Introduction
Singapore has established a comprehensive cybersecurity regulatory framework under the Cybersecurity Act 2018 to protect Critical Information Infrastructure (CII) and strengthen the country’s overall cybersecurity resilience.
One of the key regulatory requirements is the Cybersecurity Code of Practice (CCoP) for Critical Information Infrastructure, issued by the Cyber Security Agency of Singapore (CSA). The Code establishes minimum cybersecurity requirements that designated Critical Information Infrastructure Owners (CIIOs) must implement to protect their systems and networks.
The latest edition, the Cybersecurity Code of Practice for Critical Information Infrastructure 2026, was issued on 29 July 2026. It introduces stronger requirements relating to cybersecurity governance, board-level accountability, interconnected systems, threat detection, and operational resilience.
However, not every organisation operating in Singapore is automatically required to comply with the CII Cybersecurity Code of Practice. The applicability of these requirements depends on whether an organisation owns designated CII and whether specific obligations extend to its interconnected systems.
Understanding who must comply is important for organisations operating in regulated industries, technology environments, and critical infrastructure supply chains.
This article explains who must comply with Singapore’s Cybersecurity Code of Practice, which systems are covered, the responsibilities of CII owners, and how Cyberintelsys can help organisations strengthen their cybersecurity posture and regulatory readiness.
Who Must Comply with Singapore’s Cybersecurity Code of Practice?
The Cybersecurity Code of Practice primarily applies to organisations that have been formally designated as owners of Critical Information Infrastructure under Singapore’s Cybersecurity Act 2018.
These organisations are known as Critical Information Infrastructure Owners (CIIOs).
Under Section 35A of the Cybersecurity Act, designated CII owners must comply with the applicable Cybersecurity Code of Practice and relevant standards of performance issued by the Commissioner of Cybersecurity.
The organisations required to comply include:
- Designated CII Owners: Organisations formally notified by the Commissioner as owners of Critical Information Infrastructure.
- Essential Service Operators: Organisations responsible for computer systems necessary for the continuous delivery of essential services in Singapore, where those systems have been formally designated as CII.
- IT Infrastructure Owners: Organisations responsible for designated IT systems and infrastructure supporting essential services.
- OT Infrastructure Owners: Organisations responsible for designated Operational Technology systems supporting critical industrial and operational processes.
- Organisations with Interconnected Systems: CIIOs must also comply with specific requirements extending to relevant interconnected systems that communicate with or connect to their designated CII.
An organisation is not automatically classified as a CIIO simply because it operates in an essential service sector. Formal designation under the Cybersecurity Act is required.
Which Industries Must Follow Singapore’s CII Cybersecurity Requirements?
Singapore identifies Critical Information Infrastructure across essential service sectors that are important to the country’s national security, economy, public health, and public safety.
Organisations operating within these sectors may be designated as CII owners when their computer systems meet the applicable legal criteria.
The essential service sectors include:
- Energy: Electricity generation, transmission, and distribution systems.
- Banking and Finance: Banking infrastructure, financial systems, and essential financial services.
- Water: Water supply, treatment, and distribution infrastructure.
- Healthcare: Hospital systems, healthcare infrastructure, and essential medical services.
- Land Transport: Railway systems, road transportation infrastructure, and transport management systems.
- Maritime: Port operations, maritime infrastructure, and vessel-related operational systems.
- Aviation: Airport operations, aviation infrastructure, and air traffic-related systems.
- Infocomm and Media: Telecommunications networks, digital communications, and media infrastructure.
- Security and Emergency Services: Systems supporting national security, emergency response, and public safety.
- Government: Government systems supporting essential public services.
Organisations in these sectors should understand their potential regulatory responsibilities. However, sector membership alone does not establish CII designation.
Does the Cybersecurity Code of Practice Apply to All Organisations in Singapore?
No. The CII Cybersecurity Code of Practice does not automatically apply to every business or organisation operating in Singapore.
Its mandatory requirements primarily apply to formally designated CII owners. However, the 2026 Code also extends certain requirements to interconnected systems owned, operated, or controlled by CIIOs.
The applicability can be understood through the following categories:
- Designated CII Owners: Must comply with the applicable requirements of the Cybersecurity Code of Practice.
- Interconnected Systems: Certain cybersecurity requirements extend to systems that communicate with or connect to designated CII.
- Enterprise Systems: The Code provides recommendations for broader enterprise systems supporting business, operational, and administrative functions.
- Third-Party Service Providers: May be subject to contractual security requirements and other applicable regulatory obligations when supporting CIIOs.
- Other Private Organisations: Are not automatically subject to the CII Code unless the relevant legal designation or other applicable requirements apply.
This distinction is important because the 2026 Code introduces broader cybersecurity oversight beyond the designated CII itself.
Key Cybersecurity Responsibilities of CII Owners
Organisations designated as CIIOs have specific responsibilities under Singapore’s Cybersecurity Act and the applicable Cybersecurity Code of Practice.
These requirements are intended to ensure that critical systems remain secure, resilient, and capable of supporting essential services.
The key responsibilities include:
Cybersecurity Governance: Establishing appropriate cybersecurity policies, management responsibilities, and board-level oversight.
Risk Management: Conducting regular cybersecurity risk assessments to identify and manage potential threats.
Security Audits: Arranging independent cybersecurity compliance audits as required under the Act.
Vulnerability Management: Identifying security weaknesses and implementing appropriate remediation measures.
Access Control: Maintaining effective user access management and privileged account controls.
Network Security: Protecting network infrastructure through appropriate configurations, segmentation, and monitoring.
Incident Reporting: Reporting prescribed cybersecurity incidents within applicable regulatory timelines.
Cybersecurity Exercises: Participating in relevant cybersecurity exercises and maintaining incident response readiness.
Operational Resilience: Establishing appropriate business continuity, disaster recovery, and incident recovery arrangements.
What Are the New Requirements Under the Cybersecurity Code of Practice 2026?
The Cybersecurity Code of Practice 2026 introduces enhanced requirements to strengthen the cybersecurity posture of designated CII owners.
The updated Code focuses on improving governance, expanding visibility across interconnected systems, and strengthening organisations’ ability to detect and respond to cyber threats.
The important requirements include:
Board-Level Accountability: Strengthening board and senior management oversight of cybersecurity risks.
Cyber Resilience Framework: Maintaining a documented framework covering risk tolerance, mitigation, transfer, and recovery.
Cyber Trust Mark Level 5: Obtaining the required Cyber Trust Mark Advocate (Tier 5) certification or an accepted equivalent.
Interconnected Systems Security: Maintaining oversight of systems that communicate with or connect to designated CII.
Threat Detection: Strengthening threat detection capabilities across relevant network segments.
Cybersecurity Exercise Planning: Establishing a comprehensive cybersecurity exercise plan.
Network Architecture Management: Improving network management, monitoring, and detection capabilities.
Security Readiness: Strengthening incident response and operational resilience.
The 2026 Code took effect on 29 July 2026. Most new requirements have a compliance date of 29 July 2027, while existing CIIOs have until 31 December 2027 to attain the required Cyber Trust Mark Level 5 certification. Applicable transitional arrangements should be considered when planning compliance.
Do Interconnected Systems Also Need to Comply?
Yes. The 2026 Code extends certain mandatory cybersecurity requirements beyond designated CII to relevant interconnected systems.
Interconnected systems are computer systems or network infrastructure that communicate with or connect to designated CII and are owned, operated, or controlled by the CIIO.
These systems may introduce additional cybersecurity risks because weaknesses in connected enterprise environments could affect the security of critical infrastructure.
Examples of interconnected systems include:
Enterprise IT Systems: Business systems connected to designated CII.
Corporate Networks: Internal networks communicating with critical infrastructure.
Remote Access Systems: Technologies providing remote connectivity to CII environments.
Supporting Applications: Applications and platforms connected to critical systems.
Shared Infrastructure: Network components and supporting systems used to communicate with CII.
Organisations should focus on:
Reviewing connections between enterprise networks and CII.
Identifying potential security weaknesses in interconnected systems.
Strengthening network segmentation and access controls.
Monitoring communication between connected environments.
Maintaining visibility into relevant network architecture.
The Code also includes recommendations for broader enterprise systems supporting the CIIO’s business, operational, and administrative functions. These recommendations should be distinguished from requirements that are expressly mandatory.
Do Third-Party Service Providers Need to Comply?
Third-party service providers are not automatically subject to the entire CII Cybersecurity Code simply because they provide services to a CIIO.
However, organisations that support critical infrastructure may have important cybersecurity responsibilities through contractual arrangements, applicable laws, and specific regulatory requirements.
Third-party providers with access to critical systems, sensitive information, or interconnected infrastructure should understand their security responsibilities.
The relevant considerations include:
Access to Critical Systems: Reviewing access permissions provided to external service providers.
Supplier Risk Management: Evaluating cybersecurity risks associated with third-party suppliers.
Security Requirements: Establishing appropriate contractual cybersecurity obligations.
Remote Access Protection: Securing third-party access to critical infrastructure.
Incident Notification: Establishing procedures for reporting security incidents affecting supported systems.
Service Provider Assurance: Reviewing the security capabilities and credentials of external cybersecurity providers.
Additionally, certain cybersecurity service providers are subject to separate licensing and certification requirements under Singapore’s cybersecurity regulatory framework. These requirements should not be confused with direct CIIO obligations under the CII Code.
What Happens If Organisations Fail to Meet CII Cybersecurity Requirements?
Failure to comply with applicable cybersecurity requirements can expose organisations to regulatory consequences under Singapore’s Cybersecurity Act.
The Commissioner of Cybersecurity has powers to issue directions and take enforcement action in accordance with the Act.
Potential compliance consequences include:
Regulatory Directions: Receiving directions requiring corrective actions to address identified security issues.
Compliance Investigations: Being subject to regulatory inquiries and information requests.
Audit Requirements: Being required to undergo applicable cybersecurity compliance audits.
Incident Reporting Obligations: Facing regulatory consequences for failing to fulfil prescribed incident reporting requirements.
Financial Penalties: Potentially facing penalties for offences established under the Cybersecurity Act.
Organisations should therefore maintain appropriate cybersecurity controls, documentation, and assessment processes to demonstrate compliance with applicable requirements.
How Can Organisations Prepare for Singapore’s CII Cybersecurity Code of Practice?
Organisations that are designated as CIIOs should take a proactive approach to understanding the 2026 Code and preparing for the applicable compliance deadlines.
Recommended preparation activities include:
Regulatory Gap Assessment: Reviewing existing cybersecurity practices against the applicable requirements of the 2026 Code.
Asset Identification: Maintaining accurate inventories of critical IT and OT assets.
Vulnerability Assessment: Identifying security weaknesses across infrastructure, applications, and networks.
Penetration Testing: Evaluating the effectiveness of existing security controls through authorised testing.
Network Security Review: Assessing network architecture, segmentation, and interconnected systems.
Access Management: Reviewing user privileges, authentication, and privileged account controls.
Incident Response Planning: Establishing procedures for detecting, reporting, and responding to cybersecurity incidents.
Cybersecurity Governance: Strengthening board-level accountability and management oversight.
Cyber Trust Mark Readiness: Preparing for the required Cyber Trust Mark Level 5 certification.
Remediation and Retesting: Addressing identified weaknesses and validating corrective actions.
These activities help organisations understand their current security posture and prepare for the requirements applicable to their designated systems.
Our Methodology: A Structured Approach to CII Cybersecurity Compliance
Cyberintelsys follows a structured and risk-based assessment methodology to help organisations identify vulnerabilities, evaluate cybersecurity risks, and strengthen their security controls.
The assessment approach can be tailored to the organisation’s infrastructure, regulatory requirements, technology environment, and agreed security objectives.
Step 1: Requirement Understanding and Scope Definition
The first stage involves understanding the organisation’s infrastructure, critical systems, and security assessment objectives.
The process includes:
Regulatory Requirements: Understanding applicable CII cybersecurity requirements.
Infrastructure Review: Reviewing existing IT and OT environments.
Critical Asset Identification: Identifying important systems and infrastructure.
Assessment Scope: Defining systems, applications, and networks within scope.
Assessment Planning: Establishing assessment objectives and testing boundaries.
Step 2: Asset and Security Posture Review
The next stage focuses on understanding the organisation’s existing security posture.
The review includes:
Asset Inventory Review: Identifying critical systems and infrastructure.
Network Architecture Review: Evaluating network architecture and connections.
System Configuration Review: Identifying potential configuration weaknesses.
Access Management Review: Assessing user permissions and access controls.
Security Controls Evaluation: Reviewing existing cybersecurity measures.
Step 3: Vulnerability Assessment
A systematic vulnerability assessment is conducted across the agreed infrastructure to identify potential security weaknesses.
The assessment includes:
Vulnerability Identification: Identifying known vulnerabilities across systems.
Configuration Analysis: Detecting insecure configurations.
Software Assessment: Identifying outdated software and unsupported versions.
Exposed Services Identification: Detecting publicly accessible services.
Risk Prioritisation: Classifying vulnerabilities according to severity and impact.
Step 4: Penetration Testing
Where included in the agreed scope, penetration testing evaluates whether identified security weaknesses can be exploited.
The testing includes:
Network Penetration Testing: Evaluating approved network infrastructure.
Web Application Testing: Identifying application-level vulnerabilities.
External Security Testing: Assessing internet-facing systems.
System Security Testing: Evaluating weaknesses across approved systems.
OT Security Considerations: Planning testing to avoid disruption to critical operations.
Step 5: Risk Analysis and Reporting
Identified findings are analysed to determine their severity, business impact, and potential security implications.
The report includes:
Executive summary.
Technical findings.
Vulnerability descriptions.
Risk ratings.
Supporting evidence.
Recommended remediation measures.
Step 6: Remediation and Retesting
After the assessment, organisations can address identified weaknesses according to their risk priorities.
The process includes:
Remediation Review: Reviewing implemented corrective actions.
Vulnerability Retesting: Reassessing previously identified vulnerabilities.
Security Validation: Verifying whether identified weaknesses have been resolved.
Remaining Risk Identification: Highlighting outstanding security issues.
Continuous Improvement: Supporting ongoing cybersecurity improvements.
Cyberintelsys Services for CII Cybersecurity Compliance
Cyberintelsys offers a range of cybersecurity assessment and testing services to help organisations identify security weaknesses, strengthen infrastructure protection, and improve their cybersecurity readiness.
The following services can support organisations seeking to improve their security posture in line with Singapore’s CII cybersecurity requirements.
1. Vulnerability Assessment (VA)
Vulnerability Assessment identifies security weaknesses across an organisation’s IT infrastructure, applications, and network environments.
The assessment helps organisations:
Identify known vulnerabilities and security misconfigurations.
Detect outdated operating systems and software.
Identify exposed network services and unnecessary ports.
Evaluate infrastructure security weaknesses.
Prioritise vulnerabilities based on risk and severity.
2. Penetration Testing (PT)
Penetration Testing evaluates the security of systems through authorised and controlled simulated cyberattacks.
Testing can cover:
External Network Penetration Testing.
Internal Network Penetration Testing.
Web Application Penetration Testing.
Mobile Application Penetration Testing.
API Penetration Testing.
Cloud Penetration Testing.
3. Network Security Assessment
Network Security Assessment evaluates network infrastructure, communication environments, and security configurations.
The assessment includes:
Network Configuration Review.
Access Control Assessment.
Firewall Policy Review.
Network Segmentation Assessment.
Infrastructure Security Evaluation.
4. Web Application Security Assessment
Web Application Security Assessment identifies application-level vulnerabilities that could expose sensitive information or allow unauthorised access.
The assessment includes:
Authentication Testing.
Access Control Testing.
Injection Vulnerability Testing.
Security Configuration Review.
Sensitive Data Protection Assessment.
5. Cloud Security Assessment
Cloud Security Assessment evaluates security configurations and controls implemented across cloud environments.
The assessment includes:
Identity and Access Management.
Cloud Storage Security.
Network Security Configuration.
Encryption and Data Protection.
Cloud Workload Security.
Logging and Monitoring.
6. OT Security Assessment
Operational Technology environments support essential services across sectors such as energy, water, manufacturing, and transportation.
The assessment includes:
OT Infrastructure Review.
Network Architecture Assessment.
Access Control Review.
Security Configuration Review.
Operational Risk Assessment.
Safety and Availability Considerations.
7. Security Compliance Assessment
Security Compliance Assessment helps organisations evaluate their existing cybersecurity controls against applicable regulatory requirements and recognised security frameworks.
The assessment includes:
Reviewing cybersecurity policies and procedures.
Evaluating existing security controls.
Identifying regulatory compliance gaps.
Assessing cybersecurity risk management practices.
Providing recommendations for security improvements.
Why Choose Cyberintelsys?
Selecting an experienced cybersecurity partner is important when assessing critical infrastructure and addressing regulatory security requirements.
Cyberintelsys combines technical cybersecurity expertise, recognised industry credentials, and structured assessment methodologies to help organisations strengthen their security posture.
CREST-accredited cybersecurity company for Vulnerability Assessment (VA) and Penetration Testing (PT).
Holds a Singapore Cybersecurity Service Provider (CSP) Licence for applicable licensed cybersecurity services.
Maintains ISO/IEC 27001:2022 certification through Bureau Veritas under UKAS accreditation.
Holds ISO/IEC 27001:2022 certification under Singapore Accreditation Council (SAC) accreditation.
Provides comprehensive cybersecurity assessment services covering IT, OT, networks, applications, and cloud environments.
Follows structured security assessment methodologies to identify vulnerabilities and evaluate cybersecurity risks.
Delivers detailed technical reports with practical remediation recommendations based on potential business impact.
Supports remediation validation and retesting to help organisations strengthen security controls and improve overall cybersecurity resilience.
Contact Cyberintelsys
Singapore’s Cybersecurity Code of Practice for Critical Information Infrastructure establishes important cybersecurity expectations for organisations responsible for delivering essential services.
The 2026 Code introduces enhanced requirements covering cybersecurity governance, interconnected systems, threat detection, and operational resilience.
Organisations designated as CIIOs must understand their applicable responsibilities and ensure that their cybersecurity practices align with the relevant regulatory requirements.
Cyberintelsys helps organisations identify vulnerabilities, evaluate cybersecurity risks, and strengthen their infrastructure through professional security assessment and testing services.
Looking to strengthen your organisation’s CII cybersecurity compliance in Singapore?
Contact Cyberintelsys to discuss your security assessment requirements, identify potential security gaps, and improve your organisation’s resilience against evolving cyber threats.
