Singapore’s digital infrastructure supports essential public services, government operations, healthcare delivery, financial transactions, and national security. Certain systems become especially important during temporary events, emergencies, or time-sensitive operations. Examples include systems supporting election processes, vaccine distribution during a pandemic, and other activities where disruption could have serious consequences for Singapore.

To address these risks, the Cybersecurity (Amendment) Act 2024 introduced a regulatory framework for Systems of Temporary Cybersecurity Concern (STCCs). The relevant provisions came into force on 31 October 2025, empowering the Cyber Security Agency of Singapore (CSA) to designate qualifying systems for a limited period and require their owners to implement cybersecurity measures.

An STCC is not simply any system used for a temporary project. Under Section 17 of the Cybersecurity Act 2018, the Commissioner of Cybersecurity may designate a computer or computer system as an STCC if satisfied that, for a limited period, there is a high risk of a cybersecurity threat or incident that could jeopardise its cybersecurity, and that its loss or compromise would have a serious detrimental effect on Singapore’s national security, defence, foreign relations, economy, public health, public safety or public order. The system must also be located wholly or partly in Singapore.

Organizations operating systems that may fall within this framework should prepare by strengthening security controls, monitoring threats, maintaining system documentation, and establishing incident-response procedures.

Cyberintelsys supports organizations with cybersecurity assessments, vulnerability assessment and penetration testing (VAPT), and compliance gap assessments to help identify weaknesses and improve security readiness.

Understanding Singapore’s STCC Regulatory Framework

The Cybersecurity Act 2018 establishes Singapore’s legal framework for managing cybersecurity threats and protecting computer systems that are important to national interests.

The STCC provisions are intended to address situations where a system becomes particularly exposed to cyber threats because of a temporary event or operating requirement.

For example, a system supporting a national election may become a high-value target during the election period. A digital platform coordinating emergency healthcare resources may also become particularly important during a public health crisis.

Under Section 17, the Commissioner may designate a computer or computer system as an STCC through a written notice to its owner. The notice identifies the designated system, the owner, the designation period, the owner’s responsibilities, the supervising officer, and the applicable process for making representations or appealing the designation. 

The designation period cannot exceed one year at a time, although it may be extended if the relevant criteria continue to be met. The Commissioner may also withdraw the designation when the system no longer meets the criteria.

Organizations should therefore distinguish between general cybersecurity best practices and the specific legal obligations that arise when a system is formally designated.

Key Security Requirements for an STCC

1. Understand the Designation and Its Scope

The first step is to review the formal designation notice and determine exactly which computer or computer system is covered.

Organizations should identify:

• The designated system and its primary functions.

• The legal owner and operational stakeholders.

• The beginning and end of the designation period.

• Connected systems, external interfaces, and relevant dependencies.

• Applicable regulatory duties and directions.

• The CSA officer assigned to supervise the system’s cybersecurity.

This information establishes the boundaries of the security programme and helps prevent critical dependencies from being overlooked.

2. Maintain Accurate System and Network Documentation

Section 17D allows the Commissioner to request information about an STCC’s design, configuration, security, and operation.

The Cybersecurity (Systems of Temporary Cybersecurity Concern) Regulations 2025 specify information that may be requested, including network diagrams, key components, physical locations, operating systems, software versions, internet-facing ports, data types, and cybersecurity responsibilities. Information may also be required about connected systems and outsourced service providers.

Organizations should maintain current records covering:

• Hardware, software, applications, and cloud resources.

• Network architecture and communication pathways.

• External connections and remote-access arrangements.

• Data flows and system dependencies.

• System owners, operators, and security contacts.

• Third-party service providers and support arrangements.

Accurate documentation supports both effective security management and timely responses to regulatory information requests.

3. Implement Strong Access Controls

• Unauthorized access can compromise the confidentiality, integrity, or availability of a designated system.
• Organizations should apply role-based access controls, multi-factor authentication where appropriate, least-privilege permissions, and separate administrative accounts.
• Privileged access should be limited to authorized personnel, reviewed regularly, and monitored for unusual activity. Temporary staff and external contractors should receive access only for approved tasks and for the necessary period.
• Remote access should use approved secure channels, with authentication, access restrictions, logging, and prompt revocation when access is no longer required.

4. Strengthen Network Security and System Hardening

STCC environments may involve public-facing applications, enterprise systems, cloud infrastructure, or operational technology. Each environment requires controls appropriate to its risk.

Recommended measures include:

• Restricting unnecessary internet exposure and open ports.

• Applying secure configuration baselines.

• Separating critical systems from less-trusted networks.

• Restricting communications to approved services.

• Deploying firewalls and other suitable protective controls.

• Disabling unused accounts, services, and protocols.

• Applying security patches through controlled change management.

Where the system supports industrial or safety-sensitive operations, security changes should be tested and approved before implementation to avoid disrupting essential processes.

5. Identify and Remediate Vulnerabilities

• Vulnerability management is essential when a system becomes a potential target during a high-risk period.
• Organizations should review vendor advisories, monitor newly disclosed vulnerabilities, identify unsupported software, and prioritize weaknesses according to exploitability and potential impact.
• Vulnerability scanning and penetration testing can help identify technical exposure, but testing must be authorized and appropriately scoped. Disruptive testing should not be conducted on sensitive production systems without suitable safeguards.
• For systems with limited maintenance windows, organizations should establish compensating controls when immediate patching is not feasible. These may include stronger segmentation, restricted access, additional monitoring, and temporary isolation of unnecessary connections.

6. Establish Continuous Monitoring and Incident Detection

• Security controls are more effective when organizations can detect suspicious activity and respond quickly.
• Monitoring should cover relevant authentication events, privileged activity, network traffic, security alerts, and system changes. Logs should be protected against unauthorized modification and retained according to applicable requirements.
• Organizations should define escalation thresholds, assign incident-response responsibilities, and ensure security personnel know how to contact the relevant decision-makers.
• Monitoring should also account for connected systems and supplier environments where incidents could affect the designated STCC.

STCC Cybersecurity Incident Reporting Requirements

Section 17F of the Cybersecurity Act establishes incident-reporting obligations for owners of designated STCCs. These obligations cover prescribed incidents involving the STCC, certain connected systems under the owner’s control, and qualifying connected systems under a supplier’s control.

Under Regulation 4 of the Cybersecurity (Systems of Temporary Cybersecurity Concern) Regulations 2025, the reporting process includes three stages:

• Initial notification: Within two hours of becoming aware of the prescribed incident, provide the required initial details through the specified reporting channel.

• Supplementary report: Within 72 hours of awareness, provide available updates, information about the cause and impact, and remedial measures taken.

• Final incident report: Within 30 days after submitting the supplementary report, provide the required final report and available updates.

Prescribed incidents include unauthorized hacking, malicious software installation or execution, unauthorized interception of communications, and certain denial-of-service attacks or other unauthorized actions affecting system availability or operability.

Organizations should maintain a reporting playbook that identifies who can submit the initial notification, how evidence will be collected, who coordinates investigation, and how supplementary and final reports will be completed.

The two-hour deadline is particularly important: incident-response procedures should enable prompt notification without waiting for a full forensic investigation to finish.

Our Methodology for STCC Security Assessment

Cyberintelsys follows a risk-based methodology designed to evaluate security weaknesses while considering the system’s purpose, operational constraints, and applicable regulatory requirements.

1. Scope and Asset Identification

• Identify the designated system, its components, operating environment, connected systems, and third-party dependencies. Review available architecture diagrams, asset inventories, and ownership records.

2. Security Configuration Review

• Evaluate system hardening, access permissions, network exposure, authentication controls, logging, and security configurations. Identify unnecessary services and weaknesses that could increase exposure during the designation period.

3. Cybersecurity Risk Assessment

• Evaluate potential threats, vulnerabilities, likelihood of compromise, and consequences for Singapore’s national interests and the organization’s operations.
• Prioritize risks according to potential impact and identify suitable risk-treatment measures.

4. Vulnerability Assessment

• Use authorized and appropriately selected testing methods to identify known vulnerabilities, outdated components, exposed services, and insecure configurations.
• Where active testing may affect system stability, use safer validation techniques or carefully controlled testing windows.

5. Penetration Testing

• Where justified and authorized, assess whether selected vulnerabilities can be exploited and determine their potential impact.
• The testing scope should be agreed in advance, with appropriate safeguards for sensitive systems and clear procedures for stopping testing if operational risks arise.

6. Incident-Response Readiness Review

• Review detection capabilities, incident escalation, reporting responsibilities, evidence preservation, communication channels, and recovery procedures.
• Test whether responsible personnel can execute the incident-response plan within the applicable reporting timelines.

7. Reporting and Remediation

• Document findings, assign risk ratings, recommend corrective actions, and establish remediation priorities.
• Follow-up assessments can help validate whether implemented controls have reduced exposure.

These services support security improvement and compliance preparation; they do not replace statutory duties or written directions issued under the Cybersecurity Act 2018.

Cyberintelsys Cybersecurity Services

Cyberintelsys provides cybersecurity assessment services that can help organizations identify technical weaknesses and strengthen security controls.

• Vulnerability Assessment: Identifies known vulnerabilities, outdated software, exposed services, and insecure configurations across in-scope systems.

• Penetration Testing: Evaluates whether selected weaknesses can be exploited through authorized testing designed around agreed scope and safeguards.

• Cybersecurity Risk Assessment: Examines threats, vulnerabilities, and potential operational impacts to support risk prioritization.

• IT and OT Security Assessment: Reviews enterprise systems and industrial environments, including access management, network segmentation, remote access, and critical dependencies.

• Compliance Gap Assessment: Compares existing security controls and documentation with applicable regulatory requirements and identifies areas for improvement.

• Incident-Response Readiness Assessment: Reviews incident-handling processes, escalation procedures, monitoring, and reporting preparedness.

• Remediation and Retesting: Helps verify corrective actions and reassess previously identified security weaknesses.

Certifications and Accreditations

• Cyberintelsys holds a Cybersecurity Service Provider (CSP) Licence from the Cyber Security Agency of Singapore (CSA) for providing penetration testing services in Singapore, within the scope of its licence

• Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognized security testing services for organizations across multiple sectors.
• Cyberintelsys also holds ISO/IEC 27001:2022 Information Security Management System certifications through Bureau Veritas under UKAS and Singapore Accreditation Council (SAC) accreditation, respectively, within the relevant certification scopes.

Why Choose Cyberintelsys?

Organizations preparing for an STCC designation need security measures that reflect both the temporary nature of the system and the potential consequences of disruption.

Cyberintelsys emphasizes structured assessments, practical recommendations, and risk-based reporting to help organizations improve cybersecurity readiness.

Key benefits include:

• Risk-focused assessment: Prioritizes weaknesses according to likelihood, exposure, and potential impact.

• Technical security expertise: Evaluates vulnerabilities across in-scope IT and OT environments.

• Operational awareness: Considers availability and continuity when selecting assessment techniques.

• Actionable recommendations: Provides practical guidance to support remediation and security improvement.

• Compliance support: Helps organizations review applicable controls and prepare relevant security documentation.

The appropriate engagement depends on the system’s architecture, designation notice, risk profile, and operational requirements.

Contact Cyberintelsys

Securing a System of Temporary Cybersecurity Concern requires a focused approach to access management, network protection, vulnerability remediation, incident detection, and regulatory reporting.

Organizations should review their STCC designation notice, establish clear security responsibilities, maintain accurate system documentation, and verify that their incident-response procedures meet the applicable reporting requirements.

Contact Cyberintelsys to discuss vulnerability assessment, penetration testing, IT/OT security reviews, cybersecurity risk assessment, and compliance gap assessment support. Strengthen your system’s defenses, reduce exposure to cyber threats, and improve readiness to meet applicable cybersecurity obligations in Singapore.