Cybersecurity is an important responsibility for organisations that manage sensitive information or operate systems supporting Singapore’s national interests. As digital infrastructure becomes increasingly interconnected, a cybersecurity incident affecting one organisation can create consequences beyond its immediate business operations.
Singapore’s Cybersecurity Act 2018 provides a regulatory framework for protecting important computer systems and addressing cybersecurity risks. Following the Cybersecurity (Amendment) Act 2024, the framework expanded beyond Critical Information Infrastructure (CII) to include additional categories of regulated systems and entities.
One of these categories is the Entity of Special Cybersecurity Interest (ESCI).
Under Part 3C of the Cybersecurity Act, the Commissioner of Cybersecurity may designate an organisation as an ESCI if it meets the applicable statutory criteria. This includes organisations that store sensitive information or use computer systems to perform functions whose disruption could have a significant detrimental effect on Singapore’s defence, foreign relations, economy, public health, public safety, or public order.
But what happens after an organisation receives an ESCI designation?
Designation creates specific regulatory responsibilities. The organisation may need to furnish cybersecurity information, respond to regulatory directions, establish threat detection mechanisms, report prescribed cybersecurity incidents, and maintain appropriate security controls.
Understanding these responsibilities is essential for organisations seeking to protect sensitive information, strengthen cybersecurity governance, and meet their obligations under Singapore’s Cybersecurity Act.
Understanding ESCI Designation Under Singapore’s Cybersecurity Act
Section 18 of the Cybersecurity Act 2018 establishes the legal framework for designating an Entity of Special Cybersecurity Interest.
The Commissioner may designate an organisation through a written notice when the statutory requirements are satisfied.
An organisation may qualify when:
It stores sensitive information in a computer or computer system under its control.
It uses a computer or computer system to perform a function that could significantly affect Singapore’s defence, foreign relations, economy, public health, public safety, or public order if disrupted.
It is incorporated or established under written law.
The legislation defines sensitive information based on the significant detrimental effect its disclosure could have on Singapore’s specified national interests.
An ESCI designation does not automatically apply to every organisation handling confidential information. The statutory conditions and the Commissioner’s formal designation decision determine whether an organisation falls within this category.
1. Receiving the Official ESCI Designation Notice
The first important step occurs when the organisation receives a written designation notice from the Commissioner of Cybersecurity.
Under Section 18(2), the notice must provide specific information about the designation.
This includes:
Organisation identification: Details identifying the organisation designated as an ESCI.
System identification: A description of the computer or computer system, or class of systems, associated with the designation.
Regulatory responsibilities: Information about the organisation’s duties and responsibilities under the Cybersecurity Act.
Supervisory officer: The name and contact particulars of the officer assigned to supervise the organisation’s cybersecurity arrangements.
Representations: Information about making representations against the designation, with a specified deadline that must not be earlier than 14 days after the notice.
Appeal procedure: Information explaining the organisation’s right to appeal to the Minister and the applicable procedure.
The designation takes effect for five years unless the Commissioner withdraws it earlier. The designation may also be extended for another five-year period under Section 18C if the statutory criteria continue to be met.
Organisations should review the notice carefully, identify the designated systems, and establish internal responsibilities for managing the regulatory requirements.
2. Reviewing Cybersecurity Responsibilities and Regulatory Obligations
After designation, the organisation should review its cybersecurity governance and determine how the ESCI requirements apply to its systems and operations.
This includes identifying the systems covered by the designation, assigning internal responsibilities, and ensuring that relevant technical and management teams understand their obligations.
Important activities include:
Reviewing existing cybersecurity policies and procedures.
Identifying sensitive information stored and processed by designated systems.
Evaluating existing security controls and access permissions.
Reviewing network architecture and system dependencies.
Establishing responsibilities for regulatory communication.
Maintaining appropriate cybersecurity documentation.
The organisation should also review applicable CSA codes of practice, standards, regulations, and directions to identify any additional requirements relevant to its designation.
3. Providing Cybersecurity Information to the Commissioner
Section 18D gives the Commissioner authority to require an ESCI to furnish information about its system of special cybersecurity interest.
The organisation may be required to provide information relating to:
System design and architecture.
Technical configurations and security settings.
Existing cybersecurity safeguards.
Information needed to determine the system’s cybersecurity level.
Organisations should maintain accurate system inventories, architecture diagrams, configuration records, and security documentation to support these requirements.
Failure to comply without reasonable excuse with a valid information notice can result in penalties under Section 18D. The statutory maximum fine is the greater of S$200,000 or 10% of the annual turnover of the person’s business in Singapore, with an additional fine of up to S$5,000 for every day or part of a day a continuing offence persists after conviction.
4. Complying with Cybersecurity Directions
Under Section 18E, the Commissioner may issue written directions to an ESCI when considered necessary or expedient to ensure the cybersecurity of its system or for the effective administration of the Act.
Directions may relate to:
Actions required to address identified cybersecurity threats.
Compliance with prescribed technical or other cybersecurity standards.
Compliance with applicable codes of practice or standards of performance.
Appointment of an approved auditor to assess compliance.
Other measures considered necessary or expedient to protect the designated system.
Organisations should establish a process for receiving, reviewing, assigning, implementing, and documenting regulatory directions.
These directions are legally significant and should be managed through appropriate internal governance and accountability arrangements.
5. Establishing Cybersecurity Threat Detection Mechanisms
An ESCI must establish mechanisms and processes for detecting cybersecurity threats and incidents affecting its system of special cybersecurity interest, as specified in any applicable code of practice.
This requirement is important because early threat detection can reduce the impact of cyberattacks and help organisations respond before security incidents escalate.
Security monitoring activities may include:
Monitoring network traffic for suspicious activities.
Reviewing system logs and security events.
Implementing endpoint detection and protection mechanisms.
Monitoring privileged accounts and unauthorised access attempts.
Establishing security alerts and incident escalation procedures.
Reviewing unusual activities affecting sensitive information.
Organisations should ensure that their monitoring arrangements are appropriate for their systems, risk exposure, and applicable regulatory requirements.
6. Reporting Prescribed Cybersecurity Incidents
Incident reporting is one of the important responsibilities following ESCI designation.
Under Section 18F, an ESCI must notify the Commissioner of prescribed cybersecurity incidents affecting its system of special cybersecurity interest or another computer or computer system under its control, where the statutory impact conditions are satisfied.
The Cybersecurity (Entities of Special Cybersecurity Interest) Regulations 2026, which commenced on 30 October 2026, prescribe the following reporting requirements.
ESCI cybersecurity incident reporting timeline
Within 24 hours – Initial notification
Notify the Commissioner after becoming aware of a prescribed incident. The initial notification includes the affected system, nature of the incident, relevant data impact, observed effects, and reporting contact details.
Within 72 hours – Supplementary information
Provide available updates, incident causes, impact on the designated system, and remedial measures taken.
Within 30 days – Final incident report
Submit a final report containing the initial and supplementary information, including further updates to the fullest extent practicable.
Prescribed incidents include:
Unauthorised hacking to gain access to or control of the designated system.
Installation or execution of malicious unauthorised software or computer code.
Man-in-the-middle attacks, session hijacking, or other unauthorised interception of communications.
Denial-of-service attacks or other unauthorised activities affecting system availability or operability.
The 24-hour initial notification is followed by supplementary and final reporting requirements. Organisations should prepare incident response procedures that support these timelines.
7. Maintaining Cybersecurity Compliance and Documentation
ESCI designation is not a one-time administrative exercise. Organisations should maintain appropriate cybersecurity controls and documentation throughout the designation period.
Important activities include:
Maintaining updated asset inventories and system architecture documentation.
Reviewing vulnerability management and remediation records.
Documenting security assessments and penetration testing activities.
Maintaining incident response and recovery procedures.
Reviewing access management and authentication controls.
Recording regulatory communications and implemented directions.
Monitoring third-party access and relevant system dependencies.
These activities help organisations demonstrate appropriate cybersecurity governance and respond effectively to regulatory requirements.
8. Designation Review, Extension, and Withdrawal
- An ESCI designation initially remains effective for five years under Section 18(3).
- However, the designation does not necessarily remain in force for the entire period.
- Extension: Under Section 18C, the Commissioner may extend the designation for another five years if the entity continues to fulfil the statutory criteria.
- Withdrawal: Under Section 18B, the Commissioner may withdraw the designation by written notice if the entity no longer fulfils the designation criteria.
- Organisations should therefore monitor changes in their operations, systems, and risk environment while maintaining appropriate cybersecurity arrangements throughout the designation period.
Our Methodology for ESCI Cybersecurity Assessment
Cyberintelsys follows a risk-based assessment methodology to help organisations identify cybersecurity weaknesses, evaluate existing controls, and improve the security of systems handling sensitive information.
1. Scope and Asset Identification
- Identify designated systems, applications, servers, databases, network infrastructure, cloud environments, and third-party connections.
2. Cybersecurity Risk Assessment
- Evaluate potential threats, security weaknesses, access risks, and the possible impact of system compromise.
3. Vulnerability Assessment
- Identify outdated software, insecure configurations, exposed services, weak authentication mechanisms, and other vulnerabilities across in-scope systems.
4. Penetration Testing
- Conduct authorised and controlled security testing to determine whether identified vulnerabilities can be exploited to gain unauthorised access or compromise sensitive information.
5. Security Configuration and Access Review
- Evaluate system hardening, privileged accounts, authentication mechanisms, access permissions, and relevant cloud security configurations.
6. Incident Response and Security Review
- Review monitoring capabilities, logging, incident escalation, response procedures, and reporting readiness against applicable ESCI requirements.
7. Remediation and Retesting
- Provide a detailed report containing identified weaknesses, risk ratings, supporting evidence, and practical remediation recommendations. Retesting can validate whether corrective actions have addressed the findings.
Cyberintelsys Services for ESCI Security
Cyberintelsys supports organisations seeking to strengthen cybersecurity controls and improve their readiness for applicable regulatory requirements.
Vulnerability Assessment: Identifies security weaknesses across servers, networks, applications, and infrastructure, with prioritised remediation recommendations.
Penetration Testing: Evaluates the exploitability of vulnerabilities through controlled and authorised security testing.
Network Penetration Testing: Examines network exposure, firewall configurations, segmentation, and potential attack paths.
Web Application Penetration Testing: Identifies application vulnerabilities, authentication weaknesses, access control issues, and potential data exposure.
Cloud Security Assessment: Evaluates AWS, Microsoft Azure, and Google Cloud environments for misconfigurations, excessive permissions, and security weaknesses.
Mobile Application Testing: Assesses Android and iOS applications for vulnerabilities affecting sensitive information and application security.
Cybersecurity Gap Assessment: Reviews existing security practices against applicable regulatory requirements and recognised frameworks.
Additional credentials include:
- Cyberintelsys holds a CSP Licence issued by the Cyber Security Agency of Singapore (CSA) for providing penetration testing services in Singapore, within the scope of its licence.
Cyberintelsys is a CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT), delivering industry-recognised security testing services across multiple sectors.
ISO/IEC 27001:2022 – UKAS-Accredited Certification: Certified for Information Security Management Systems through Bureau Veritas under UKAS accreditation.
ISO/IEC 27001:2022 – SAC-Accredited Certification: Certified through Bureau Veritas under Singapore Accreditation Council accreditation.
Why Choose Cyberintelsys?
Organisations designated as ESCIs need a structured cybersecurity approach that addresses technical vulnerabilities, regulatory responsibilities, and operational risks.
Cyberintelsys focuses on:
Risk-based cybersecurity assessments.
CREST-accredited penetration testing and vulnerability assessment.
Practical security recommendations supported by technical findings.
Assessment coverage across networks, applications, cloud platforms, and mobile environments.
Support for security improvement and regulatory readiness.
The assessment approach can be tailored to the organisation’s technology environment, designated systems, and cybersecurity objectives.
Contact Cyberintelsys
Receiving an ESCI designation introduces important cybersecurity responsibilities under Singapore’s Cybersecurity Act. Organisations must understand their regulatory obligations, strengthen threat detection capabilities, maintain appropriate security documentation, and report prescribed incidents within the applicable timelines.
Cyberintelsys helps organisations identify vulnerabilities, assess security controls, and develop practical remediation strategies to strengthen their cybersecurity posture.
Contact Cyberintelsys to discuss your ESCI cybersecurity assessment requirements and take proactive steps towards stronger security and regulatory readiness under Singapore’s Cybersecurity Act.
