Singapore’s Cybersecurity Act 2018 establishes a legal framework to protect important computer systems, sensitive information, and digital infrastructure that could affect national interests if compromised. Under the Cybersecurity (Amendment) Act 2024, which took effect on 31 October 2025, the Cyber Security Agency of Singapore (CSA) gained additional powers to regulate Entities of Special Cybersecurity Interest (ESCI).

An ESCI is an entity designated under Section 18 of the Cybersecurity Act because it meets specific criteria relating to sensitive information or functions that are important to Singapore’s national interests. This designation extends cybersecurity oversight beyond the traditional Critical Information Infrastructure (CII) framework.

The purpose is to help protect entities whose computer systems may store information or perform functions where a cybersecurity incident could have significant consequences for Singapore’s defence, foreign relations, economy, public health, public safety, or public order.

For organizations, understanding the ESCI designation process is important because designation introduces specific legal responsibilities. Organizations can prepare by identifying sensitive information, assessing system dependencies, reviewing cybersecurity controls, and maintaining appropriate security documentation.

Cyberintelsys supports organizations through cybersecurity assessments, vulnerability assessment and penetration testing (VAPT), risk reviews, and compliance gap assessments that can help strengthen security readiness.

What Is an Entity of Special Cybersecurity Interest?

• An Entity of Special Cybersecurity Interest is an entity that has been formally designated by the Commissioner of Cybersecurity under Section 18(1) of Singapore’s Cybersecurity Act 2018.
• The designation focuses on entities whose information or computer-supported functions could have significant implications for Singapore’s national interests.
• Unlike CII designation, which focuses on computer systems necessary for the continuous delivery of essential services, ESCI designation focuses on the entity’s sensitive information or the importance of functions performed using systems under its control.
• The framework is intended to address cybersecurity risks associated with entities that may not necessarily be designated CII owners but nevertheless hold sensitive information or perform nationally significant functions.
• Designation is not automatic. The Commissioner must be satisfied that the statutory criteria are met, and the entity must receive a formal written designation notice. 

The Legal Criteria CSA Uses to Determine ESCI Eligibility

Section 18(1) establishes the principal criteria for designation. CSA must be satisfied that the entity meets the requirements concerning both its systems and its legal status.

1. Storage of Sensitive Information

The first criterion concerns whether an entity stores sensitive information in a computer, computer system, or class of computer systems under its control.

For the purposes of Section 18, sensitive information is information whose disclosure would have a significant detrimental effect on Singapore’s:

• Defence.

• Foreign relations.

• Economy.

• Public health.

• Public safety.

• Public order.

The assessment is therefore concerned with the potential national consequences of disclosure, rather than simply whether information is confidential, commercially valuable, or subject to ordinary data-protection requirements.

Potential areas for review may include sensitive government-related information, information relevant to national security, and other information whose exposure could have significant consequences for Singapore’s interests. Whether specific information qualifies depends on the statutory definition and the circumstances.

Organizations should identify where sensitive information is stored, which systems process it, who can access it, and how it is protected against unauthorized disclosure.

2. Performance of a Function of National Importance

• The second criterion concerns whether the entity uses a computer or computer system under its control to perform a function that, if disrupted, would have a significant detrimental effect on one or more of the national interests listed in Section 18.
• The relevant interests include defence, foreign relations, the economy, public health, public safety, and public order.
• This criterion focuses on the potential consequences of disruption. It is not enough that an organization uses important technology or provides a commercially significant service; the statutory test concerns the significant detrimental effect that disruption of the function could have on Singapore.
• Examples of functions that may warrant examination include activities supporting essential public services, nationally significant operations, or functions whose interruption could affect public safety or economic stability. These are illustrative examples, not automatic grounds for designation.
• Organizations should evaluate the purpose of their systems, their dependencies, the consequences of downtime, and the wider effects that a cyber incident could produce.

3. Incorporation or Establishment Under Written Law

• Section 18(1)(b) also requires the entity to be incorporated or established under written law.
• This is a separate statutory requirement. An entity does not meet the ESCI criteria solely because it stores sensitive information or performs an important function if it does not meet the applicable legal-status requirement.
• The organization’s incorporation or establishment status must therefore be considered alongside the nature of its information and computer-supported functions.
• Meeting the criteria does not itself mean that an organization has already been designated. The Commissioner must make the statutory determination and issue the required written notice.

How CSA Determines Whether an Entity Meets the Criteria

1. Identifying Entities That May Meet the Criteria

• The designation process can begin when the Commissioner has reason to believe that an entity may fulfil the ESCI criteria.
• At this stage, the key question is whether there is a sufficient basis to examine the entity’s information, systems, or functions against Section 18.
• Being in a sensitive industry does not, by itself, establish ESCI status. The relevant statutory criteria must be considered in relation to the particular entity.

2. Requesting Information From the Entity

Under Section 18A, the Commissioner may issue a notice requiring an entity to provide relevant information within a reasonable period specified in the notice.

The information requested may include:

• The extent to which the entity stores sensitive information in systems under its control.

• The extent to which its computer systems perform functions whose disruption could significantly affect Singapore’s national interests.

• Information about the design of the systems used for those purposes.

• Other relevant information needed to determine whether the designation criteria are fulfilled.

The Cybersecurity (Entities of Special Cybersecurity Interest) Regulations 2026, which came into operation on 30 October 2026, specify that the relevant information request must be given in writing using the form provided for that purpose on the CSA website.

Organizations receiving such a notice should identify the responsible stakeholders, understand the requested scope, collect accurate information, and respond within the stated period.

Section 18A also recognizes that certain information may be subject to legal rights, privileges, immunities, or restrictions on disclosure. Organizations should obtain appropriate legal advice when such issues arise.

3. Evaluating the Potential National Impact

• The Commissioner considers the information obtained to determine whether the entity meets the criteria in Section 18(1).
• The central considerations are whether the entity stores qualifying sensitive information or performs a qualifying function, whether the relevant systems are under its control, and whether the legal-status criterion is met.
• Cybersecurity architecture, system dependencies, the potential consequences of data disclosure, and the effects of service disruption may be relevant to understanding the circumstances.
• However, the Act does not establish a publicly stated numerical risk score or a universal industry checklist that automatically determines ESCI designation. The statutory criteria and the circumstances of the particular entity govern the determination.

4. Issuing the Formal Designation Notice

If the Commissioner is satisfied that the statutory criteria are met, the Commissioner may designate the entity through a written notice.

Under Section 18(2), the notice must:

• Identify the entity being designated.

• Describe the computer system or class of systems associated with the designation.

• Inform the entity of its duties and responsibilities under the Act.

• Provide the name and contact details of the officer assigned to supervise the entity’s cybersecurity.

• Specify the date by which representations against the designation may be made, which must be no earlier than 14 days after the notice date.

• Inform the entity of its right to appeal to the Minister and explain the applicable procedure.

The designation notice is therefore important for identifying the systems in scope and understanding the entity’s specific regulatory responsibilities. The Act also provides that the notice need not be published in the Government Gazette. 

What Happens After an Entity Is Designated?

An ESCI designation creates ongoing responsibilities under Part 3C of the Cybersecurity Act, subject to the applicable provisions and directions.

1. Providing System Information

• Under Section 18D, the Commissioner may require information about the design, configuration, and security of the system of special cybersecurity interest.
• Organizations should maintain reliable system inventories, architecture diagrams, configuration records, and security documentation to support applicable information requests.

2. Complying With Applicable Cybersecurity Requirements

• ESCI entities may be required to comply with applicable codes of practice, standards of performance, and written directions concerning their designated systems.
• Security controls should be reviewed against the requirements that apply to the entity and its designated systems.

3. Reporting Prescribed Cybersecurity Incidents

• Section 18F establishes incident-reporting obligations for prescribed cybersecurity incidents affecting the relevant systems or other computer systems under the entity’s control, where the specified conditions are met.
• These conditions include incidents that result in a breach of the availability, confidentiality, or integrity of the entity’s data, or have a significant impact on its business operations.
• ESCI entities must also establish the mechanisms and processes required under applicable codes of practice to detect cybersecurity threats and incidents.

4. Maintaining Cybersecurity Readiness

• Organizations should establish clear accountability for cybersecurity, maintain incident-response procedures, assess vulnerabilities, and document corrective actions.
• A formal designation lasts five years unless withdrawn earlier. The Commissioner may extend the designation for another five-year period if the criteria continue to be met, and may withdraw it if the entity no longer fulfils the criteria. 

Our Risk-Based Methodology 

Cyberintelsys follows a risk-based approach to help organizations evaluate their cybersecurity posture and prepare for relevant regulatory expectations. These services support readiness but do not determine ESCI eligibility on behalf of CSA.

1. Information and System Identification

• Identify systems that store sensitive information or support important organizational functions. Document system ownership, data flows, access privileges, and dependencies.

2. Cybersecurity Risk Assessment

• Evaluate potential threats, vulnerabilities, the likelihood of compromise, and the possible consequences of data disclosure or system disruption.

3. Vulnerability Assessment

• Identify known vulnerabilities, insecure configurations, outdated software, and exposed services across the agreed scope.

4. Penetration Testing

• Where authorized and appropriate, test selected weaknesses to evaluate their exploitability and potential impact. Testing should be carefully scoped to avoid unnecessary disruption.

5. Compliance Gap Assessment

• Review existing policies, procedures, and technical controls against applicable requirements and identify areas requiring improvement.

6. Reporting and Remediation

• Document findings, prioritize risks, recommend corrective actions, and support follow-up validation where required.

Cyberintelsys Cybersecurity Services

Cyberintelsys supports organizations seeking to improve security controls and prepare for relevant cybersecurity obligations.

• Vulnerability Assessment: Identifies technical weaknesses across in-scope systems, applications, and network infrastructure.

• Penetration Testing: Evaluates the exploitability of selected vulnerabilities through authorized security testing.

• Cybersecurity Risk Assessment: Reviews threats, vulnerabilities, and potential impacts to help prioritize risk treatment.

• IT and OT Security Assessment: Examines enterprise systems and operational environments, including network segmentation, access management, and critical system dependencies.

• Compliance Gap Assessment: Compares existing controls with applicable requirements and identifies areas for improvement.

• Remediation and Retesting: Helps verify whether corrective actions address previously identified weaknesses.

Certifications and Accreditations

• Cyberintelsys holds a CSP Licence issued by the Cyber Security Agency of Singapore (CSA) for providing penetration testing services in Singapore, within the scope of its licence.
• Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognized security testing services for organizations across multiple sectors.
• Cyberintelsys also holds ISO/IEC 27001:2022 Information Security Management System certifications through Bureau Veritas under UKAS and Singapore Accreditation Council (SAC) accreditation, respectively, within the relevant certification scopes.

Why Choose Cyberintelsys?

Organizations preparing for cybersecurity regulation need a clear understanding of their technical exposure, security controls, and remediation priorities.

Cyberintelsys emphasizes structured assessments, practical recommendations, and risk-based reporting to help organizations strengthen their security posture.

Key benefits include:

• Risk-focused assessment: Prioritizes weaknesses according to potential impact and exposure.

• Technical security expertise: Evaluates vulnerabilities across in-scope IT and OT environments.

• Compliance support: Helps identify control gaps and prepare supporting security documentation.

• Actionable reporting: Provides recommendations to guide remediation and improve resilience.

• Ongoing improvement: Supports follow-up assessments to help validate security improvements.

The scope of any engagement should reflect the organization’s systems, risk profile, and applicable regulatory responsibilities.

Contact Cyberintelsys

Understanding how CSA determines ESCI eligibility can help organizations evaluate their exposure, prepare accurate system information, and strengthen cybersecurity governance.

Organizations should review the statutory criteria, maintain appropriate technical documentation, and seek professional legal advice when determining how the Act applies to their circumstances.

Contact Cyberintelsys to discuss vulnerability assessment, penetration testing, cybersecurity risk assessment, IT/OT security reviews, and compliance gap assessment support. Strengthen your cybersecurity posture, address technical weaknesses, and improve readiness for applicable regulatory requirements.