Introduction
Singapore’s digital economy depends on infrastructure that enables organisations, government agencies and individuals to access essential online services. Cloud computing platforms, data centres and other foundational technology services support a wide range of activities, from financial transactions and healthcare systems to business applications and government operations.
As more organisations depend on these services, cybersecurity risks affecting the underlying infrastructure can have consequences beyond an individual service provider. A cyberattack, system failure or unauthorised access incident could affect multiple customers, disrupt digital services and create wider operational and economic impact.
To address these risks, Singapore introduced the concept of Foundational Digital Infrastructure (FDI) through amendments to the Cybersecurity Act 2018. The framework extends cybersecurity oversight to important digital infrastructure providers, recognising that protecting the technology on which other organisations depend is essential to Singapore’s overall cyber resilience.
Understanding FDI is particularly important for cloud service providers, data centre operators and organisations that manage or depend on foundational digital infrastructure. It helps them understand the regulatory framework, potential designation requirements and the importance of maintaining appropriate cybersecurity controls.
What Services Are Classified as Foundational Digital Infrastructure?
The Third Schedule of Singapore’s Cybersecurity Act identifies two categories of foundational digital infrastructure services:
1. Cloud Computing Services
Cloud computing services provide on-demand access to scalable and shared computing resources. These may include computing power, storage, networking and virtualised infrastructure delivered remotely.
Cloud platforms enable organisations to host applications, store data and operate digital services without maintaining all the underlying infrastructure themselves.
2. Data Centre Facility Services
These services use facilities in Singapore to provide centralised accommodation, interconnection and operation of computer systems for another party’s data storage, processing and transmission.
They include hosting customer-owned computer systems within dedicated data centre facilities.
These categories reflect the importance of cloud infrastructure and data centre facilities in supporting Singapore’s digital ecosystem.
For example, a cloud provider may host applications used by financial institutions, healthcare organisations and government agencies. Similarly, a data centre operator may provide the physical infrastructure and connectivity that allow multiple organisations to operate their digital platforms.
A disruption affecting these services could therefore affect many businesses simultaneously.
What Is a Major Foundational Digital Infrastructure Service Provider?
An important distinction under the Cybersecurity Act is that providing an FDI service does not automatically make an organisation a regulated major FDI service provider.
Under Section 18G, the Commissioner of Cybersecurity may designate a provider as a major foundational digital infrastructure service provider through a written notice.
The designation considers two main elements:
1. Critical Systems Supporting Continuous Service Delivery
The provider must operate a computer or computer system, or a class of systems, that is necessary for the continuous delivery of the relevant foundational digital infrastructure service.
These systems may include:
Cloud computing infrastructure.
Virtualisation and computing platforms.
Data storage and processing systems.
Network and connectivity infrastructure.
Systems supporting data centre operations.
Management and control platforms required to deliver the service.
2. Potential Impact on a Large Number of Businesses
The provider must also meet one of the following geographical and impact conditions:
It provides the service to persons in Singapore, whether from within or outside Singapore, and loss or impairment of the service is likely to disrupt or deteriorate the operations of a large number of businesses or organisations in Singapore.
It provides the service wholly or partly from Singapore, and loss or impairment is likely to disrupt or deteriorate the operations of a large number of businesses or organisations in Singapore or overseas.
The Commissioner considers the provider’s role in supporting other organisations and the potential consequences of service disruption.
Importantly, the Act does not establish a simple rule that every cloud provider or data centre operator must be designated. The criteria and formal designation process determine which providers fall within the major FDI framework.
How Does the FDI Designation Process Work?
The designation process gives CSA the authority to identify providers whose services have significant importance to Singapore’s digital infrastructure.
1. Information Gathering
Under Section 18H, the Commissioner may issue a notice requiring a person who appears to provide an FDI service to supply relevant information.
This information helps determine whether the provider meets the major FDI designation criteria.
It may cover:
The nature and purpose of the digital infrastructure service.
The systems required to deliver the service.
The number and types of organisations relying on the service.
The extent of business operations supported by the service.
Whether the service is provided from Singapore or overseas.
The potential consequences of service disruption.
2. Formal Designation
If the Commissioner is satisfied that the statutory criteria are met, the provider may receive a written designation notice under Section 18G.
The notice identifies the relevant FDI service, the designated provider and the computer systems necessary for continuous service delivery.
It also explains the duties and responsibilities arising from designation.
3. Overseas Provider Requirements
The framework can apply to providers located outside Singapore if they provide qualifying FDI services to persons in Singapore.
A designated major FDI service provider located outside Singapore must appoint a person in Singapore to accept notices and directions under the Cybersecurity Act.
This ensures that regulatory communications can be formally served even when the provider operates from another jurisdiction.
What Are the Cybersecurity Obligations of Major FDI Service Providers?
Once designated, major FDI service providers become subject to cybersecurity responsibilities under Part 3D of Singapore’s Cybersecurity Act.
These requirements are intended to improve the protection, monitoring and resilience of infrastructure that supports a large number of organisations.
1. Reporting Cybersecurity Incidents
Under Section 18M, a designated major FDI service provider must notify the Commissioner of prescribed cybersecurity incidents affecting its major FDI systems or other computer systems under its control when the incident:
Causes disruption or degradation to the continuous delivery in Singapore of the designated FDI service; or
Has a significant impact on the provider’s business operations in Singapore.
Reporting must take place within the prescribed period and in the prescribed manner after the provider becomes aware of the incident.
This helps CSA obtain better visibility into incidents that could affect important digital infrastructure services.
2. Establishing Threat Detection Mechanisms
Section 18M also requires designated providers to establish mechanisms and processes for detecting cybersecurity threats and incidents affecting their major FDI systems.
These mechanisms should support the identification of suspicious activities, potential compromises and security events that could disrupt service delivery.
Relevant security measures may include:
Network and infrastructure monitoring.
Security event logging and analysis.
Intrusion detection mechanisms.
Vulnerability monitoring.
Threat detection and investigation procedures.
Incident escalation and response processes.
The applicable codes of practice determine the specific expectations.
3. Responding to Regulatory Requirements
Designated providers must also take account of applicable codes of practice, standards of performance and written directions issued under the Cybersecurity Act.
They should maintain suitable governance arrangements and ensure that relevant technical teams understand their cybersecurity responsibilities.
4. Protecting Data Availability, Confidentiality and Integrity
The Cybersecurity Act recognises that loss or impairment of an FDI service can include the loss or impairment of the availability, confidentiality or integrity of data stored, transmitted or processed through the service.
Consequently, cybersecurity arrangements should address more than service uptime.
Providers should also consider data protection, access management, system integrity, secure configurations and the prevention of unauthorised access.
Why Is Cybersecurity Assessment Important for FDI Providers?
Cloud infrastructure and data centres often support multiple organisations and business operations. A vulnerability affecting shared infrastructure could therefore create risks across several customer environments.
Regular security assessments help providers identify weaknesses and improve their ability to protect critical digital services.
Key benefits include:
Identifying vulnerabilities: Discover weaknesses in cloud infrastructure, servers, networks and management platforms.
Reducing attack exposure: Identify potential attack paths that could allow unauthorised access or compromise.
Protecting customer environments: Review security controls that help prevent unauthorised access to shared infrastructure.
Strengthening resilience: Identify weaknesses that could affect availability and continuous service delivery.
Improving incident readiness: Evaluate monitoring, detection, escalation and response capabilities.
Supporting regulatory responsibilities: Produce technical findings and documentation that can assist with applicable cybersecurity obligations.
Security assessments should be designed around the infrastructure architecture, shared responsibility arrangements and operational sensitivity of the environment.
Our Structured Cybersecurity Assessment Methodology
At Cyberintelsys, a structured cybersecurity assessment approach helps organisations identify technical weaknesses, understand potential attack scenarios and improve their security controls.
Our methodology includes the following stages:
Scoping and Planning: Understand the organisation’s infrastructure, technology environment, business requirements and assessment boundaries.
Information Gathering: Review network architecture, cloud configurations, applications, servers, access arrangements and relevant infrastructure components.
Vulnerability Identification: Conduct systematic security testing to identify weaknesses, misconfigurations and potential security gaps.
Security Validation: Where authorised and within the agreed scope, validate identified vulnerabilities to understand their exploitability and potential impact.
Risk Analysis: Evaluate findings according to severity, exploitability, affected systems and potential business consequences.
Reporting: Prepare a detailed report containing vulnerabilities, supporting evidence, risk ratings and recommended remediation measures.
Remediation Support and Retesting: Help organisations understand remediation priorities and validate whether addressed vulnerabilities have been resolved.
For cloud and data centre environments, assessment planning should consider shared infrastructure, tenant separation, access controls, network segmentation and operational availability. All testing must be authorised and carefully scoped to avoid disruption.
Cyberintelsys Services for FDI Cybersecurity
Cyberintelsys supports organisations in identifying security weaknesses and strengthening their cybersecurity posture through specialised assessment and testing services.
Relevant services include:
Vulnerability Assessment: Identifies security weaknesses across cloud infrastructure, servers, networks and applications, helping organisations understand and prioritise their exposure.
Penetration Testing: Simulates authorised attack techniques to determine whether vulnerabilities can be exploited and assess their potential impact.
Cloud Security Assessment: Reviews cloud configurations, identity and access management, network controls, storage security and other relevant cloud security settings.
Network Penetration Testing: Evaluates internal and external network environments to identify weaknesses that could allow unauthorised access or lateral movement.
Web Application Security Testing: Assesses applications for vulnerabilities involving authentication, access control, application logic and data protection.
Red Teaming: Simulates realistic adversary techniques to evaluate an organisation’s ability to prevent, detect and respond to cyber threats.
Security Assessment and Advisory: Provides technical insights and recommendations to help organisations improve security controls and strengthen cyber resilience.
Certifications and Accreditations
- Cybersecurity Service Provider (CSP) Licence – Singapore: Cyberintelsys holds a CSP Licence issued by the Cyber Security Agency of Singapore (CSA) for providing penetration testing services in Singapore, within the scope of its licence.
- Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognized security testing services across multiple sectors.
- Cyberintelsys also holds ISO/IEC 27001:2022 certifications through Bureau Veritas under UKAS accreditation and Singapore Accreditation Council (SAC) accreditation.
These credentials support its security services, but they do not replace the system owner’s responsibility to fulfil applicable statutory obligations.
Why Choose Cyberintelsys?
Selecting a cybersecurity assessment provider is an important consideration for organisations operating cloud infrastructure, data centres and other critical digital services.
Cyberintelsys combines structured assessment processes with technical testing capabilities to help organisations understand their security exposure.
Organisations can benefit from:
Relevant industry credentials: CSP licensing within the applicable Singapore scope and CREST accreditation for VA and PT.
Structured assessment methodology: A systematic approach covering planning, testing, validation and reporting.
Technical security expertise: Assessments designed to identify vulnerabilities and potential attack paths.
Actionable findings: Clear technical reports with risk explanations and practical remediation recommendations.
Security improvement support: Technical insights that help organisations strengthen controls and improve cyber resilience.
Conclusion
Foundational Digital Infrastructure is an important part of Singapore’s cybersecurity framework because cloud computing and data centre services support a large proportion of the country’s digital economy.
Under the Cybersecurity Act, the Commissioner can designate qualifying providers as major FDI service providers when their systems and services meet the statutory criteria. Designated providers have responsibilities relating to cybersecurity incident reporting and threat detection.
Cyberintelsys helps organisations strengthen their cybersecurity posture through vulnerability assessments, penetration testing, cloud security assessments and red teaming.
Contact Cyberintelsys to discuss your cybersecurity assessment requirements and take practical steps towards protecting your cloud infrastructure, data centre environments and digital services.
