Organizations in Singapore increasingly depend on Information Technology (IT) and Operational Technology (OT) systems to deliver essential services, manage business operations, and maintain infrastructure reliability. While IT systems support applications, databases, business communication, and information processing, OT systems control and monitor physical processes in industrial and critical environments.

The growing integration of IT and OT has created new cybersecurity risks. Ransomware, unauthorized remote access, insecure network connections, outdated software, and compromised third-party systems can affect both information security and operational continuity.

Singapore’s Cybersecurity Act 2018 establishes a legal framework for protecting Critical Information Infrastructure (CII), managing cybersecurity threats, and regulating specified cybersecurity service providers. The legislation expressly includes OT systems such as Industrial Control Systems (ICS), Programmable Logic Controllers (PLCs), Supervisory Control and Data Acquisition (SCADA) systems, and Distributed Control Systems (DCS) within the definition of computer systems.

For organizations operating critical infrastructure, security assessments help identify vulnerabilities, evaluate cyber risks, and improve security controls. However, the Act’s specific CII obligations depend on the applicable designation and regulatory requirements; operating an IT or OT system does not automatically make every organization subject to all CII-owner obligations.

Cyberintelsys supports organizations through vulnerability assessments, penetration testing, IT/OT security reviews, and compliance gap assessments designed to strengthen cybersecurity and support applicable regulatory requirements.

Understanding the Cybersecurity Act 2018 and Its Scope

The Cybersecurity Act 2018 provides the legal foundation for cybersecurity oversight in Singapore. The Cyber Security Agency of Singapore (CSA) administers the framework and oversees designated systems and other regulated entities within the Act’s scope.

The legislation identifies CII across essential service sectors, including:

• Energy and electricity infrastructure.

• Water supply and treatment.

• Banking and financial services.

• Healthcare services.

• Land, maritime, and aviation transport.

• Infocomm and media.

• Security and emergency services.

• Government services.

Within these environments, IT systems may support business applications, identity management, enterprise networks, and data storage. OT systems may operate industrial machinery, monitor physical processes, manage facility automation, or control infrastructure.

The Cybersecurity (Amendment) Act 2024 introduced expanded regulatory provisions that took effect from 31 October 2025, including changes concerning virtual systems, incident reporting, and additional categories of regulated entities. Organizations should therefore assess their obligations against the current legislation, applicable regulations, designation notices, and CSA guidance. 

Regulatory Requirements for IT and OT Security Assessments

1. Cybersecurity Risk Assessment

• Section 15 of the Act requires owners of provider-owned CII to conduct cybersecurity risk assessments at least annually, subject to the applicable statutory requirements.
• The assessment must identify cybersecurity risks as far as reasonably practicable, evaluate their likelihood and potential consequences, and identify actions to address each risk. The prescribed reporting requirements also cover the assessment methodology, identified risks, evaluations, and planned actions.
• The first assessment must generally be completed within six months of the relevant designation notice, unless a longer period is allowed by the Commissioner.
• For IT systems, the assessment may examine vulnerabilities in servers, endpoints, applications, databases, identity systems, and network infrastructure. For OT systems, it may examine control-system architecture, engineering workstations, industrial protocols, remote maintenance connections, and dependencies affecting production or essential services. 

2. Periodic Cybersecurity Audits

• Applicable CII owners must undergo cybersecurity audits at least once every two years, or more frequently when directed by the Commissioner, in accordance with Section 15 and the applicable requirements.
• These audits evaluate compliance with relevant provisions of the Act, prescribed cybersecurity standards, and applicable CSA codes of practice and standards of performance.
• A general vulnerability assessment or penetration test is not automatically a substitute for the required statutory audit. Organizations must ensure that the formal audit is conducted by an auditor approved or appointed as required by the Commissioner.

3. Vulnerability Assessment and Penetration Testing

• Vulnerability assessment and penetration testing can help organizations evaluate the technical security of their IT and OT environments.
• A vulnerability assessment identifies known weaknesses, insecure configurations, outdated components, and exposed services. Penetration testing evaluates whether selected weaknesses can be exploited within an authorized scope.
• Testing activities should reflect the sensitivity of the environment. Production OT systems may require passive discovery, configuration reviews, offline testing, or carefully controlled validation to avoid disrupting essential processes.
• These services can support a broader cybersecurity programme, but their scope should be distinguished from the specific requirements of a statutory CII audit.

4. Incident Reporting and Response

• The Act establishes cybersecurity incident reporting obligations for designated and other regulated systems, according to the applicable provisions.
• Certain incidents affecting CII must be reported to CSA within two hours of awareness, with additional reporting requirements depending on the incident category. The amendments effective from 31 October 2025 expanded reporting obligations to cover specified additional incidents, including certain incidents involving advanced persistent threats and disruptions affecting non-interconnected systems under a CII owner’s control. 
• Organizations should maintain documented incident-response procedures, clear escalation responsibilities, evidence-preservation practices, and reporting workflows.

5. Compliance with Applicable CSA Codes of Practice

• CII owners must follow the applicable statutory requirements and relevant cybersecurity codes of practice and standards of performance.
• CSA published the Cybersecurity Code of Practice for Critical Information Infrastructure 2026 on 29 July 2026. Organizations should review the current edition and determine which requirements apply to their designated systems. 
• A compliance gap assessment can help compare existing security controls with relevant requirements and identify corrective actions.

Importance of IT and OT Security Assessments

IT and OT security assessments are essential for understanding how cyber threats could affect business operations, sensitive information, and critical infrastructure.

IT environments often face risks associated with phishing, ransomware, insecure applications, excessive privileges, and data exposure. OT environments introduce additional concerns because cyber incidents may affect physical equipment, industrial processes, product quality, or service availability.

Key areas requiring security assessment include:

• Asset identification: Maintaining an accurate inventory of servers, endpoints, PLCs, SCADA components, HMIs, engineering workstations, and connected devices.

• Network segmentation: Evaluating separation between corporate IT, industrial OT, production networks, and external connections.

• Access management: Reviewing privileged accounts, authentication mechanisms, vendor access, and remote maintenance arrangements.

• Vulnerability management: Identifying outdated software, unsupported systems, insecure configurations, and known vulnerabilities.

• Industrial communication security: Examining industrial protocols, exposed services, and unnecessary connectivity between systems.

• Monitoring and incident response: Evaluating logging, threat detection, alert handling, and incident escalation.

• Backup and recovery: Assessing backup security, recovery procedures, and the ability to restore critical operations.

• Third-party risk: Reviewing supplier connections, outsourced services, and dependencies that could introduce cyber exposure.

Without appropriate controls, attackers may use a compromised IT endpoint to reach connected OT environments, disrupt industrial processes, or gain unauthorized access to sensitive operational information.

A structured assessment helps organizations prioritize remediation according to business impact, technical exposure, and operational criticality. It also supports management decisions about cybersecurity investment, risk acceptance, and long-term resilience.

Our IT and OT Security Assessment Methodology

Cyberintelsys follows a risk-based methodology that considers system criticality, business requirements, operational constraints, and applicable security requirements. Assessment activities are tailored to the agreed scope and the characteristics of each environment.

1. Scope Definition and Asset Discovery

• The assessment begins by establishing the scope, identifying critical assets, and understanding the organization’s IT and OT architecture.
• Activities may include reviewing network diagrams, asset inventories, system dependencies, communication paths, and external connections.
• Relevant assets may include enterprise servers, cloud-connected applications, firewalls, PLCs, SCADA servers, HMIs, DCS components, and remote-access gateways.

2. IT and OT Architecture Assessment

• Network architecture is reviewed to identify unnecessary connectivity, insecure trust relationships, exposed services, and potential attack paths.
• The assessment examines the separation between enterprise IT and operational networks, remote-access arrangements, industrial communication pathways, and access to critical control systems.
• Recommendations may include stronger segmentation, controlled access points, improved monitoring, and more secure remote connectivity.

3. Cybersecurity Risk and Control Assessment

• Potential threats and vulnerabilities are evaluated against the criticality of affected assets and the consequences of a successful attack.
• Existing safeguards, access controls, security configurations, monitoring capabilities, and incident-response procedures are reviewed.
• Where relevant, findings are mapped to applicable regulatory requirements and organizational security policies.

4. Vulnerability Assessment

• Authorized assessment activities identify vulnerabilities across in-scope systems, applications, devices, and networks.
• The approach may include vulnerability scanning, configuration analysis, software-version checks, and manual verification.
• For sensitive OT systems, the assessment is planned to minimize operational impact and avoid unapproved disruptive testing.

5. Penetration Testing

• Where appropriate and explicitly authorized, penetration testing evaluates the exploitability of selected weaknesses and the potential consequences of unauthorized access.
• Testing methods are agreed in advance, with suitable safeguards for production environments. Intrusive testing may be restricted or replaced with safer validation methods where availability or safety could be affected.

6. Reporting and Remediation

• Findings are documented with risk ratings, supporting evidence, potential impacts, and practical remediation recommendations.
• Organizations can use the results to assign corrective actions, establish implementation timelines, improve security controls, and track residual risks.
• Follow-up testing may help verify whether important weaknesses have been resolved.

Cyberintelsys Security Assessment Services

Cyberintelsys provides cybersecurity assessment services that help organizations identify technical weaknesses and strengthen IT and OT security.

• IT Vulnerability Assessment: Identifies vulnerabilities in networks, servers, endpoints, databases, applications, and other in-scope enterprise systems. Findings help organizations prioritize patching, configuration changes, and access-control improvements.

• OT Security Assessment: Examines industrial control environments, including SCADA, PLCs, HMIs, DCS components, engineering workstations, and industrial network architecture. The assessment considers operational continuity and safety constraints.

• Penetration Testing: Evaluates whether security weaknesses can be exploited through authorized testing. Scope and testing techniques are selected according to system sensitivity and agreed objectives.

• IT/OT Network Security Assessment: Reviews network segmentation, firewall configurations, remote access, industrial communication pathways, and connectivity between enterprise and operational environments.

• Cybersecurity Risk Assessment: Identifies relevant threats, evaluates potential impacts, and prioritizes risk treatment measures to support informed security decisions.

• Compliance Gap Assessment: Compares existing security controls and documentation against applicable regulatory requirements and organizational policies. This supports compliance preparation but does not replace a required statutory audit.

• Remediation and Retesting: Helps organizations validate corrective actions, reassess previously identified vulnerabilities, and evaluate remaining security risks.

Certifications and Accreditations

• Cyberintelsys holds a Cybersecurity Service Provider (CSP) licence issued under Singapore’s Cybersecurity Act for penetration testing services, within the applicable scope of its licence.
• Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognized security testing services for organizations across multiple sectors.
• Cyberintelsys also holds ISO/IEC 27001:2022 Information Security Management System certifications through Bureau Veritas under UKAS and Singapore Accreditation Council (SAC) accreditation, respectively, within the relevant certification scopes.

For regulated cybersecurity services in Singapore, including penetration testing, organizations should verify that the provider holds the applicable Cybersecurity Service Provider licence and that the service falls within its authorized scope.

Why Choose Cyberintelsys?

Organizations need a security assessment partner that understands the differences between enterprise IT risks and the operational constraints of industrial environments.

Cyberintelsys emphasizes structured assessment, practical technical findings, and risk-based remediation guidance to help organizations improve their security posture.

Key benefits include:

• Risk-based assessments: Prioritize weaknesses according to their potential impact and exploitability.

• IT and OT coverage: Evaluate enterprise technology and industrial environments within the agreed assessment scope.

• Operational awareness: Consider availability, safety, and continuity when selecting assessment methods.

• Actionable reporting: Provide clear findings and remediation recommendations to support security improvement.

• Compliance support: Help organizations review applicable controls and prepare evidence for relevant compliance activities.

The assessment approach can be adapted to the organization’s technology landscape, risk profile, and regulatory responsibilities.

Contact Cyberintelsys

The security of IT and OT systems is essential to protecting business information, maintaining operational continuity, and supporting Singapore’s cybersecurity objectives.

Organizations should regularly review their technology environments, identify vulnerabilities, evaluate cyber risks, and verify that applicable regulatory obligations are addressed.

Contact Cyberintelsys to discuss IT vulnerability assessment, OT security assessment, penetration testing, cybersecurity risk assessment, and compliance gap assessment services. Strengthen your security controls, reduce exposure to cyber threats, and improve resilience across your IT and operational technology environments.