understanding of the operational risks associated with critical infrastructure.
Cyberintelsys combines professional security testing capabilities with industry-recognized credentials to help organizations identify vulnerabilities and improve their security posture.
Key credentials and certifications include:
Cybersecurity Service Provider (CSP) Licence – Singapore: Licensed to provide cybersecurity services in Singapore, including penetration testing, as applicable to the scope of the licence.
ISO/IEC 27001:2022 – UKAS-Accredited Certification: Certified for Information Security Management Systems (ISMS) through Bureau Veritas under UKAS accreditation.
ISO/IEC 27001:2022 – SAC-Accredited Certification: Certified through Bureau Veritas under Singapore Accreditation Council (SAC) accreditation.
Organizations working with Cyberintelsys can benefit from:
Structured and risk-based cybersecurity assessments.
Technical expertise in IT and OT security testing.
Identification and validation of security vulnerabilities.
Actionable remediation recommendations.
Assessment approaches designed around operational requirements.
Support for improving cybersecurity resilience and compliance readiness.
Contact Cyberintelsys
Singapore’s Cybersecurity Act amendments represent an important development in protecting critical infrastructure against evolving cybersecurity threats.
With expanded regulatory oversight, additional incident reporting obligations, increased attention to third-party dependencies, and stronger cybersecurity governance expectations, CII owners must continuously evaluate and improve their security posture.
Proactive cybersecurity assessments, vulnerability identification, penetration testing, and OT security evaluations can help organizations address weaknesses before they develop into serious security incidents.
Whether your organization operates in energy, healthcare, banking, transportation, water, telecommunications, or other critical sectors, Cyberintelsys can support your cybersecurity requirements through professional security testing and assessment services.
Strengthen your critical infrastructure protection, address cybersecurity gaps, and improve your compliance readiness with Cyberintelsys.
Contact Cyberintelsys to discuss your CII cybersecurity assessment, penetration testing, and OT security requirements in Singapore.
