Critical Information Infrastructure (CII) plays an essential role in maintaining Singapore’s economic stability, public safety, and delivery of vital services. These systems support sectors such as energy, water, banking and finance, healthcare, transportation, infocomm, media, security and emergency services, and government. A cybersecurity incident affecting these systems could disrupt essential services and have consequences beyond a single organization.

As critical services become increasingly connected through digital platforms, operational technology (OT), cloud environments, enterprise networks, and third-party systems, the potential attack surface continues to expand. Cyber threats such as ransomware, unauthorized access, software vulnerabilities, supply chain compromise, and targeted attacks can affect system availability, data integrity, and operational reliability.

A cybersecurity risk assessment for CII is a structured process used to identify cybersecurity risks, evaluate their likelihood and potential impact, and determine appropriate measures to manage them. In Singapore, CII owners have specific responsibilities under the Cybersecurity Act 2018 and applicable Codes of Practice issued by the Cyber Security Agency of Singapore (CSA).

For organizations responsible for critical systems, risk assessment is not simply a technical exercise. It is an important part of cybersecurity governance, operational resilience, and regulatory compliance.

What Is Critical Information Infrastructure (CII)?

Critical Information Infrastructure refers to computer systems necessary for the continuous delivery of essential services in Singapore. The Cybersecurity Act establishes a framework for identifying and protecting these systems against cyber threats.

The relevant sectors include:

• Energy: Electricity generation, transmission, and other essential energy services.

• Water: Water treatment, distribution, and associated control systems.

• Banking and Finance: Systems supporting critical financial services.

• Healthcare: Infrastructure necessary for essential healthcare delivery.

• Transportation: Land, maritime, and aviation systems supporting transport services.

• Infocomm and Media: Infrastructure essential to communications and media services.

• Security and Emergency Services: Systems supporting public safety and emergency response.

• Government: Systems supporting designated essential government functions.

Not every organization or system operating in these sectors is automatically designated as CII. The relevant designation and statutory obligations depend on the applicable legal framework and decisions of the regulator.

Because CII environments may include both IT and OT components, risk assessments must consider technical vulnerabilities as well as their potential consequences for physical processes and essential services.

Singapore Regulations and Frameworks for CII Risk Assessment

Singapore’s cybersecurity regulatory framework establishes responsibilities for protecting designated CII and managing cybersecurity risks throughout the system lifecycle.

1. Cybersecurity Act 2018

• The Cybersecurity Act 2018 provides the legal foundation for CII protection in Singapore. It establishes obligations relating to cybersecurity risk assessments, audits, incident reporting, and compliance with applicable codes and directions.
• Under the Act, CII owners must conduct cybersecurity risk assessments at least annually, subject to the applicable statutory requirements. The assessment must identify reasonably foreseeable cybersecurity risks, evaluate their likelihood and potential consequences, and identify appropriate actions to address them.

2. Cybersecurity Code of Practice for CII

• CSA issues Codes of Practice that establish cybersecurity requirements for CII owners. The applicable edition and supplementary requirements should be considered when planning an assessment.
• CSA published an updated Cybersecurity Code of Practice for CII on 29 July 2026. The updated requirements strengthen areas such as cybersecurity governance, visibility, threat detection, resilience, and oversight of interconnected systems.

3. CSA Guidance for Cybersecurity Risk Assessment

• CSA provides a dedicated Guide to Conducting Cybersecurity Risk Assessment for CII to help CII owners perform appropriate assessments and understand regulatory expectations.
• Additional resources include guidance on cyber threat modelling and auditing critical information infrastructure. These materials help organizations identify relevant threat scenarios, evaluate risks systematically, and maintain supporting documentation. Organizations should use these resources as applicable to their designated systems and should not assume that a general-purpose risk assessment automatically satisfies every CII-specific obligation.

Importance of Cybersecurity Risk Assessment for CII in Singapore

CII environments support essential services where even a limited cybersecurity incident can create substantial operational consequences. A risk assessment helps organizations understand how weaknesses could affect service delivery and which corrective measures deserve priority.

Core operational systems that may require assessment include:

• Industrial control systems (ICS), distributed control systems (DCS), and supervisory control and data acquisition (SCADA) platforms.

• Programmable logic controllers (PLCs), remote terminal units (RTUs), and human-machine interfaces (HMIs).

• Enterprise servers, databases, identity management systems, and administrative workstations.

• Firewalls, switches, routers, remote access gateways, and interconnected networks.

• Cloud-hosted services, third-party connections, backup infrastructure, and security monitoring platforms.

Weaknesses in these components may create opportunities for unauthorized access, manipulation of operational data, disruption of services, or compromise of interconnected environments.

Key threats considered during a CII cybersecurity risk assessment include:

• Ransomware and other malicious software affecting essential systems.

• Unauthorized access caused by weak credentials or excessive privileges.

• Unpatched vulnerabilities and insecure system configurations.

• Compromise of suppliers, contractors, and remote maintenance connections.

• Network segmentation weaknesses between IT and OT environments.

• Inadequate backup protection, incident detection, and recovery capabilities.

• Threats to the availability, integrity, and reliability of operational processes.

A structured assessment helps organizations identify these risks, evaluate existing controls, and establish a documented remediation plan. It also supports better allocation of security resources and provides evidence for ongoing risk management and applicable regulatory obligations.

Our Methodology: CII Cybersecurity Risk Assessment

Cyberintelsys follows a risk-based assessment approach that considers the operational environment, critical assets, cybersecurity threats, existing safeguards, and business requirements. The methodology is designed to help organizations understand their exposure and prioritize appropriate security improvements.

1. Scope Definition and Asset Identification

The assessment begins by establishing the scope of the CII environment and identifying critical assets and dependencies.

Key activities include:

• Reviewing system architecture, network diagrams, and asset inventories.

• Identifying critical servers, controllers, engineering workstations, and monitoring systems.

• Mapping communication pathways between IT, OT, cloud services, and third-party environments.

• Identifying critical operational processes and their dependencies.

This stage helps establish which assets require protection and how their compromise could affect essential services.

2. Threat Identification and Threat Modelling

• The next stage identifies threats relevant to the CII environment. Threat modelling considers potential attack paths, threat actors, exposed interfaces, and weaknesses that could be exploited.
• The assessment may examine unauthorized remote access, compromised credentials, vulnerable services, malicious software, supplier-related risks, and movement between interconnected systems.
• Threat scenarios should reflect the actual architecture and operational context rather than relying solely on generic threat lists.

3. Vulnerability and Security Control Assessment

• Existing safeguards are reviewed to identify gaps in the organization’s security posture.
• Assessment activities may include configuration reviews, access-control analysis, vulnerability identification, network segmentation reviews, and examination of monitoring and recovery arrangements.
• For OT environments, testing must account for system availability and operational safety. Intrusive testing should only be performed when authorized, technically appropriate, and supported by suitable safeguards.

4. Risk Analysis and Evaluation

• Identified risks are evaluated according to their likelihood and potential consequences.
• The analysis considers factors such as vulnerability severity, exploitability, existing safeguards, potential service disruption, and the effect on safety or operational continuity.
• Risks are then prioritized according to their significance and the organization’s risk tolerance.

5. Risk Treatment and Mitigation Planning

• The assessment identifies suitable actions for managing each risk. These may include patching, configuration changes, stronger authentication, improved network segmentation, enhanced monitoring, or additional operational safeguards.
• For OT systems, non-digital engineering controls should also be considered as mitigating measures where applicable, consistent with the CII Code of Practice. 

6. Reporting, Risk Register, and Continuous Review

• The final stage documents identified risks, existing controls, risk ratings, treatment actions, responsible owners, and remediation progress.
• The CII risk register should be maintained and updated as risks change, corrective actions progress, and new vulnerabilities or threat scenarios emerge.
• This process provides a foundation for ongoing cybersecurity governance rather than treating risk assessment as a one-time activity.

Cyberintelsys Services for CII Security

Cyberintelsys supports organizations seeking to assess cybersecurity weaknesses and strengthen their security controls. Relevant services may include:

• Cybersecurity Risk Assessment: Identifies threats, vulnerabilities, operational dependencies, and potential business impacts to help organizations prioritize risk treatment.

• OT and ICS Security Assessment: Reviews industrial control environments, communication pathways, remote access, and security configurations while considering operational constraints.

• Network Security Assessment: Examines network architecture, segmentation, exposed services, and access controls to identify weaknesses that could enable unauthorized access.

• Vulnerability Assessment: Identifies and prioritizes known vulnerabilities across agreed systems, applications, and infrastructure.

• Penetration Testing: Validates exploitable weaknesses through authorized testing within an agreed scope. Any Singapore engagement involving licensable penetration testing must meet the applicable CSP licensing requirements.

• Cloud Security Assessment: Reviews cloud configurations, identity permissions, exposed resources, and connections to critical systems.

• Remediation Validation: Helps organizations verify whether identified weaknesses have been addressed effectively.

• Security Advisory and Reporting: Provides practical remediation guidance to support security improvement planning and ongoing risk management.

Service scope, applicable credentials, and regulatory authorization should be verified for each engagement. 

Why Choose Cyberintelsys?

Organizations responsible for essential services need cybersecurity assessments that recognize the relationship between technical weaknesses and operational risk.

Cyberintelsys emphasizes structured assessment processes, risk-based recommendations, and clear reporting to help organizations understand and address their security exposure.

Key considerations include:

Cyberintelsys also holds ISO/IEC 27001:2022 information security management certifications through Bureau Veritas under UKAS and Singapore Accreditation Council (SAC) accreditation. Organizations should verify the applicable certificate scope and validity during vendor due diligence.

Contact Cyberintelsys

Cybersecurity risk assessment is an important part of protecting Singapore’s Critical Information Infrastructure. By identifying threats, evaluating potential impacts, documenting risks, and implementing suitable mitigation measures, organizations can strengthen cyber resilience and support their applicable regulatory obligations.

Cyberintelsys helps organizations assess vulnerabilities, evaluate security controls, and develop practical strategies to improve cybersecurity.

Looking to strengthen your CII cybersecurity posture or improve readiness for Singapore’s cybersecurity requirements?

Contact Cyberintelsys to discuss your assessment objectives, critical systems, and security improvement priorities.