Critical Information Infrastructure (CII) supports essential services that Singapore relies on for its economic stability, public safety, and daily operations. Sectors such as energy, water, banking and finance, healthcare, transportation, infocomm, media, government, and emergency services depend on systems that must remain secure, reliable, and available.

As these environments become increasingly connected, cybersecurity risks extend beyond traditional IT networks. Industrial control systems (ICS), operational technology (OT), cloud platforms, remote maintenance connections, third-party suppliers, and enterprise applications can introduce vulnerabilities that affect critical services.

A cybersecurity incident involving a CII system could result in unauthorized access, operational disruption, data manipulation, or interruption of essential services. CII owners therefore need a systematic approach to identifying threats, evaluating potential impacts, and implementing appropriate safeguards.

Singapore’s Cybersecurity Act 2018 establishes the regulatory foundation for protecting designated CII. The Cyber Security Agency of Singapore (CSA) issues Codes of Practice and supplementary guidance to help CII owners manage cybersecurity risks. The Cybersecurity Code of Practice for Critical Information Infrastructure 2026, issued on 29 July 2026, is an important current reference for understanding applicable requirements.

Understanding how risks are identified under this framework helps organizations strengthen security governance, maintain operational resilience, and prioritize remediation activities.

What Is Cybersecurity Risk Identification for CII?

Cybersecurity risk identification is the process of determining which assets need protection, what threats could affect them, which vulnerabilities may be exploited, and how successful attacks could affect essential services.

For CII owners, this process must consider the specific technology environment and the operational consequences of a cyber incident.

Key areas include:

• Critical asset identification: Determining which systems, applications, network devices, and infrastructure support essential services.

• Threat identification: Understanding relevant threat actors, attack methods, malicious activities, and emerging cyber threats.

• Vulnerability discovery: Identifying technical weaknesses, insecure configurations, inadequate access controls, and unsupported components.

• Risk scenario development: Establishing realistic scenarios that explain how a threat could exploit a weakness and affect a critical system.

• Impact assessment: Evaluating possible consequences for service availability, safety, data integrity, and operational continuity.

• Existing control evaluation: Determining whether current security measures adequately reduce the identified risks.

CSA’s guidance recommends a structured process covering risk identification, risk analysis, risk evaluation, and risk response. It also emphasizes maintaining an updated risk register for each CII.

Singapore’s CII Regulatory Requirements for Cybersecurity Risk Identification

CII owners should base their risk assessment process on the Cybersecurity Act 2018, the applicable Cybersecurity Code of Practice, and relevant CSA supplementary guidance.

1. Cybersecurity Act 2018

• The Cybersecurity Act establishes obligations for designated CII owners, including requirements relating to risk assessments, cybersecurity audits, incident reporting, and compliance with applicable regulatory directions and Codes of Practice.
• CII owners should determine which statutory duties apply to their designated systems and maintain the documentation needed to demonstrate compliance.

2. Cybersecurity Code of Practice for CII 2026

• CSA’s updated Code of Practice, issued on 29 July 2026, strengthens requirements concerning cybersecurity governance, visibility, threat detection, resilience, and interconnected systems. CII owners should review the applicable provisions to understand the controls and risk management processes expected for their environments.

3. CSA Risk Assessment and Threat Modelling Guidance

• CSA publishes a Guide to Conducting Cybersecurity Risk Assessment for CII and a Guide to Cyber Threat Modelling. These resources help CII owners identify relevant threat events, construct risk scenarios, and assess potential consequences.
• The guides support a consistent, evidence-based approach to identifying and evaluating cybersecurity risks.

How Do CII Owners Identify Cybersecurity Risks?

1. Identify Critical Assets and System Dependencies

Risk identification begins with an accurate understanding of the CII environment. Organizations need to know which assets support essential services and how those assets depend on connected systems.

Typical assets include:

• SCADA servers, DCS platforms, PLCs, RTUs, and HMIs.

• Engineering workstations, historians, and industrial communication gateways.

• Enterprise servers, identity systems, and administrative endpoints.

• Firewalls, routers, switches, and remote access infrastructure.

• Cloud services, backup systems, and third-party maintenance connections.

Asset inventories should include relevant ownership, system functions, dependencies, and security information. Mapping connections between critical systems and supporting infrastructure helps uncover risks that may otherwise remain hidden.

2. Identify Threats and Potential Attack Paths

• CII owners must consider how threat actors or accidental events could compromise critical assets.
• Threat identification may involve reviewing threat intelligence, examining previous incidents, analysing system architecture, and conducting structured threat modelling.
• Potential threats include ransomware, compromised privileged accounts, malicious insiders, software supply chain attacks, unauthorized remote access, and exploitation of known vulnerabilities.
• CSA’s threat modelling guidance can help organizations systematically identify relevant threat events rather than relying solely on generic cybersecurity checklists.

3. Identify Vulnerabilities and Existing Security Gaps

After identifying relevant threats, organizations should examine weaknesses that could make those threats possible.

This can include:

• Outdated software and unpatched vulnerabilities.

• Weak authentication or excessive user privileges.

• Poor network segmentation between IT and OT systems.

• Insecure remote access and vendor connections.

• Insufficient logging, monitoring, or alerting.

• Inadequate backup protection and recovery arrangements.

• Weak supplier oversight and undocumented system dependencies.

Assessment methods may include configuration reviews, vulnerability assessments, architecture analysis, interviews with system owners, and authorized security testing. For OT environments, assessment techniques must account for operational safety and availability.

4. Develop Realistic Cybersecurity Risk Scenarios

• A risk scenario connects a potential threat to an exposed asset, an exploitable weakness, and a possible consequence.
• For example, an attacker might obtain compromised vendor credentials and use an inadequately protected remote access connection to reach an industrial control environment. If network segmentation and access restrictions are insufficient, the attacker could disrupt monitoring or interfere with an operational process.
• A scenario should describe the affected assets, threat event, relevant weaknesses, existing safeguards, and potential operational consequences.
• This makes the assessment more useful than a list of vulnerabilities because it explains how individual weaknesses could contribute to a larger business or operational risk.

5. Analyse Likelihood and Potential Impact

Once scenarios are documented, CII owners evaluate how likely each event is to occur and how serious its consequences could be.

The analysis should consider threat capability, vulnerability exposure, existing security controls, potential service disruption, and recovery requirements.

Impact assessments may address:

• Availability of essential services.

• Integrity and reliability of operational processes.

• Safety implications where relevant.

• Confidentiality of sensitive information.

• Financial, legal, and reputational consequences.

The assessment should use a consistent risk-rating methodology aligned with the organization’s documented risk tolerance.

6. Evaluate, Prioritize, and Treat Risks

• Risk evaluation determines which identified risks require urgent action, additional controls, management attention, or formal acceptance.
• Possible treatment measures include patching, stronger authentication, network segmentation, improved monitoring, access restrictions, enhanced supplier controls, and tested recovery arrangements.
• For OT-based CII, non-digital engineering controls should also be considered as mitigating controls where applicable, as specified in the relevant Code of Practice.

7. Maintain an Updated CII Risk Register

The risk register provides a documented record of identified cybersecurity risks and the actions taken to manage them.

CSA’s Code of Practice identifies key information that should be recorded, including:

• Risk scenarios and identification dates.

• Existing controls and current risk ratings.

• Risk treatment plans and progress.

• Residual risk ratings.

• Assigned risk owners.

Maintaining this information helps organizations track remediation, monitor changes in exposure, and support management oversight. The register should be reviewed and updated as systems, threats, vulnerabilities, and operational requirements change.

Our Methodology: CII Cybersecurity Risk Assessment

Cyberintelsys follows a risk-based approach to help organizations identify cybersecurity weaknesses and understand their potential impact on critical operations.

1. Scope and Asset Discovery

• The assessment begins by defining the scope and identifying critical IT and OT assets, system dependencies, network connections, and operational requirements.

2. Threat and Vulnerability Assessment

• Relevant threat scenarios are developed, and security weaknesses are evaluated through appropriate reviews and authorized testing activities.

3. Architecture and Access Control Review

• Network segmentation, privileged access, remote maintenance connections, and communications between critical and supporting systems are reviewed to identify potential attack paths.

4. Risk Analysis and Prioritization

• Identified risks are evaluated according to their likelihood, potential consequences, existing safeguards, and operational significance.

5. Remediation Planning

• Practical recommendations are developed to address identified weaknesses, strengthen preventive and detective controls, and improve recovery readiness.

6. Reporting and Validation

• Findings are documented with risk ratings, remediation priorities, and supporting evidence. Follow-up testing can help confirm whether corrective actions have addressed the identified vulnerabilities.
• The methodology can support CII risk management activities, but the assessment scope and deliverables should be mapped to the specific statutory and Code of Practice requirements applicable to each organization.

Cyberintelsys Services for CII Security

Cyberintelsys supports organizations seeking to strengthen their cybersecurity posture through structured security assessments and practical remediation guidance.

• Web Application Penetration Testing: Identify OWASP Top 10 vulnerabilities, authentication weaknesses, and application security risks through structured penetration testing.

• Network Penetration Testing: Assess internal and external networks to identify exploitable vulnerabilities, insecure configurations, and potential attack paths.

• Cloud Security Assessment: Evaluate AWS, Microsoft Azure, and Google Cloud environments to identify misconfigurations, access control weaknesses, and cloud security risks.

• Mobile Application Testing: Assess Android and iOS applications for vulnerabilities involving data storage, authentication, communication, and application security.

• IoT & OT Security Testing: Identify security weaknesses in connected devices, industrial control systems, and operational technology environments while considering operational safety and continuity.

• Wireless Security Assessment: Identify weak encryption, insecure wireless configurations, unauthorized access points, and network access vulnerabilities.

• Red Teaming: Simulate realistic cyberattacks to evaluate security controls, test detection and response capabilities, and identify gaps in organizational defenses.

For Singapore engagements involving licensable penetration testing, organizations should verify the provider’s applicable Cybersecurity Service Provider (CSP) Licence. Industry accreditation does not replace a licence where one is legally required.

Why Choose Cyberintelsys?

Effective CII risk management requires an understanding of technical vulnerabilities, operational dependencies, and business consequences.

Cyberintelsys emphasizes:

• CSA – Licensed Service Provider: Cyberintelsys has secured a Cybersecurity Service Provider (CSP) Licence from Singapore’s Cyber Security Agency (CSA) for providing penetration testing services in Singapore.
• CREST Accreditation: CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognized security testing services for organizations across multiple sectors.

• Risk-Based Assessment: Identifying and prioritizing weaknesses according to their potential impact on critical operations.

• Technical Expertise: Assessing relevant network, application, and infrastructure security risks.

• Practical Reporting: Providing clear findings and remediation recommendations.

• Operational Awareness: Considering availability, reliability, and safety when evaluating OT environments.

• Continuous Improvement: Supporting remediation validation and ongoing security enhancement.

Cyberintelsys also holds ISO/IEC 27001:2022 information security management certifications through Bureau Veritas under UKAS and Singapore Accreditation Council (SAC) accreditation. Organizations should verify the applicable certification scope and validity as part of vendor due diligence.

Contact Cyberintelsys

Identifying cybersecurity risks under Singapore’s CII framework requires a structured process that combines asset visibility, threat modelling, vulnerability identification, risk evaluation, and continuous monitoring.

By documenting risks and implementing appropriate mitigation measures, CII owners can improve cyber resilience, protect essential services, and support their applicable regulatory obligations.

Looking to strengthen your CII security posture or improve readiness for Singapore’s cybersecurity requirements?

Contact Cyberintelsys to discuss your cybersecurity risk assessment objectives and identify practical opportunities to improve your security controls.