Introduction

NEWater production plants in Singapore depend on a complex ecosystem of vendors, contractors, and third-party service providers for operations, maintenance, and digital integration. While this interconnected environment enhances efficiency, it also introduces significant cybersecurity risks through third-party access points.

NEWater production plants are increasingly targeted through supply chain vulnerabilities, where attackers exploit weaker vendor systems to gain access to critical infrastructure. These risks can directly impact OT, ICS, and SCADA environments, potentially disrupting essential water treatment processes.

To address these challenges, the Cybersecurity Act 2018 mandates strict cybersecurity controls for Critical Information Infrastructure (CII). Third-party Vulnerability Assessment and Penetration Testing (VAPT), aligned with the Cybersecurity Code of Practice issued by the Cyber Security Agency of Singapore, is essential to identify, assess, and mitigate risks introduced by external entities.

Regulatory Compliance and Framework Alignment

Third-party VAPT for NEWater production plants must be conducted in accordance with the Cybersecurity Code of Practice for CII, ensuring that vendor-related risks are properly managed and controlled.

1. Key Compliance Requirements

1. Identify and assess third-party cybersecurity risks
2. Conduct regular VAPT on vendor-connected systems
3. Ensure secure remote access and integrations
4. Maintain audit logs and compliance documentation
5. Implement continuous monitoring of third-party activities

2. Frameworks and Standards Followed

Security assessments are aligned with internationally recognized frameworks and standards:

1. IEC 62443 – Industrial control system security
2. NIST Cybersecurity Framework (NIST CSF) – Risk-based cybersecurity management
3. ISO/IEC 27001 – Information security management
4. ISO/IEC 27036 – Information security for supplier relationships
5. OWASP Top 10 – Application security risks
6. CSA Cybersecurity Code of Practice for CII – Regulatory compliance baseline

Importance of Third-Party VAPT for NEWater Production Plants

Third-party Vulnerability Assessment and Penetration Testing is critical for identifying and mitigating risks introduced through external vendors and supply chain integrations.

1. Supply Chain Risk Management

1. Identify vulnerabilities in vendor systems
2. Assess risks from third-party integrations
3. Prevent indirect cyberattacks

2. Protection of OT and SCADA Systems

1. Secure remote access channels used by vendors
2. Prevent unauthorized access to control systems
3. Ensure integrity of industrial processes

3. Compliance with Cybersecurity Regulations

1. Meet Cybersecurity Act 2018 and CII Code requirements
2. Ensure vendor compliance with security policies
3. Demonstrate strong governance over third-party risks

4. Prevention of Data Breaches and Unauthorized Access

1. Identify weak authentication and access controls
2. Detect insecure APIs and communication channels
3. Prevent lateral movement within networks

5. Operational Resilience

1. Reduce risk of disruptions caused by third-party vulnerabilities
2. Maintain continuous plant operations
3. Enhance trust in critical infrastructure

Our Methodology for Third-Party VA & PT

A structured and risk-based methodology ensures comprehensive evaluation of third-party cybersecurity risks while maintaining operational safety in NEWater production plants.

1. Third-Party Inventory and Risk Profiling

1. Identify all vendors and external service providers
2. Classify third parties based on access levels and criticality
3. Map integrations with OT and IT systems

2. Access and Integration Assessment

1. Review remote access mechanisms (VPNs, gateways)
2. Evaluate API and system integrations
3. Identify insecure communication channels

3. Vulnerability Assessment

1. Scan third-party connected systems for vulnerabilities
2. Identify misconfigurations and weak controls
3. Validate findings through manual verification

4. Penetration Testing

1. Simulate attacks through third-party access points
2. Test for privilege escalation and lateral movement
3. Evaluate impact on OT and SCADA systems

5. Risk Analysis and Reporting

1. Prioritize vulnerabilities based on risk severity
2. Map findings to compliance requirements
3. Provide detailed and executive-level reports

6. Remediation and Vendor Coordination

1. Recommend mitigation strategies for identified risks
2. Collaborate with vendors for remediation
3. Validate fixes through re-testing

Cyberintelsys Services for NEWater Production Plants

Cyberintelsys provides specialized cybersecurity services to secure third-party ecosystems in NEWater production plants.

1. Third-Party Risk Assessment

• Identification and evaluation of vendor-related risks
• Risk classification based on access and impact
• Alignment with ISO/IEC 27036 standards

2. Vulnerability Assessment

• Detection of vulnerabilities in third-party systems
• Identification of insecure integrations
• Risk prioritization for remediation

3. Penetration Testing (PT)

• Simulation of real-world supply chain attacks
• Exploitation of vulnerabilities to assess impact
• Validation of access controls and defenses

4. OT and SCADA Security Assessment

• Evaluation of industrial control systems
• Assessment of vendor access to SCADA environments
• Alignment with IEC 62443

5. Compliance and Governance Support

• Gap analysis against Cybersecurity Code of Practice
• Vendor security policy development
• Audit and documentation support

6. Continuous Monitoring and Advisory

• Monitoring of third-party access and activities
• Early detection of emerging risks
• Strategic cybersecurity advisory

Why Choose Cyberintelsys

Cyberintelsys is a trusted partner for securing third-party ecosystems in critical infrastructure environments like NEWater production plants.

1. Expertise in OT and Supply Chain Security

1. Deep understanding of SCADA and ICS systems
2. Experience in managing third-party cybersecurity risks
3. Tailored methodologies for critical infrastructure

2. Compliance-Focused Approach

1. Alignment with Cybersecurity Act 2018
2. Adherence to CSA Code of Practice for CII
3. Integration of global standards and frameworks

3. Advanced Testing Capabilities

1. Real-world attack simulations targeting supply chains
2. Combination of automated and manual testing
3. Focus on IT-OT convergence security

4. CREST-Accredited Assurance

Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognized security testing services for organizations across multiple sectors.

5. Actionable and Practical Insights

1. Clear and prioritized remediation strategies
2. Business-focused risk analysis
3. Continuous improvement support

Contact Us

Third-party cybersecurity risks are one of the most critical challenges for NEWater production plants in today’s interconnected environment. Addressing these risks through structured Vulnerability Assessment and Penetration Testing is essential for compliance and operational resilience.

Connect with Cyberintelsys to secure your third-party ecosystem, ensure compliance with the Cybersecurity Code of Practice for CII, and protect your NEWater production plants from evolving cyber threats.