Introduction
Singapore’s cybersecurity regulatory framework continues to evolve as organisations become increasingly dependent on digital systems, sensitive information and interconnected technology. While Critical Information Infrastructure (CII) receives significant attention because it supports essential services, other organisations may also hold information or perform functions that are important to Singapore’s national interests.
To address these risks, Singapore introduced the category of Entities of Special Cybersecurity Interest (ESCIs) through amendments to the Cybersecurity Act 2018. This framework gives the Commissioner of Cybersecurity the authority to designate certain entities for additional cybersecurity oversight when their systems store sensitive information or support functions whose disruption could have significant consequences for Singapore.
The ESCI framework is important because cybersecurity risks are not limited to organisations operating in traditional essential service sectors. An organisation may not own a designated CII system but could still be a significant target because of the information it holds or the role it performs.
Understanding ESCI designation, its criteria and the responsibilities that follow is therefore important for organisations that manage sensitive information or operate systems connected to Singapore’s national interests.
What Is an Entity of Special Cybersecurity Interest (ESCI)?
An Entity of Special Cybersecurity Interest is an organisation formally designated by Singapore’s Commissioner of Cybersecurity under Section 18 of the Cybersecurity Act 2018.
The designation focuses on entities whose computer systems could present particular cybersecurity concerns because they either:
Store sensitive information; or
Perform functions that could have a significant detrimental effect on Singapore if disrupted.
The framework is designed to strengthen cybersecurity oversight of entities that may be attractive targets for malicious cyber actors. A successful attack against such an organisation could affect areas such as national defence, foreign relations, the economy, public health, public safety or public order.
An ESCI designation applies to an identified entity and the computer or computer systems described in its designation notice. It is not simply an industry-wide classification or a voluntary cybersecurity certification.
The Commissioner must issue a written notice to the organisation. The notice identifies the entity, describes the relevant systems, explains the responsibilities arising from the designation and provides information about representations and appeal procedures.
What Are the Criteria for ESCI Designation?
Under Section 18(1) of Singapore’s Cybersecurity Act 2018, the Commissioner of Cybersecurity may designate an entity as an Entity of Special Cybersecurity Interest (ESCI) if it meets either of the following two substantive criteria and is incorporated or established under any written law.
1. The entity stores sensitive information
An entity may qualify for ESCI designation if it stores sensitive information in a computer or computer system, or a class of computers or computer systems, under its control.
Under the Act, sensitive information refers to information whose disclosure would have a significant detrimental effect on Singapore’s defence, foreign relations, economy, public health, public safety or public order.
2. The entity performs a function important to Singapore’s national interests
An entity may also qualify if it uses a computer or computer system, or a class of computers or computer systems, under its control to perform a function that, if disrupted, would have a significant detrimental effect on Singapore’s:
Defence
Foreign relations
Economy
Public health
Public safety
Public order
This criterion recognises that the disruption of certain systems could affect important national interests, even where the entity does not store sensitive information.
Additional statutory condition: The entity must be incorporated or established under written law
In addition to meeting either of the two substantive criteria above, the entity must be incorporated or established under any written law to be designated as an ESCI under Section 18(1) of the Cybersecurity Act.
The Commissioner assesses whether the statutory criteria are fulfilled before issuing a written designation notice to the entity.
How Does the ESCI Designation Process Work?
The designation process is led by the Commissioner of Cybersecurity under the Cybersecurity Act.
1. Information Gathering
Before making a designation, the Commissioner may have reason to believe that an organisation meets the ESCI criteria.
Under Section 18A, the Commissioner can issue a written notice requiring the organisation to provide relevant information to determine whether the statutory criteria are fulfilled.
This information may include:
The type and extent of sensitive information stored.
The computer systems used to store that information.
The functions performed by the organisation’s systems.
The potential consequences if those functions are disrupted.
Relevant details about system design and architecture.
Organisations receiving such notices should review the request carefully and provide the required information within the specified reasonable period.
2. Formal Designation
If the Commissioner is satisfied that the criteria are met, the organisation may be designated through a written notice under Section 18.
The notice must identify the organisation and relevant computer systems, explain the responsibilities arising from designation and provide details about the supervising officer.
It must also explain how the organisation can make representations against the designation and appeal to the Minister.
3. Designation Period
An ESCI designation generally remains effective for five years, unless withdrawn earlier by the Commissioner.
The designation may be extended for another five-year period if the Commissioner considers that the organisation continues to meet the relevant criteria. It may also be withdrawn if the organisation no longer fulfils the designation requirements.
What Are the Cybersecurity Obligations of ESCIs?
Once designated, an ESCI becomes subject to specific cybersecurity responsibilities under Part 3C of the Cybersecurity Act.
These requirements are intended to improve CSA’s visibility into cybersecurity risks and ensure that designated organisations maintain appropriate safeguards.
1. Furnishing Information About Relevant Systems
Under Section 18D, the Commissioner may require an ESCI to provide information about the design, configuration and security of its system of special cybersecurity interest. The Commissioner may also request other information necessary to assess the cybersecurity level of the designated system.
2. Complying With Written Directions
Under Section 18E, the Commissioner has the authority to issue written directions where considered necessary or expedient to ensure the cybersecurity of a system of special cybersecurity interest.
An ESCI should be prepared to respond to applicable directions and take the required actions within the specified timelines.
3. Cybersecurity Incident Reporting
Section 18F requires ESCIs to notify the Commissioner of prescribed cybersecurity incidents affecting their system of special cybersecurity interest or another computer system under their control, where the incident:
Breaches the availability, confidentiality or integrity of the entity’s data; or
Has a significant impact on the entity’s business operations.
The Cybersecurity (Entities of Special Cybersecurity Interest) Regulations 2026 came into operation on 30 October 2026. They prescribe reportable incidents, including unauthorised hacking, malicious software, man-in-the-middle attacks, session hijacking and denial-of-service attacks.
Under Regulation 4, ESCIs must follow these reporting timelines:
Initial notification – Within 24 hours: Notify the Commissioner after becoming aware of a prescribed incident, providing details of the affected system, incident, impact and reporting individual.
Supplementary notification – Within 72 hours: Submit further information in writing, including the incident’s cause, impact, updates and remedial measures.
Final incident report – Within 30 days: Submit a written report within 30 days after the supplementary notification, including the information and updates available.
Initial notification must generally be made by telephone using the number specified by the Commissioner. If this is not possible within a reasonable time, the prescribed alternatives are text message or written submission using the specified contact details and format.
ESCIs should maintain effective incident detection and escalation procedures to support timely reporting and response.
4. Establishing Detection Mechanisms
Section 18F also requires ESCIs to establish mechanisms and processes for detecting cybersecurity threats and incidents in respect of their system of special cybersecurity interest, as set out in any applicable code of practice.
This makes security monitoring, incident detection and response planning important parts of an ESCI’s cybersecurity arrangements.
Organisations should establish processes that allow suspicious activity to be identified, investigated and escalated promptly.
5. Meeting Applicable Codes and Standards
ESCIs must also pay attention to applicable codes of practice, standards of performance and written directions issued by the Commissioner.
These requirements help establish expectations for protecting designated systems and managing cybersecurity risks.
The precise obligations should be determined by reviewing the applicable legislation, regulations, codes and directions relevant to the particular designation.
Why Is Cybersecurity Risk Management Important for ESCIs?
ESCIs may hold information or support functions that are attractive targets for cybercriminals, sophisticated threat actors and other malicious parties.
A successful cyberattack could lead to unauthorised disclosure, operational disruption, data manipulation or loss of access to important systems.
A structured cybersecurity risk management programme helps organisations address these risks before they develop into serious incidents.
Important activities include:
Asset inventory: Identify systems, applications, databases and infrastructure that store sensitive information or support important functions.
Access control reviews: Ensure that access permissions are appropriate and privileged accounts are adequately protected.
Vulnerability management: Identify and remediate weaknesses in applications, operating systems, network devices and infrastructure.
Security monitoring: Detect suspicious activities, unauthorised access and potential compromises.
Incident response planning: Establish procedures for investigation, escalation, containment, reporting and recovery.
Third-party risk management: Review the cybersecurity practices of suppliers and service providers that have access to relevant systems.
Regular security testing: Evaluate the effectiveness of security controls through authorised technical assessments.
These activities should be supported by clear accountability, documented procedures and appropriate management oversight.
Our Structured Cybersecurity Assessment Methodology
At Cyberintelsys, a structured cybersecurity assessment approach helps organisations identify security weaknesses, understand potential attack scenarios and strengthen their security controls.
Our methodology includes the following stages:
Scoping and Planning: Understand the organisation’s environment, identify relevant systems and applications, and establish clear assessment objectives and boundaries.
Information Gathering: Review network architecture, infrastructure, applications, access arrangements and technology dependencies.
Vulnerability Identification: Conduct systematic testing to identify weaknesses, misconfigurations and potential security gaps.
Security Validation: Where authorised and within the agreed scope, validate identified vulnerabilities to understand their exploitability and potential impact.
Risk Analysis: Evaluate findings based on severity, exploitability, affected assets and possible operational consequences.
Reporting: Provide a detailed report containing identified vulnerabilities, supporting evidence, risk ratings and practical remediation recommendations.
Remediation Support and Retesting: Help organisations understand remediation priorities and validate whether addressed vulnerabilities have been resolved.
Assessment activities should be tailored to the sensitivity and operational requirements of the environment. Testing must be authorised and carefully scoped to avoid unnecessary disruption.
Cyberintelsys Services for ESCI Cybersecurity
Cyberintelsys helps organisations identify security weaknesses and improve their cybersecurity posture through specialised assessment and testing services.
Relevant services include:
Vulnerability Assessment: Identifies security weaknesses across networks, servers, applications and infrastructure, helping organisations prioritise remediation.
Penetration Testing: Simulates authorised cyberattacks to determine whether vulnerabilities can be exploited and understand their potential impact.
Network Penetration Testing: Evaluates internal and external network security, including access controls, segmentation and potential attack paths.
Web Application Security Testing: Identifies weaknesses in application authentication, access control, data protection and application logic.
Mobile Application Security Testing: Evaluates mobile applications for security weaknesses involving data storage, authentication, communication and application behaviour.
Red Teaming: Simulates realistic adversary techniques to assess an organisation’s ability to prevent, detect and respond to cyber threats.
Security Assessment and Advisory: Provides technical findings and recommendations to help organisations improve security controls and strengthen cyber resilience.
Certification and Accreditation
Cyberintelsys holds a Cybersecurity Service Provider (CSP) Licence in Singapore for licensed cybersecurity services within the applicable licence scope. The company is also CREST-accredited for Vulnerability Assessment (VA) and Penetration Testing (PT).
In addition, Cyberintelsys holds ISO/IEC 27001:2022 Information Security Management System (ISMS) certification through Bureau Veritas under UKAS accreditation and separate certification through Bureau Veritas under Singapore Accreditation Council (SAC) accreditation.
These credentials demonstrate relevant service licensing, technical accreditation and information security management certification. They do not guarantee that an organisation will meet all ESCI regulatory obligations.
Why Choose Cyberintelsys?
Organisations handling sensitive information or performing important functions need a clear understanding of their cybersecurity exposure.
Cyberintelsys combines structured security assessment processes with technical testing capabilities to help organisations identify vulnerabilities and make informed security decisions.
Organisations can benefit from:
Relevant credentials: CSP licensing within the applicable Singapore scope and CREST accreditation for VA and PT.
Structured testing methodology: A systematic approach to identifying, validating and documenting security weaknesses.
Technical assessment capabilities: Testing designed to uncover vulnerabilities and potential attack paths.
Actionable reporting: Clear findings, risk explanations and practical remediation recommendations.
Security improvement support: Technical insights that help organisations strengthen their controls and improve cyber resilience.
Conclusion
Entities of Special Cybersecurity Interest form an important part of Singapore’s expanded cybersecurity regulatory framework. Through the Cybersecurity Act, the Commissioner can designate organisations that hold sensitive information or perform functions whose disruption could significantly affect Singapore’s national interests.
Following designation, ESCIs have responsibilities relating to system information, cybersecurity directions, incident reporting and threat detection. The Cybersecurity (Entities of Special Cybersecurity Interest) Regulations 2026, which took effect on further specify incident reporting requirements.
Organisations should understand their potential cybersecurity exposure, maintain appropriate security controls and ensure that incident detection and response processes are effective.
Cyberintelsys supports organisations through vulnerability assessments, penetration testing, red teaming and other cybersecurity services to help identify weaknesses and strengthen security resilience.
Contact Cyberintelsys to discuss your cybersecurity assessment requirements and take practical steps towards protecting sensitive information and important digital systems.
