Singapore’s Cybersecurity Act 2018 is a national cybersecurity law designed to protect essential services, strengthen cyber resilience, and establish regulatory oversight of specified computer systems and cybersecurity service providers. It provides the legal foundation for preventing, managing, and responding to cybersecurity threats and incidents that could affect Singapore’s economy, public safety, national security, and essential services.

As organizations increasingly rely on interconnected IT infrastructure, cloud platforms, industrial control systems, and digital services, cybersecurity risks can affect more than confidential information. A successful cyberattack may disrupt business operations, interrupt essential services, or compromise systems that control physical processes.

The Cybersecurity Act establishes requirements for organizations and systems that fall within its scope. These include designated Critical Information Infrastructure (CII), certain third-party-owned systems supporting essential services, systems of temporary cybersecurity concern, entities of special cybersecurity interest, and major foundational digital infrastructure service providers.

The Cybersecurity (Amendment) Act 2024 introduced significant changes that took effect on 31 October 2025. These changes expanded the regulatory framework to address evolving technologies, supply-chain dependencies, and additional categories of digital infrastructure. 

Cyberintelsys helps organizations assess their cybersecurity posture through vulnerability assessments, penetration testing, risk assessments, and security reviews that can support applicable regulatory and security objectives.

What Are the Main Objectives of the Cybersecurity Act?

The Act establishes a framework for protecting Singapore’s digital infrastructure and managing cybersecurity risks that could have significant consequences.

Its principal objectives include:

• Protecting Critical Information Infrastructure: Establishing regulatory requirements for designated systems that support essential services.

• Managing cybersecurity threats and incidents: Empowering the Cyber Security Agency of Singapore (CSA) to investigate and respond to significant cybersecurity threats and incidents.

• Supporting information sharing: Providing a framework for obtaining and sharing relevant cybersecurity information.

• Regulating cybersecurity service providers: Establishing licensing requirements for specified cybersecurity services, including penetration testing and managed security operations centre monitoring.

• Expanding cybersecurity oversight: Addressing additional categories of systems and organizations under the amended legislation.

These objectives support a coordinated approach to cybersecurity, combining preventive controls, incident response, regulatory oversight, and accountability. 

Who Must Comply with Singapore’s Cybersecurity Act 2018?

The Act does not impose identical obligations on every business operating in Singapore. Requirements depend on the applicable statutory provisions, the nature of the systems involved, and whether an organization or system has been designated or otherwise falls within the legislation.

1. Owners of Critical Information Infrastructure

CII refers to computer systems necessary for the continuous delivery of essential services, where their loss or compromise could have a debilitating effect on those services.

Singapore’s CII sectors include:

• Energy

• Water

• Banking and finance

• Healthcare

• Land Transport

• Maritime 

• Aviation

• Infocomm

• Media

• Security and emergency services

• Government

Not every organization operating in these sectors is automatically a CII owner. The Act applies to computer systems that have been formally designated as CII because they are necessary for the continuous delivery of essential services and meet the applicable statutory criteria.

2. Providers Responsible for Third-Party-Owned CII

• The amended Act allows CSA to designate a provider of an essential service that is responsible for the cybersecurity of qualifying CII owned by a third party.

• This recognizes that essential services may depend on infrastructure operated or owned by external organizations. The designated provider has specific responsibilities under the Act, including requirements relating to cybersecurity oversight, incident reporting, and ensuring that the third-party-owned CII meets applicable cybersecurity requirements.

3. Other Regulated Systems and Entities

The amended legislation introduced additional regulatory categories of systems and entities that CSA may designate or regulate under the Act. These include:

• Systems of Temporary Cybersecurity Concern (STCC): Systems designated because of a high cybersecurity risk over a limited period and the potential for serious detrimental consequences.

• Entities of Special Cybersecurity Interest (ESCI): Certain entities designated because they hold sensitive information or perform functions whose disruption could significantly affect Singapore’s national interests.

• Major Foundational Digital Infrastructure (FDI) service providers: Providers of designated foundational digital infrastructure services, including qualifying cloud and data centre services.

Each category has its own applicability criteria and obligations. Organizations should consult the current legislation and CSA guidance to determine whether specific requirements apply.

Key Regulatory Requirements Under the Act

1. Cybersecurity Risk Management

• Designated CII owners must conduct cybersecurity risk assessments at least annually, subject to the applicable statutory provisions and requirements.
• Risk assessments help identify vulnerabilities, evaluate potential threats, assess operational consequences, and determine appropriate risk treatment measures.
• Organizations should consider their critical assets, network architecture, access controls, third-party dependencies, and incident-response capabilities when evaluating cybersecurity exposure.

2. Periodic Security Audits

• The Act requires applicable CII owners to undergo cybersecurity audits at least once every two years, or more frequently when directed by the Commissioner of Cybersecurity.
• The audit evaluates compliance with applicable statutory requirements, cybersecurity standards, and relevant codes of practice. Organizations must ensure that the required audit is conducted by an auditor approved or appointed as required under the regulatory framework.
• A general penetration test or internal security review does not automatically replace the required statutory audit.

3. Cybersecurity Incident Reporting

• The Act establishes incident reporting obligations for designated systems and other regulated entities, according to their applicable requirements.
• Organizations should maintain incident-response procedures that define how incidents are detected, escalated, investigated, documented, and reported. Certain CII incidents are subject to a two-hour reporting deadline, with additional reporting requirements depending on the prescribed incident category.

4. Compliance with Codes of Practice

• Applicable organizations must follow the relevant statutory requirements, codes of practice, and standards of performance.
• These requirements may address security governance, access management, vulnerability management, network protection, monitoring, and operational resilience.
• A structured compliance review can help organizations identify gaps between existing controls and applicable requirements.

5. Cybersecurity Service Provider Licensing

• Singapore’s framework licenses specified cybersecurity service providers, including providers of penetration testing and managed security operations centre monitoring.
• Organizations engaging external providers for regulated services should verify the provider’s licensing status and authorized service scope. The licensing obligation applies according to the Act and applicable licensing rules, rather than automatically covering every cybersecurity consulting activity.

Why Is the Cybersecurity Act Important for Organizations?

The Cybersecurity Act encourages organizations responsible for critical systems to treat cybersecurity as an ongoing risk-management responsibility rather than a one-time technical exercise.

Cyberattacks can affect business continuity, customer confidence, sensitive information, and essential services. In industrial environments, security incidents may also affect equipment availability, production processes, and physical safety.

A structured cybersecurity programme helps organizations:

• Identify and prioritize vulnerabilities before they are exploited.

• Strengthen access controls and network security.

• Improve monitoring and incident-response readiness.

• Evaluate risks arising from suppliers and connected systems.

• Maintain evidence of applicable compliance activities.

• Improve resilience and recovery capabilities.

Regular security assessments provide practical insight into weaknesses and help management prioritize remediation according to risk and operational impact.

Our Methodology for Cybersecurity Assessment

Cyberintelsys follows a risk-based assessment approach tailored to the organization’s environment, security objectives, and agreed scope.

1. Scope Definition and Asset Discovery

• The assessment begins by identifying the systems, applications, networks, and infrastructure within scope. This may include servers, endpoints, databases, firewalls, cloud-connected assets, SCADA systems, PLCs, and other operational technology components.

2. Regulatory Gap Assessment

• Applicable regulatory requirements and organizational security policies are mapped against existing technical and procedural controls. This helps identify areas requiring improvement and supports compliance planning.

3. Cybersecurity Risk Assessment

• Potential threats, vulnerabilities, existing safeguards, and business impacts are evaluated. Findings are prioritized according to risk and the criticality of affected systems.

4. Vulnerability Assessment

• Authorized testing identifies known vulnerabilities, outdated components, exposed services, and insecure configurations across in-scope systems.

5. Penetration Testing

• Where appropriate and authorized, penetration testing evaluates whether selected vulnerabilities can be exploited. Testing methods are chosen according to system sensitivity and operational constraints.

6. Reporting and Remediation

• The final report documents findings, supporting evidence, risk ratings, and remediation recommendations. Follow-up testing may be used to validate corrective actions and identify residual risks.
• These assessment services can support an organization’s cybersecurity programme but do not replace any statutory audit or regulatory obligation that requires a specifically qualified or approved auditor.

Cyberintelsys Cybersecurity Services

Cyberintelsys supports organizations seeking to improve security controls and evaluate their cybersecurity readiness.

• Vulnerability Assessment: Identifies known security weaknesses, outdated software, exposed services, and insecure configurations across in-scope infrastructure.

• Penetration Testing: Evaluates the exploitability of selected weaknesses through authorized testing designed around agreed objectives and safeguards.

• IT and OT Security Assessment: Reviews enterprise IT and industrial environments, including network segmentation, remote access, control systems, and operational dependencies.

• Cybersecurity Risk Assessment: Evaluates threats, vulnerabilities, and potential impacts to help organizations prioritize risk treatment.

• Compliance Gap Assessment: Compares existing controls with applicable regulatory requirements and identifies areas requiring improvement.

• Remediation and Retesting: Helps verify corrective actions and reassess previously identified vulnerabilities.

Certifications and Accreditations

• Cyberintelsys holds a Cybersecurity Service Provider (CSP) licence issued under Singapore’s Cybersecurity Act for penetration testing services, within the applicable scope of its licence.
• Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognized security testing services for organizations across multiple sectors.
• Cyberintelsys also holds ISO/IEC 27001:2022 Information Security Management System certifications through Bureau Veritas under UKAS and Singapore Accreditation Council (SAC) accreditation, respectively, within the relevant certification scopes.

Why Choose Cyberintelsys?

Organizations need a cybersecurity partner that understands technical vulnerabilities, business risks, and operational requirements.

Cyberintelsys emphasizes structured assessment, clear reporting, and practical remediation recommendations to help organizations strengthen their security posture.

Key benefits include:

• Risk-based assessments: Prioritize weaknesses according to potential impact and exposure.

• Technical expertise: Evaluate security weaknesses across in-scope IT and OT environments.

• Compliance support: Help organizations identify control gaps and prepare for applicable regulatory requirements.

• Practical recommendations: Provide actionable findings that support remediation planning.

• Security improvement: Support follow-up assessments to help validate implemented controls.

The right assessment depends on the organization’s systems, regulatory status, and cybersecurity objectives.

Contact Cyberintelsys

Singapore’s Cybersecurity Act 2018 provides an important framework for protecting critical systems, strengthening cyber resilience, and establishing responsibilities for designated organizations and regulated service providers.

Organizations should determine which provisions apply to their systems, review their existing security controls, and address identified weaknesses through a structured cybersecurity programme.

Contact Cyberintelsys to discuss vulnerability assessment, penetration testing, IT/OT security reviews, cybersecurity risk assessments, and compliance gap assessments. Strengthen your cybersecurity posture, improve resilience, and prepare to meet your applicable regulatory requirements.