Introduction
Critical Information Infrastructure (CII) plays a vital role in maintaining the economic stability, public safety and essential services of Singapore. Industries such as banking, healthcare, energy, water, transportation, telecommunications and government rely heavily on interconnected digital systems to deliver uninterrupted services. Any disruption or compromise affecting these systems can have significant consequences for organisations, businesses and the wider community.
As cyber threats become increasingly sophisticated, protecting critical infrastructure requires more than conventional security controls. Advanced persistent threats (APTs), ransomware, supply chain attacks, insider threats and vulnerabilities in Operational Technology (OT) environments can expose essential services to serious cybersecurity risks.
To address these challenges, Singapore introduced the Cybersecurity Code of Practice (CCoP) for Critical Information Infrastructure, issued by the Cyber Security Agency of Singapore (CSA) under the Cybersecurity Act 2018.
The regulatory landscape has also evolved. On 29 July 2026, CSA issued an updated CII Cybersecurity Code of Practice, replacing the previous 2022 edition. The updated requirements place greater emphasis on cybersecurity governance, organisational accountability, interconnected systems, threat detection and cyber resilience.
For Critical Information Infrastructure Owners (CIIOs), understanding and implementing these requirements is essential to maintaining security, operational continuity and regulatory compliance.
Singapore’s CII Cybersecurity Regulatory Framework
Singapore’s Critical Information Infrastructure (CII) cybersecurity requirements are established under the Cybersecurity Act 2018, administered by the Cyber Security Agency of Singapore (CSA). The Act provides the legal foundation for regulating designated computer systems that support the continuous delivery of essential services.
The updated Cybersecurity Code of Practice for Critical Information Infrastructure 2026 took effect on 29 July 2026, replacing the previous 2022 edition. CII owners must consider the Code alongside their applicable obligations under the Cybersecurity Act and relevant regulatory directions.
1. Identifying Critical Information Infrastructure
Critical Information Infrastructure refers to computer systems necessary for the continuous delivery of essential services, where the loss or compromise of those systems could have a debilitating effect on the availability of the essential services in Singapore.
Singapore recognises the following nine CII sectors:
Energy
Water
Banking and Finance
Healthcare
Transport, including Land, Maritime and Aviation
Infocomm
Media
Security and Emergency Services
Government
Not every organisation operating in these sectors is automatically designated as a CII owner. The Commissioner of Cybersecurity formally designates the relevant computer systems under the Cybersecurity Act. Once designated, CII owners must fulfil the applicable statutory and Code of Practice requirements.
The 2026 Code also strengthens requirements relating to interconnected systems that connect to or communicate with CII. This helps address cybersecurity risks across the wider network environments supporting essential services.
2. Cybersecurity Governance and Management Accountability
The updated Code strengthens Board and senior management accountability for cybersecurity oversight.
CII owners must establish a documented cyber resilience framework covering four important areas:
Risk Tolerance: Define and maintain a cybersecurity risk appetite statement that establishes the organisation’s acceptable levels of cyber risk.
Risk Mitigation: Oversee cybersecurity investments, security controls, resource allocation and activities to reduce cyber risks.
Risk Transfer: Oversee appropriate cyber risk transfer arrangements, including the consideration of cyber insurance.
Risk Recovery: Oversee Business Continuity and Disaster Recovery strategies to support the restoration of essential services following cyber incidents or disruptions.
The Board must review the cyber resilience framework at least annually. The Code also addresses Board cybersecurity training, threat briefings and the responsibilities of senior management in overseeing cybersecurity policies, resources and risk management activities.
These governance measures help ensure that cybersecurity is treated as an organisational responsibility rather than solely an IT function.
3. Cybersecurity Risk Assessment and Audit Requirements
Risk assessments and independent cybersecurity audits are essential elements of CII security and regulatory compliance.
Under Section 15 of the Cybersecurity Act 2018, owners of provider-owned Critical Information Infrastructure (CII) must:
Conduct cybersecurity risk assessments at least once every year.
Arrange cybersecurity audits at least once every two years, or more frequently if directed by the Commissioner of Cybersecurity.
Ensure that audits are conducted by an auditor approved or appointed by the Commissioner.
Submit the relevant audit and risk assessment reports to the Commissioner within 30 days after completing the respective audit or assessment.
These activities help organisations identify cybersecurity risks, evaluate existing security controls, address vulnerabilities and maintain appropriate records of their security posture and compliance with applicable regulatory requirements.
4. Incident Reporting and Cyber Resilience
CII owners must maintain effective cybersecurity incident detection, management and reporting arrangements in accordance with the Cybersecurity Act and applicable Code of Practice requirements.
Section 14 of the Cybersecurity Act addresses the reporting of prescribed cybersecurity incidents affecting CII and certain interconnected or communicating computer systems under the CII owner’s control. The applicable reporting obligations depend on the incident category and relevant statutory requirements.
The 2026 Code also strengthens cybersecurity readiness through requirements covering threat detection, monitoring and cybersecurity exercises. CII owners must establish appropriate incident response arrangements covering detection, escalation, investigation, containment, recovery and communication.
Cybersecurity exercises help evaluate organisational preparedness, test incident response arrangements and improve coordination during cybersecurity incidents.
Importance of Security Assessment for Critical Infrastructure Operators
Cybersecurity assessments are important for organisations operating critical infrastructure because vulnerabilities in essential systems can create opportunities for attackers to disrupt services.
With increasing connectivity between Information Technology (IT), Operational Technology (OT), cloud environments and third-party systems, organisations need a comprehensive approach to identifying and managing cybersecurity risks.
The following areas highlight how security assessments support the protection of critical infrastructure.
1. Identifying Security Vulnerabilities
Security assessments help identify weaknesses in networks, applications, servers, endpoints and infrastructure. Unpatched systems, misconfigured devices, outdated software and insecure access controls can create entry points for attackers.
Identifying these weaknesses allows organisations to prioritise remediation and reduce their exposure to potential cyber threats.
2. Protecting Operational Technology Environments
Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA) systems and other OT environments support essential operations across several critical sectors.
Security assessments help identify risks associated with industrial networks, remote access, connected devices and operational systems while considering availability and safety requirements.
3. Reducing Cyberattack Risks
Penetration testing and vulnerability assessments help organisations understand how attackers could exploit weaknesses within their environments. Identifying these issues early allows security teams to prioritise remediation and strengthen defensive controls.
4. Supporting Regulatory Compliance
Security assessments, documented risk evaluations and independent audits help organisations evaluate their cybersecurity controls against applicable CII requirements.
These activities can help identify compliance gaps, support remediation planning and provide technical evidence for relevant security reviews.
5. Maintaining Business Continuity
Cyber incidents can interrupt essential services, affect customer confidence and create operational and financial consequences.
Security testing and resilience assessments help organisations identify weaknesses that could affect service availability and improve their ability to prepare for, respond to and recover from security incidents.
6. Managing Third-Party and Interconnected System Risks
External vendors, service providers and interconnected networks can introduce additional cybersecurity risks.
Assessing these connections helps organisations identify potential attack paths, review access permissions and strengthen network segmentation, monitoring and security controls.
Our CII Security Assessment Methodology
At Cyberintelsys, cybersecurity assessments follow a structured and risk-focused methodology designed to identify vulnerabilities, evaluate security controls and strengthen the overall security posture of critical infrastructure environments.
The assessment approach is aligned with applicable Singapore CII cybersecurity requirements and considers the operational sensitivity of IT and OT environments.
1. Scope Definition and Asset Identification
The assessment begins by understanding the organisation’s infrastructure, business operations and critical systems.
Activities include:
Identifying critical assets, applications, servers and network components.
Understanding IT and OT environments and their interconnections.
Reviewing external interfaces, remote access points and third-party dependencies.
Defining the assessment scope based on business and operational requirements.
2. Cybersecurity Risk Assessment
A comprehensive risk assessment is conducted to identify potential threats, vulnerabilities and their impact on essential services.
This includes:
Identifying potential attack scenarios and threat actors.
Evaluating existing security controls.
Assessing vulnerabilities and their potential business impact.
Prioritising risks based on severity and likelihood.
Recommending appropriate risk mitigation measures.
3. Vulnerability Assessment and Penetration Testing
Technical security testing helps identify exploitable weaknesses across the organisation’s infrastructure.
Vulnerability Assessment (VA): Identifies known vulnerabilities, insecure configurations, outdated software and potential security weaknesses.
Penetration Testing (PT): Simulates realistic attack scenarios to determine whether identified vulnerabilities can be exploited and how they could affect critical systems.
Network Security Testing: Evaluates network configurations, access controls, segmentation and exposure to external threats.
Web Application Security Testing: Identifies application-level vulnerabilities, authentication weaknesses and potential data exposure risks.
Testing involving sensitive OT environments is planned carefully to avoid disrupting essential operations.
4. Security Configuration and Access Control Review
Existing security configurations are reviewed to identify weaknesses in authentication, authorisation and system management.
This includes evaluating privileged accounts, multi-factor authentication, network segmentation, firewall configurations, system hardening and patch management practices.
5. Security Monitoring and Incident Response Review
The organisation’s ability to detect and respond to cybersecurity threats is evaluated.
This includes reviewing security monitoring mechanisms, logging practices, threat detection capabilities, incident response procedures and escalation processes.
6. Reporting and Remediation Guidance
Following the assessment, a detailed technical report is prepared covering:
Identified vulnerabilities and security gaps.
Risk severity and potential business impact.
Evidence and technical observations.
Recommended remediation measures.
Prioritised corrective actions.
Where required, retesting can be conducted to validate whether identified vulnerabilities have been successfully addressed.
Cyberintelsys Services for Singapore CII Cybersecurity Requirements
Cyberintelsys offers cybersecurity assessment and security testing services to help organisations identify weaknesses, strengthen infrastructure protection and improve their readiness for regulatory requirements.
The following services support different aspects of CII cybersecurity programmes.
1. Vulnerability Assessment and Penetration Testing (VAPT)
VAPT helps organisations identify and validate security weaknesses across their digital infrastructure.
Network Vulnerability Assessment and Penetration Testing.
Web Application Security Testing.
Mobile Application Security Testing.
Internal and External Network Penetration Testing.
Infrastructure Security Assessment.
These assessments help identify exploitable vulnerabilities before malicious attackers can take advantage of them.
2. OT and ICS Security Assessment
Operational Technology environments require specialised security considerations because vulnerabilities can affect physical processes and essential service delivery.
Cyberintelsys supports OT and ICS security assessments covering:
SCADA and industrial control system security.
Industrial network architecture and segmentation.
Remote access security.
Communication protocols and connected devices.
Identification of vulnerabilities affecting industrial environments.
3. Cybersecurity Risk Assessment
Risk assessments help organisations understand their cybersecurity exposure and establish appropriate risk management priorities.
Activities include asset identification, threat analysis, vulnerability evaluation, impact assessment and remediation planning.
4. Network Security Assessment
Network security assessments evaluate the effectiveness of an organisation’s network protection mechanisms.
This includes firewall configuration reviews, network segmentation analysis, access control assessments, infrastructure vulnerability identification and security architecture reviews.
5. Security Configuration Review
Configuration reviews help identify insecure settings across servers, operating systems, network devices, databases and other infrastructure components.
The objective is to reduce unnecessary exposure and strengthen security configurations.
6. Incident Response and Security Readiness Assessment
Effective incident response requires clearly defined procedures, trained personnel and appropriate technical capabilities.
Cyberintelsys can support organisations in reviewing incident response arrangements, identifying preparedness gaps and improving their security response processes.
7. Compliance and Security Audit Support
Cyberintelsys supports organisations in understanding cybersecurity gaps against applicable regulatory and security requirements.
Activities can include:
Reviewing existing cybersecurity policies and procedures.
Assessing implemented security controls.
Identifying gaps against applicable CII requirements.
Supporting remediation planning.
Providing technical findings and supporting documentation.
Formal statutory CII audits must be performed by auditors approved or appointed by the Commissioner, as applicable. Security assessment support should not be confused with statutory audit approval.
Why Choose Cyberintelsys?
Protecting critical infrastructure requires technical expertise, structured security assessments and a clear understanding of evolving cybersecurity threats.
Cyberintelsys focuses on helping organisations identify security weaknesses, improve defensive capabilities and strengthen their cybersecurity readiness.
Our credentials and industry recognition include:
- Cybersecurity Service Provider (CSP) Licence – Singapore Licensed to provide cybersecurity services in Singapore, including penetration testing, as applicable to the scope of the licence.
- CREST Accreditation: Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognised security testing services for organisations across multiple sectors.
- ISO/IEC 27001:2022 – UKAS-Accredited Certification: Certified for Information Security Management Systems (ISMS) through Bureau Veritas under UKAS accreditation.
- ISO/IEC 27001:2022 – SAC-Accredited Certification: Certified through Bureau Veritas under Singapore Accreditation Council (SAC) accreditation.
By combining recognised security testing expertise with a structured assessment approach, Cyberintelsys helps organisations gain better visibility into their security posture and make informed decisions about cybersecurity improvements.
Contact Cyberintelsys – Strengthen Your Critical Infrastructure Security
As Singapore continues to strengthen its cybersecurity requirements for Critical Information Infrastructure, organisations must take proactive steps to identify vulnerabilities, manage cyber risks and improve operational resilience.
Understanding the CII Cybersecurity Code of Practice requirements is only the first step. Implementing effective security controls, conducting regular assessments and maintaining continuous security improvements are equally important.
Whether your organisation requires Vulnerability Assessment and Penetration Testing, OT security assessment, network security testing or cybersecurity risk assessment, Cyberintelsys can support your security improvement initiatives.
Connect with Cyberintelsys today to strengthen your critical infrastructure security, address cybersecurity gaps and support your organisation’s readiness for Singapore’s CII cybersecurity requirements.
