Foundational Digital Infrastructure (FDI) plays a critical role in supporting Singapore’s digital economy. Cloud computing platforms and data centre facilities enable businesses to store information, run applications, process transactions, and deliver essential digital services. As more organizations depend on these services, the security and availability of the underlying infrastructure become increasingly important.

A cyberattack against a cloud environment or data centre can affect multiple customers, interrupt business operations, expose sensitive information, and undermine confidence in digital services. Risks may arise from unpatched software, misconfigured cloud resources, weak access controls, insecure management interfaces, compromised credentials, supply-chain weaknesses, or inadequate incident detection.

Singapore’s Cybersecurity Act 2018, as amended by the Cybersecurity (Amendment) Act 2024, expands regulatory oversight beyond traditional Critical Information Infrastructure (CII). It introduces provisions for Foundational Digital Infrastructure, including a framework under which qualifying providers may be designated as major foundational digital infrastructure service providers.

Organizations operating cloud computing services or data centre facilities should understand whether they fall within the relevant regulatory scope and prepare their infrastructure, security processes, and incident response capabilities accordingly. A structured cybersecurity assessment can help identify weaknesses, strengthen resilience, and support compliance with applicable obligations.

Understanding FDI Under Singapore’s Cybersecurity Act

The Cybersecurity Act establishes Singapore’s framework for protecting national cybersecurity and responding to threats that could affect important digital systems and services. The amendments expand the regulatory framework to address the growing importance of infrastructure that supports a broad range of businesses and organizations.

Under the Act’s Third Schedule, the specified foundational digital infrastructure services include:

• Cloud computing services: Services that provide on-demand access to scalable, shareable computing resources, including resources distributed across multiple locations.

• Data centre facility services: Services involving the centralized accommodation, interconnection, and operation of computer systems in a facility in Singapore to support another person’s data storage, processing, and transmission.

The Act empowers the Commissioner of Cybersecurity to designate qualifying providers as major foundational digital infrastructure service providers. Designation depends on the statutory criteria, including the importance of the infrastructure to continuous service delivery and the potential for disruption affecting a large number of businesses or organizations.

Designation is not automatic for every cloud provider or data centre operator. Organizations should evaluate the service definitions, relevant statutory conditions, and any formal notices issued to them.

Key Cybersecurity Responsibilities for FDI Providers

Singapore’s Cybersecurity Act establishes a regulatory framework for major foundational digital infrastructure service providers. The framework provides for information-gathering powers, cybersecurity directions and incident reporting requirements. These provisions apply to qualifying providers following their commencement and designation, as applicable.

1. Understand Regulatory Scope and Designation

• Providers should determine whether their services fall within the statutory definitions of foundational digital infrastructure services and assess whether they may meet the criteria for designation as a major foundational digital infrastructure service provider.

• Section 18H provides for the Commissioner to request relevant information to determine whether a provider meets the designation criteria. Providers should maintain accurate information about their services, infrastructure, operating locations and service dependencies.

2. Apply Relevant Cybersecurity Codes and Standards

• Section 18L provides the Commissioner with powers to issue written directions concerning cybersecurity measures, applicable codes of practice, standards of performance and independent audits.

• Providers should be prepared to identify applicable requirements, assign responsibility for implementing them and maintain appropriate documentation and evidence of their cybersecurity controls.

3. Establish Cybersecurity Incident Detection and Reporting

• Section 18M establishes incident-reporting requirements for designated major foundational digital infrastructure service providers. These requirements cover prescribed cybersecurity incidents that meet the applicable statutory conditions, including specified service disruption or degradation and significant business impact.

• Providers should establish incident detection, investigation, escalation and reporting procedures to support timely notification in accordance with the applicable regulations and directions.

4. Maintain Visibility Across Infrastructure and Suppliers

• Cloud and data centre environments often depend on third-party software, hardware, network connectivity, maintenance providers and other external services. Providers should understand these dependencies and assess how a compromise could affect service availability, confidentiality or integrity.

• Asset inventories, infrastructure dependency maps, supplier reviews and access records can help identify weaknesses and reduce risks arising from interconnected systems and third-party environments.

The specific statutory obligations of a provider should be determined by reviewing the applicable provisions, commencement notifications, designation notices, regulations, codes of practice and written directions.

Importance of FDI Cybersecurity Assessment

A cybersecurity assessment helps organizations evaluate whether their infrastructure security controls are effective against realistic attack scenarios. For FDI providers, this is especially important because weaknesses in shared or interconnected environments may have consequences beyond a single system or customer.

Core operational components that may require assessment include:

• Cloud management consoles, administrative portals, and identity platforms.

• Virtual machines, hypervisors, container platforms, and orchestration systems.

• Data centre networks, switches, routers, firewalls, and security appliances.

• Storage systems, backup infrastructure, and disaster recovery environments.

• APIs, remote administration interfaces, and service-to-service connections.

• Monitoring platforms, logging systems, and incident response tools.

• Supplier access, privileged accounts, and third-party management connections.

Common threats include ransomware, credential theft, privilege escalation, exposed management interfaces, insecure APIs, cloud misconfiguration, denial-of-service attacks, exploitation of unpatched vulnerabilities, and supply-chain compromise.

An effective assessment identifies technical weaknesses, evaluates their potential operational impact, and prioritizes remediation based on risk. It can also help validate segmentation, strengthen access controls, improve detection capabilities, and support continuity planning.

How to Secure Foundational Digital Infrastructure

1. Strengthen Identity and Access Management

• Apply least-privilege access across cloud consoles, infrastructure management systems, and data centre administration tools. Use multifactor authentication for privileged and remote access, remove unnecessary accounts, and review permissions regularly. Privileged access should be monitored and granted only to authorized personnel with a defined business need.

2. Secure Network Architecture

• Separate management networks from customer-facing services and internal workloads. Apply segmentation between environments according to their function and risk. Restrict administrative interfaces to approved access paths, review firewall rules, and remove unnecessary exposed services. Network architecture reviews should also examine the risks created by trusted connections between tenants, systems, and suppliers.

3. Manage Vulnerabilities and Configuration Risks

• Maintain a current inventory of infrastructure assets, operating systems, software versions, exposed services, and dependencies. Conduct vulnerability assessments at an appropriate frequency and after significant changes. Prioritize remediation based on exploitability, exposure, asset criticality, and potential service impact.
• Configuration reviews should identify excessive permissions, insecure defaults, exposed storage, weak encryption settings, unnecessary services, and inadequate separation between environments. Any penetration testing must be properly authorized, scoped, and planned to avoid unnecessary disruption to production services.

4. Improve Monitoring and Incident Response

• Centralize relevant logs from identity systems, network devices, cloud platforms, servers, and security tools. Monitor suspicious authentication activity, unexpected configuration changes, privilege escalation, unusual data transfers, and attempts to disable security controls.
• Develop incident response procedures covering triage, containment, evidence preservation, recovery, stakeholder communication, and regulatory reporting. Test these procedures through tabletop exercises and technical simulations that reflect the organization’s operating environment.

5. Protect Backups and Service Continuity

• Maintain protected backups of critical configurations, system images, and business data. Separate backup administration from routine production access and test restoration procedures regularly. Disaster recovery plans should account for infrastructure dependencies, recovery priorities, and the possibility that a cyber incident could affect multiple connected services.

6. Assess Third-Party and Supply-Chain Risks

• Evaluate the security practices of vendors and service providers with access to infrastructure or sensitive operational information. Define access restrictions, contractual security responsibilities, incident notification expectations, and requirements for secure maintenance. Review supplier access periodically and remove it when it is no longer necessary.

Our Methodology for FDI Security Assessment

Cyberintelsys follows a risk-based assessment approach designed to evaluate the cybersecurity posture of cloud environments, data centre infrastructure, and supporting digital services. The assessment scope is agreed with the organization and tailored to its architecture, operational constraints, and applicable requirements.

1. Scope Definition and Asset Discovery

• The assessment begins by identifying in-scope infrastructure, business-critical services, management systems, network components, cloud resources, and external dependencies. Asset inventories and architecture diagrams are reviewed to understand service delivery and identify important trust boundaries.

2. Architecture and Configuration Assessment

• Cloud configurations, network segmentation, administrative interfaces, identity controls, storage permissions, and management pathways are reviewed. The objective is to identify unnecessary exposure, insecure configurations, excessive privileges, and weaknesses that could enable unauthorized access or service disruption.

3. Vulnerability Assessment

• Authorized scanning and manual validation are used to identify vulnerabilities in the agreed scope. Findings are assessed according to severity, exploitability, exposure, and potential operational consequences. Testing methods are selected to reduce the risk of disrupting production workloads.

4. Access Control and Security Control Review

• The assessment evaluates authentication mechanisms, privileged access, account lifecycle management, logging, monitoring, encryption, backup protection, and security configuration practices. Where appropriate, the review also considers how administrative and supplier access is controlled.

5. Controlled Penetration Testing

• Where authorized and suitable for the environment, penetration testing examines whether identified weaknesses can be combined into realistic attack paths. Testing boundaries, production safeguards, escalation procedures, and stop conditions are agreed in advance.

6. Incident Response and Resilience Review

• Incident response plans, detection capabilities, escalation workflows, backup recovery, and disaster recovery arrangements are examined. The review considers whether the organization can detect and respond to relevant threats while maintaining or restoring critical services.

7. Reporting and Remediation Validation

• Cyberintelsys provides a report describing identified vulnerabilities, risk ratings, supporting evidence, potential impacts, and prioritized recommendations. Following remediation, validation testing can help confirm whether the reported weaknesses have been addressed effectively.

Cyberintelsys Services for Foundational Digital Infrastructure

Cyberintelsys supports organizations seeking to strengthen their cybersecurity posture through services tailored to their infrastructure and operational requirements.

• Vulnerability Assessment: Identifies known vulnerabilities, insecure configurations, exposed services, and weaknesses across agreed infrastructure assets.

• Penetration Testing: Evaluates whether authorized security testing can exploit weaknesses and demonstrate realistic attack paths within the approved scope.

• Cloud Security Assessment: Reviews cloud configurations, identity permissions, storage access, network exposure, administrative controls, and security monitoring.

• Network Security Assessment: Evaluates segmentation, firewall rules, network devices, remote access pathways, and connectivity between critical environments.

• Configuration and Access Control Review: Examines system hardening, privileged accounts, authentication practices, and security settings.

• Security Architecture Review: Assesses infrastructure design, trust boundaries, interconnections, and potential single points of failure.

• Incident Response Readiness Review: Evaluates detection, escalation, containment, recovery, and reporting procedures.

• Remediation Validation: Retests agreed findings to determine whether corrective actions have reduced the identified risks.

Certifications and Accreditations

• Cyberintelsys holds a Cybersecurity Service Provider (CSP) licence issued under Singapore’s Cybersecurity Act for penetration testing services, within the applicable scope of its licence.
• Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognized security testing services for organizations across multiple sectors.
• Cyberintelsys also holds ISO/IEC 27001:2022 Information Security Management System certifications through Bureau Veritas under UKAS and Singapore Accreditation Council (SAC) accreditation, respectively, within the relevant certification scopes.

Why Choose Cyberintelsys?

Securing foundational digital infrastructure requires an understanding of technical vulnerabilities, business continuity, service dependencies, and the risks associated with interconnected systems. Cyberintelsys applies a structured, risk-based approach to help organizations identify weaknesses and improve their security controls.

Key benefits include:

• Risk-focused assessment: Findings are prioritized according to their potential impact and exploitability.

• Infrastructure-specific testing: Assessment activities are tailored to the agreed cloud, network, and data centre environment.

• Actionable reporting: Recommendations help technical teams understand findings and plan remediation.

• Operational awareness: Testing is planned with appropriate scope, authorization, and safeguards to minimize disruption.

• Remediation support: Validation activities can help determine whether identified weaknesses have been addressed.

• Security improvement: Findings can inform longer-term improvements to access control, vulnerability management, monitoring, and resilience.

Cyberintelsys can help organizations develop a clearer understanding of their cybersecurity risks and establish practical priorities for improving infrastructure protection.

Conclusion

Foundational Digital Infrastructure is essential to the reliability of Singapore’s digital economy. Cloud computing services and data centre facilities support numerous businesses, making their security and resilience important considerations for providers and customers alike.

Singapore’s Cybersecurity Act provides a framework for the oversight of qualifying foundational digital infrastructure providers, including designation of major providers and obligations relating to cybersecurity controls and incident reporting. Organizations should assess their regulatory position, understand the requirements that apply to them, and maintain appropriate technical and operational safeguards.

A structured security assessment can help identify vulnerabilities, strengthen infrastructure configurations, improve incident response, and support more resilient service delivery.

Contact Cyberintelsys

Looking to strengthen the security of your cloud infrastructure, data centre environment, or supporting digital services?

Cyberintelsys can help assess vulnerabilities, evaluate security controls, and recommend practical improvements aligned with your organization’s risk profile and applicable requirements.

Visit Cyberintelsys to learn more about Vulnerability Assessment, Penetration Testing, and cybersecurity assessment services.