Introduction
Cloud computing has transformed how organisations operate, manage information and deliver essential digital services. Businesses increasingly depend on cloud platforms for data storage, application hosting, infrastructure management and business-critical operations. For organisations responsible for Singapore’s Critical Information Infrastructure (CII), cloud adoption also introduces important cybersecurity and regulatory considerations.
Critical Information Infrastructure supports essential services across sectors such as banking, healthcare, energy, telecommunications, transport and water. A cybersecurity incident affecting these systems could disrupt essential services, expose sensitive information and affect the wider economy.
As CII owners explore cloud-based infrastructure, protecting these environments requires more than relying on the security measures implemented by a Cloud Service Provider (CSP). Organisations must understand their responsibilities, evaluate cloud-related risks and ensure that appropriate security controls are implemented throughout the cloud environment.
Singapore’s Cybersecurity Code of Practice (CCoP) 2026 and the developing regulatory requirements for cloud services highlight the importance of securing critical systems hosted on cloud platforms.
This article explores the key cybersecurity considerations for cloud-hosted CII systems, the regulatory landscape in Singapore and how organisations can strengthen their cloud security posture.
Singapore’s Regulatory Landscape for Cloud-Hosted CII Systems
Singapore’s Cyber Security Agency (CSA) oversees the cybersecurity requirements applicable to designated CII owners under the Cybersecurity Act 2018.
The regulatory approach recognises that moving critical systems to cloud infrastructure does not remove the responsibility of CII owners to protect those systems.
1. Cybersecurity Code of Practice for CII 2026
The Cybersecurity Code of Practice for Critical Information Infrastructure 2026 establishes minimum cybersecurity requirements for CII owners.
The updated Code places emphasis on:
Strengthening board and senior management accountability for cybersecurity.
Maintaining visibility over interconnected systems.
Improving threat detection and monitoring capabilities.
Establishing documented cyber resilience frameworks.
Strengthening cybersecurity exercises and incident preparedness.
Improving network architecture management and security oversight.
These requirements are relevant to cloud-hosted CII environments because critical systems may depend on interconnected cloud infrastructure, external services and third-party technology providers.
2. Cybersecurity Code of Practice for Cloud Services
CSA announced plans in July 2026 to introduce a separate Cybersecurity Code of Practice for Cloud Services, intended to establish cybersecurity requirements governing the secure deployment, operation and management of CII systems hosted on cloud platforms.
CSA also announced collaboration with Amazon Web Services (AWS), Google Cloud and Microsoft Azure to develop provider-specific Companion Guides explaining how the cloud requirements can be implemented using their respective cloud security capabilities.
Important regulatory distinction: The announcement establishes the planned direction of the separate cloud Code. It should not be confused with the existing CCoP 2026 for CII. Organisations should verify the latest official CSA publication and applicable effective dates before treating proposed cloud controls as final mandatory requirements.
3. Existing Cloud Security Obligations
The previous CCoP for CII already addressed cloud adoption. It required CII owners to conduct a cybersecurity risk assessment before implementing CII on cloud computing systems, formally accept the completed assessment and submit it to the Commissioner for review within 30 days of completion.
It also addressed the appointment of a Singapore-based representative by the cloud provider for accepting relevant notices or legal processes, where applicable. The CII owner remained responsible for cybersecurity even when outsourcing services to third parties.
These provisions demonstrate that cloud migration must be supported by formal risk evaluation and appropriate governance rather than treated as a routine infrastructure change.
Key Cybersecurity Requirements for Cloud-Hosted CII Systems
Securing cloud-hosted critical infrastructure requires a combination of regulatory compliance, technical safeguards, operational monitoring and effective risk management.
The following areas should form part of a CII owner’s cloud security programme.
1. Cloud Cybersecurity Risk Assessment
Before migrating CII systems to cloud infrastructure, organisations must understand the cybersecurity risks associated with the proposed deployment.
A comprehensive assessment should consider:
Cloud infrastructure architecture and deployment models.
Data sensitivity, classification and storage locations.
Potential vulnerabilities in cloud applications and services.
Risks arising from third-party integrations.
Cloud provider security capabilities and limitations.
Availability, recovery and business continuity requirements.
The assessment should identify whether the proposed cloud environment can adequately address the risks associated with hosting critical systems.
Organisations should also reassess risks whenever significant changes are made to cloud architecture, configurations, services or operational arrangements.
2. Shared Responsibility and Cloud Governance
Cloud security operates through a shared responsibility model. The Cloud Service Provider and the customer have different responsibilities depending on the cloud service model being used.
For example:
Infrastructure as a Service (IaaS): The provider generally manages physical infrastructure and underlying cloud services, while the customer is responsible for securing operating systems, applications, identities and workloads.
Platform as a Service (PaaS): The provider manages more of the underlying infrastructure and platform, while the customer remains responsible for application security, data and access configurations.
Software as a Service (SaaS): The provider manages most of the application infrastructure, while the customer remains responsible for user access, data governance and appropriate security settings.
CII owners should establish clear contractual and operational responsibilities with cloud providers.
Important considerations include:
Defining cybersecurity responsibilities between the organisation and CSP.
Establishing security obligations in service agreements.
Maintaining oversight of outsourced cloud operations.
Evaluating third-party security controls.
Establishing procedures for security incidents and service disruptions.
Ensuring appropriate audit and assurance arrangements.
The use of a third-party cloud provider does not transfer the CII owner’s regulatory accountability.
3. Identity and Access Management (IAM)
Unauthorised access to cloud environments can expose critical systems to data theft, privilege escalation and operational disruption.
Organisations should implement strong Identity and Access Management controls.
These include:
Multi-Factor Authentication (MFA) for privileged and sensitive accounts.
Role-Based Access Control (RBAC).
Least-privilege access policies.
Privileged Access Management (PAM).
Periodic access reviews.
Secure management of service accounts and API credentials.
Monitoring of suspicious login attempts and privileged activities.
Administrative access should be restricted to authorised personnel, with access rights reviewed regularly.
4. Data Protection and Encryption
Cloud-hosted CII systems may process sensitive operational information, confidential business data and critical service records.
Appropriate data protection measures should be implemented throughout the data lifecycle.
Key controls include:
Encryption of sensitive data at rest and in transit.
Secure encryption key management.
Data classification and handling policies.
Restrictions on unauthorised data transfers.
Secure data backup and restoration.
Monitoring of data access and modification activities.
Appropriate data retention and secure disposal procedures.
Organisations should also understand the geographical locations where cloud data is stored and processed and evaluate applicable legal and contractual obligations.
5. Network Security and Segmentation
Cloud infrastructure must be designed to prevent unauthorised access and limit the movement of attackers between connected systems.
Network security controls should include:
Network segmentation between critical and non-critical workloads.
Secure configuration of Virtual Private Clouds (VPCs) and virtual networks.
Firewall rules and network access restrictions.
Intrusion Detection and Prevention Systems (IDS/IPS).
Secure connectivity between cloud and on-premises environments.
Restricted access to management interfaces.
Monitoring of network traffic and communication pathways.
Particular attention should be given to connectivity between cloud-hosted CII systems and Operational Technology (OT) environments.
6. Vulnerability Management and Security Testing
Cloud environments are continuously updated and reconfigured. Misconfigurations, outdated components and insecure application deployments can introduce vulnerabilities.
Organisations should establish a continuous vulnerability management programme.
This should include:
Regular cloud infrastructure vulnerability assessments.
Application and API security testing.
Configuration reviews against secure baselines.
Operating system and software patch management.
Container and workload security assessments, where applicable.
Penetration testing based on approved scope and testing procedures.
Remediation tracking and validation.
Security testing should be coordinated with cloud providers where necessary, particularly when testing shared infrastructure or services with provider-specific restrictions.
7. Continuous Monitoring and Threat Detection
Traditional perimeter-based security is insufficient for complex cloud environments. Organisations need continuous visibility into user activities, workload behaviour and network communications.
Important monitoring capabilities include:
Centralised security logging.
Cloud Security Posture Management (CSPM).
Security Information and Event Management (SIEM).
Endpoint Detection and Response (EDR).
Cloud workload monitoring.
Suspicious account activity detection.
Threat intelligence integration.
Security alert escalation and incident investigation.
Monitoring should cover relevant cloud workloads and interconnected systems to identify suspicious activities before they escalate into major incidents.
8. Incident Response and Disaster Recovery
Cloud-hosted CII systems must be capable of maintaining essential operations and recovering from cybersecurity incidents.
Organisations should develop documented incident response and recovery arrangements covering:
Cloud account compromise.
Ransomware and malware infections.
Unauthorised data access.
Cloud service disruptions.
Data corruption or deletion.
Third-party security incidents.
Loss of access to critical cloud resources.
Regular backup testing, disaster recovery exercises and incident response simulations help organisations evaluate their readiness.
Recovery strategies should establish appropriate Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) based on operational requirements.
Our Methodology for Cloud Security Assessment
Cyberintelsys follows a structured methodology to evaluate cloud-hosted infrastructure, identify security weaknesses and help organisations strengthen their cybersecurity controls.
The assessment is adapted to the cloud service model, infrastructure architecture, criticality of workloads and applicable regulatory requirements.
Step 1: Cloud Infrastructure Discovery
Identify cloud-hosted applications, workloads, servers and databases.
Review cloud architecture and network connectivity.
Identify interconnected systems and external integrations.
Understand data flows and access pathways.
Step 2: Risk and Compliance Assessment
Evaluate cloud-related cybersecurity risks.
Review existing security policies and governance.
Identify gaps against applicable CCoP requirements.
Assess third-party and shared responsibility arrangements.
Step 3: Technical Security Assessment
Perform cloud configuration reviews.
Conduct infrastructure Vulnerability Assessments.
Evaluate identity and access management controls.
Assess network segmentation and application security.
Perform authorised penetration testing within the agreed scope.
Step 4: Security Monitoring Evaluation
Review logging and monitoring capabilities.
Assess threat detection mechanisms.
Evaluate incident identification and escalation procedures.
Identify gaps in security visibility.
Step 5: Reporting and Remediation
Document identified security weaknesses.
Classify findings based on severity and risk.
Provide technical recommendations.
Develop prioritised remediation guidance.
Step 6: Validation and Continuous Improvement
Conduct retesting following remediation.
Validate implemented security controls.
Recommend periodic security assessments.
Support continuous improvement of the organisation’s cloud security posture.
This approach helps organisations understand their security gaps and develop a practical roadmap for protecting cloud-hosted critical infrastructure.
Cyberintelsys Services for Cloud-Hosted CII Security
Cyberintelsys offers cybersecurity services that help organisations evaluate cloud security risks, identify vulnerabilities and strengthen infrastructure protection.
1. Cloud Security Assessment
A comprehensive evaluation of cloud environments to identify security weaknesses and misconfigurations.
Activities include:
Reviewing cloud architecture and configurations.
Assessing identity and access management.
Evaluating data protection mechanisms.
Reviewing network security and cloud connectivity.
Identifying cloud security risks and recommending improvements.
2. Vulnerability Assessment (VA)
Identifies vulnerabilities across cloud-hosted servers, network infrastructure, applications and other technical components.
The assessment helps organisations identify outdated software, insecure configurations, exposed services and weaknesses that could be exploited by attackers.
3. Cloud Penetration Testing
Simulates authorised attacks against cloud-hosted applications, infrastructure and services to evaluate their resistance to exploitation.
Testing can include:
Cloud infrastructure penetration testing.
Web application and API security testing.
Access control and privilege escalation testing.
Authentication and configuration testing.
Validation of potential attack paths.
4. Network Security Assessment
Evaluates cloud network architecture, firewall configurations, network segmentation and connectivity between cloud and on-premises infrastructure.
The objective is to identify potential entry points and minimise unauthorised access to critical systems.
5. Compliance and Security Gap Assessment
Helps organisations evaluate existing security controls against applicable regulatory requirements and recognised cybersecurity frameworks.
This includes reviewing policies, technical controls, risk management practices, incident response arrangements and cloud governance procedures.
6. Security Audit and Remediation Support
Provides structured security findings and recommendations to help organisations address identified weaknesses.
Activities include reviewing security configurations, documenting vulnerabilities, prioritising remediation and validating corrective actions through retesting.
Why Choose Cyberintelsys for Cloud Security?
Choosing an experienced cybersecurity partner is important when protecting cloud-hosted critical infrastructure. Cyberintelsys combines technical expertise, recognised industry credentials and structured security assessment methodologies.
Industry-recognised credentials and certifications include:
CREST Accreditation: Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognised security testing services across multiple sectors.
Cybersecurity Service Provider (CSP) Licence – Singapore: Licensed to provide cybersecurity services in Singapore, including penetration testing, as applicable to the scope of the licence.
ISO/IEC 27001:2022 – UKAS-Accredited Certification: Certified for Information Security Management Systems (ISMS) through Bureau Veritas under UKAS accreditation.
ISO/IEC 27001:2022 – SAC-Accredited Certification: Certified through Bureau Veritas under Singapore Accreditation Council (SAC) accreditation.
Organisations working with Cyberintelsys can benefit from:
Technical security expertise: Comprehensive assessments of cloud infrastructure, applications and network environments.
Risk-focused evaluations: Identification and prioritisation of security weaknesses based on their potential impact.
Actionable recommendations: Detailed technical reports with practical remediation guidance.
Regulatory awareness: Security assessments designed with applicable Singapore cybersecurity requirements in mind.
Continuous security improvement: Support for retesting, vulnerability management and strengthening security controls.
These capabilities help organisations make informed cybersecurity decisions while improving the protection of their critical cloud environments.
Strengthen Your Cloud Security with Cyberintelsys
Cloud adoption offers significant operational benefits, but hosting Critical Information Infrastructure on cloud platforms introduces additional cybersecurity responsibilities.
CII owners must maintain visibility over their cloud environments, understand shared security responsibilities, implement appropriate technical safeguards and ensure that critical systems remain protected against evolving cyber threats.
Singapore’s evolving regulatory landscape reinforces the importance of proactive cloud security management. Preparing through comprehensive risk assessments, vulnerability testing, penetration testing and continuous security monitoring can help organisations establish a stronger foundation for cyber resilience.
Cyberintelsys helps organisations identify cloud security vulnerabilities, evaluate infrastructure risks and strengthen their cybersecurity posture through CREST-accredited Vulnerability Assessment and Penetration Testing services.
Whether your organisation is planning a cloud migration, already operates critical systems on cloud infrastructure or preparing for applicable CCoP requirements, Cyberintelsys can help you assess your security readiness.
Contact Cyberintelsys today to discuss your cloud security assessment requirements and take proactive steps towards protecting your critical information infrastructure.
