Introduction
Singapore’s Cybersecurity Code of Practice plays a vital role in protecting Critical Information Infrastructure (CII), supporting national security, economic stability, and the delivery of essential services. Sectors such as energy, water, banking and finance, healthcare, transport, infocomm, and telecommunications depend on interconnected digital systems to maintain secure and uninterrupted operations.
As these systems become increasingly connected, cyber threats can have consequences beyond individual organizations. A successful attack against critical infrastructure could disrupt essential services, compromise sensitive information, affect operational continuity, and create wider risks for the country.
To address these challenges, Singapore has established cybersecurity requirements under the Cybersecurity Act 2018 and the Cybersecurity Code of Practice (CCoP) issued by the Cyber Security Agency of Singapore (CSA).
The Code establishes minimum cybersecurity requirements for organizations designated as CII owners. It addresses important areas such as cybersecurity governance, risk management, asset protection, access control, vulnerability management, penetration testing, security monitoring, and incident response.
An important development is the updated Cybersecurity Code of Practice for Critical Information Infrastructure 2026, issued on 29 July 2026. The updated Code strengthens accountability at Board and senior management levels, expands cybersecurity oversight to interconnected systems, and introduces stronger requirements for threat detection, cyber resilience, and security exercises.
For CII owners, understanding these requirements is essential for maintaining regulatory compliance and protecting critical infrastructure against evolving cyber threats.
This article explains the key requirements of Singapore’s Cybersecurity Code of Practice and how Vulnerability Assessment and Penetration Testing can support CII security objectives.
Understanding Singapore’s Cybersecurity Code of Practice
The Cybersecurity Code of Practice is issued by the Commissioner of Cybersecurity under the Cybersecurity Act 2018. It specifies the minimum cybersecurity measures that designated CII owners must implement to protect their critical information infrastructure.
The 2026 edition replaces the previous edition and reflects changes in the cybersecurity threat landscape, including Advanced Persistent Threats (APTs), AI-enabled attacks, and risks arising from interconnected enterprise environments.
One significant change is the broader emphasis on protecting systems that connect to or communicate with designated CII. These interconnected systems can become entry points for attackers seeking to compromise critical infrastructure.
The Code must be considered alongside the applicable provisions of the Cybersecurity Act, relevant regulatory directions, and other requirements issued by CSA.
Key Requirements of Singapore’s Cybersecurity Code of Practice for CII Owners
1. Cybersecurity Governance and Board-Level Accountability
The updated Code places greater responsibility on the Board and senior management for overseeing organizational cybersecurity and resilience.
Cybersecurity must be treated as an organization-wide responsibility rather than an activity managed exclusively by IT or security teams.
CII owners are expected to:
Establish clear cybersecurity responsibilities across the organization.
Ensure the Board oversees cybersecurity risks and provides strategic direction.
Maintain a documented cyber resilience framework.
Allocate appropriate cybersecurity budgets and resources.
Establish management reporting and escalation procedures.
Review cybersecurity risks and the effectiveness of security measures.
The documented cyber resilience framework should address four important areas:
Risk Tolerance: Defining the organization’s cybersecurity risk appetite and acceptable exposure.
Risk Mitigation: Establishing appropriate controls, cybersecurity investments, and risk reduction strategies.
Risk Transfer: Evaluating risk transfer arrangements, including relevant cyber insurance.
Risk Recovery: Establishing business continuity and disaster recovery strategies to restore essential services following cyber incidents.
This governance approach helps ensure that cybersecurity decisions are supported by senior leadership and aligned with business and operational priorities.
2. Cybersecurity Risk Assessment and Management
CII owners must establish a structured approach to identifying, evaluating, and managing cybersecurity risks affecting critical infrastructure.
Risk assessments should consider potential threats, system vulnerabilities, existing security controls, operational dependencies, and the consequences of successful attacks.
Important activities include:
Identifying critical IT and OT assets.
Evaluating potential cyber threats and attack scenarios.
Identifying vulnerabilities across infrastructure and connected systems.
Assessing the effectiveness of existing security controls.
Evaluating the likelihood and impact of potential incidents.
Prioritizing risks based on operational criticality.
Developing remediation and risk treatment plans.
Organizations should also consider risks arising from cloud environments, third-party connections, remote access, and interconnected enterprise networks.
CSA provides supplementary guidance for conducting cybersecurity risk assessments and threat modelling to help CII owners identify and manage relevant security risks.
3. Asset Management and Interconnected System Visibility
Maintaining accurate visibility of infrastructure is essential for effective cybersecurity management.
The updated Code extends specific mandatory cybersecurity requirements to interconnected systems owned, operated, or controlled by CII owners, even when those systems are not independently designated as CII.
Organizations should maintain comprehensive asset inventories covering:
Hardware, software, servers, and network devices.
Critical system functions and asset ownership.
Internal and external network connections.
Cloud services and outsourced infrastructure.
Third-party service provider dependencies.
Internet-facing systems and external connectivity.
Personnel responsible for cybersecurity management.
CII owners should also maintain accurate network topology diagrams that identify interconnected systems, network segments, and communication interfaces.
This wider visibility helps organizations identify weaknesses in supporting infrastructure that could otherwise provide attackers with pathways into critical systems.
4. Access Control and Privileged Account Management
Access control is necessary to prevent unauthorized users from accessing critical systems, sensitive information, and administrative interfaces.
CII owners must implement appropriate access management practices to ensure that permissions are assigned according to business responsibilities and security requirements.
Important controls include:
Implementing role-based access control and least-privilege principles.
Maintaining individual user accounts instead of shared accounts.
Applying multi-factor authentication where required.
Restricting privileged administrative access.
Reviewing user and service accounts regularly.
Disabling inactive or unnecessary accounts.
Monitoring privileged account activities.
The updated Code also introduces specific requirements for privileged accounts on interconnected systems, including multi-factor authentication, restrictions on shared privileged accounts, and logging and reviewing emergency access through break-glass accounts.
5. Network Security and Segmentation
Network segmentation helps prevent attackers from moving freely between different infrastructure environments.
CII owners should establish security boundaries between critical systems, enterprise networks, external connections, and other interconnected infrastructure.
Key security measures include:
Separating networks according to their security requirements.
Implementing firewalls at appropriate network boundaries.
Restricting unauthorized communication between network segments.
Monitoring external and outbound network connections.
Securing remote access mechanisms.
Maintaining appropriate network security configurations.
For OT environments, network separation is particularly important because unauthorized access to industrial control networks could affect physical processes and essential service delivery.
6. System Hardening and Patch Management
Insecure configurations and unpatched software can create opportunities for attackers to compromise critical infrastructure.
The Code requires CII owners to establish processes for maintaining secure system configurations and addressing security vulnerabilities.
System hardening activities should include:
Disabling unnecessary ports, services, and protocols.
Removing unused applications and components.
Applying secure configuration standards.
Restricting unnecessary administrative privileges.
Protecting sensitive system configurations.
Reviewing security settings following infrastructure changes.
Patch management should ensure that security updates are assessed, tested, and applied in a timely manner. Where immediate patching is not feasible, appropriate compensating controls should be implemented to reduce exposure.
These measures are particularly important for interconnected systems, where outdated or poorly configured supporting infrastructure could become an entry point into CII networks.
7. Vulnerability Assessment and Penetration Testing
Vulnerability Assessment (VA) and Penetration Testing (PT) are essential activities for identifying weaknesses and evaluating the effectiveness of cybersecurity controls.
The 2026 Code establishes specific testing requirements for designated CII systems.
Vulnerability Assessment requirements:
IT CII must undergo vulnerability assessment at least once every 12 months.
OT CII must undergo vulnerability assessment at least once every 24 months.
Relevant CII assets must also be assessed following major system changes.
Identified vulnerabilities must be tracked and remediated in a timely manner, prioritizing those posing greater security or operational risks.
Penetration Testing requirements:
IT CII must undergo penetration testing at least once every 12 months.
OT CII must undergo penetration testing at least once every 24 months.
Relevant assets must be tested following major system changes, including new system commissioning, application module implementation, upgrades, and technology refreshes.
The Code also specifically addresses the qualifications of external testing providers:
Third-party penetration testing companies must possess industry-recognized accreditation, such as CREST or equivalent.
Individual penetration testers must hold recognized certifications demonstrating their technical knowledge and practical skills.
Testing must be conducted under the supervision of the CII owner.
Activities must remain within the approved scope and must not disrupt CII operations.
These requirements make it important to select a technically competent and appropriately accredited penetration testing provider.
8. Security Monitoring and Threat Detection
CII owners must establish effective monitoring and detection capabilities to identify malicious activities, suspicious behaviour, and potential cybersecurity incidents.
The updated Code places greater emphasis on improving visibility across CII networks and interconnected systems.
Important activities include:
Maintaining appropriate system and security logs.
Monitoring network traffic and system activities.
Detecting unusual authentication and access patterns.
Monitoring endpoint and infrastructure security events.
Establishing alerting and investigation procedures.
Conducting threat hunting to identify suspicious activities that may have bypassed existing security controls.
Reviewing monitoring mechanisms regularly.
CSA has also highlighted the importance of deploying threat detection capabilities across network segments to improve visibility and identify malicious activities.
9. Incident Response, Business Continuity and Recovery
CII owners must establish incident response and recovery arrangements to minimize the impact of cybersecurity incidents on essential services.
An effective incident management approach should cover:
Incident identification and classification.
Reporting and escalation procedures.
Containment and investigation activities.
Communication with relevant stakeholders.
Evidence preservation and root-cause analysis.
Recovery of affected systems and services.
Post-incident reviews and corrective actions.
Organizations should also maintain Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP) to support the restoration of essential services.
These plans must be reviewed regularly, with appropriate backup and restoration procedures to ensure that critical information and systems can be recovered when required.
10. Cybersecurity Exercises, OT Security and Employee Training
The Code emphasizes the importance of validating cybersecurity readiness through practical exercises and maintaining appropriate protection for operational environments.
Cybersecurity exercises: CII owners must establish a comprehensive exercise plan and conduct scenario-based cybersecurity exercises at least once every 12 months. These exercises should involve relevant technical teams, senior management, crisis management personnel, and other stakeholders. Personnel responsible for CII cybersecurity must also participate in technical exercises organized by CSA or its designated partners at least annually.
OT security: Organizations operating industrial environments must protect SCADA, DCS, PLCs, and other industrial control components. Security measures should address network architecture, secure communications, field controller protection, and prevention of unauthorized modifications.
Employee training: CII owners must maintain cybersecurity awareness programmes and ensure personnel responsible for operating or managing critical systems have appropriate knowledge and technical skills.
These activities help improve organizational preparedness and reduce the possibility of security incidents caused by technical weaknesses or human error.
Important Compliance Timelines Under the 2026 Code
CII owners should pay particular attention to the transition arrangements introduced under the updated Code.
29 July 2026: The 2026 Cybersecurity Code of Practice came into effect and superseded the previous edition.
29 July 2027: Existing CII owners must meet the new requirements specifically identified for this compliance date, including specified governance, asset management, interconnected system, monitoring, and cybersecurity exercise provisions.
31 December 2027: Existing CII owners must attain Cyber Trust Mark Advocate (Tier 5) certification or an equivalent certification.
The Code also establishes a 24-month certification requirement for newly designated CII owners, subject to the applicable provisions.
During the transition period, existing CII owners must continue meeting the previous Code’s requirements until the applicable compliance dates for the new provisions.
Organizations should review the official compliance timeline carefully because different requirements have different implementation deadlines.
Our Methodology for Supporting CII Cybersecurity Requirements
Meeting cybersecurity requirements requires more than identifying vulnerabilities. Organizations must understand their infrastructure, validate security controls, and establish practical remediation measures.
Cyberintelsys follows a structured assessment methodology to help CII owners identify security weaknesses and improve their cybersecurity posture.
1. Scope Definition and Infrastructure Understanding
The engagement begins with understanding the organization’s IT and OT environments, critical assets, network architecture, system dependencies, and security objectives.
2. Vulnerability Identification
Security assessments identify vulnerabilities, outdated software, insecure configurations, exposed services, and weaknesses in authentication and access management.
3. Controlled Penetration Testing
Validated vulnerabilities are examined through authorized attack simulations to determine whether attackers could gain unauthorized access, escalate privileges, or compromise interconnected systems.
4. Security Control Evaluation
The assessment examines network segmentation, firewall configurations, remote access, privileged accounts, and existing security mechanisms.
5. Risk Analysis and Reporting
Findings are documented with supporting technical evidence, risk classifications, potential business impact, and practical remediation recommendations.
6. Remediation Validation
Following corrective actions, retesting helps verify whether identified vulnerabilities have been successfully addressed.
Cyberintelsys Services for CII Cybersecurity
Cyberintelsys delivers cybersecurity assessment and testing services to help organizations identify infrastructure weaknesses and strengthen security controls.
Relevant services include:
1. Vulnerability Assessment
Identifies security weaknesses across IT infrastructure, OT environments, networks, servers, applications, and connected systems. Findings are prioritized according to severity and potential operational impact.
2. Penetration Testing
Simulates controlled cyberattacks to identify exploitable vulnerabilities and evaluate potential attack paths. This helps organizations understand whether security weaknesses could allow unauthorized access or compromise critical infrastructure.
3. OT Security Assessment
Evaluates the cybersecurity posture of industrial control environments, including SCADA, DCS, PLCs, and interconnected OT networks.
The assessment focuses on network architecture, access restrictions, remote connectivity, system configurations, and operational security risks.
4. Network Security Assessment
Examines network architecture, firewall configurations, segmentation controls, communication pathways, and access restrictions to identify potential security gaps.
5. Web Application and API Penetration Testing
Evaluates customer-facing applications, administrative portals, and APIs for authentication weaknesses, authorization issues, insecure configurations, and vulnerabilities that could expose sensitive information.
6. Security Retesting
Validates whether identified vulnerabilities have been successfully remediated and whether implemented security controls are functioning effectively.
Why Choose Cyberintelsys?
Selecting a qualified cybersecurity partner is essential for CII owners seeking to strengthen security and address applicable regulatory requirements.
Cyberintelsys brings professional security testing capabilities supported by recognized industry credentials and certifications.
Cybersecurity Service Provider (CSP) Licence – Singapore: Licensed to provide cybersecurity services in Singapore, including penetration testing, as applicable to the scope of the licence.
CREST Accreditation: Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognized security testing services for organizations across multiple sectors.
ISO/IEC 27001:2022 – UKAS-Accredited Certification: Certified for Information Security Management Systems (ISMS) through Bureau Veritas under UKAS accreditation.
ISO/IEC 27001:2022 – SAC-Accredited Certification: Certified through Bureau Veritas under Singapore Accreditation Council (SAC) accreditation.
With a structured testing approach, technical expertise, and actionable reporting, Cyberintelsys helps organizations identify security weaknesses, understand their exposure, and improve infrastructure resilience.
Contact Cyberintelsys
Singapore’s Cybersecurity Code of Practice establishes important requirements for organizations responsible for Critical Information Infrastructure. Meeting these requirements involves continuous risk assessment, vulnerability management, penetration testing, effective monitoring, and operational resilience.
CII owners should proactively evaluate their security posture, identify infrastructure weaknesses, and address vulnerabilities before they become opportunities for cyber attackers.
Looking to strengthen your CII cybersecurity posture and meet Singapore’s Cybersecurity Code of Practice requirements?
Contact Cyberintelsys to discuss your cybersecurity requirements and explore professional Vulnerability Assessment, Penetration Testing, and OT Security Assessment services.
