Singapore’s economy runs on digital systems that most people never see. Power grids, payment networks, hospitals, and transport operators all depend on computers that must stay available and one serious incident can ripple across the economy. The Cybersecurity Act Singapore enacted in 2018 is the main law protecting the most critical of these systems.
The Act gives the Cyber Security Agency of Singapore (CSA) following powers-
- Oversee Critical Information Infrastructure (CII)
- Respond to cyber threats
- License certain cybersecurity service providers
Parliament widened its scope in 2024, and CSA updated its CII code of practice in 2026.
Most statutory duties apply to designated CII owners, certain providers of essential services, STCC owners and licensed cybersecurity service providers. Even so, any organisation in Singapore’s digital economy needs to understand its cyber risks and the rules reaching it through contracts, supply chains, and sector regulation. This guide explains the version of the Cybersecurity Act Singapore has in force today and how it fits with other requirements.
Singapore Cybersecurity & Data Compliance Overview
| Law / Framework | Primary Purpose | Who It Applies To | Main Regulatory Body |
| Cybersecurity Act 2018 | CII protection and national cybersecurity oversight | Designated CII owners and other designated entities; licensed providers | CSA |
| Personal Data Protection Act 2012 (PDPA) | Handling and protection of personal data | Private-sector organisations | PDPC |
| Computer Misuse Act | Criminalises unauthorised computer access and misuse | Any person | Singapore Police Force |
| MAS Notices and Guidelines on technology risk | Technology and cyber risk in financial services | Financial institutions regulated by MAS | MAS |
| Telecommunications Cybersecurity Code of Practice | Cybersecurity of internet infrastructure | Major internet service providers | IMDA |
No single law covers every organisation. Requirements come in layers of statutes, sector rules, codes, and guidance, with different legal weight. Statutes such as the Cybersecurity Act Singapore administers through CSA impose binding duties, while MAS guidelines describe best practices. A joint handbook from CSA, PDPC and the police compares the three main Acts.
What are the Main Regulatory Bodies Overseeing Cybersecurity in Singapore?
Cyber Security Agency of Singapore (CSA)
CSA is the national cybersecurity agency. Established in 2015 within the Prime Minister’s Office, it works with sector leads to protect CII.
Through CSA, the Commissioner of Cybersecurity exercises the powers of the Cybersecurity Act Singapore introduced in 2018. These include designating CII, issuing codes of practice and directions and investigating incidents.
Personal Data Protection Commission (PDPC)
PDPC administers the PDPA, the baseline law on how private-sector organisations manage and protect personal data.
A compromised system often becomes a data breach. Organisations must notify PDPC and sometimes affected individuals, of breaches meeting the PDPA’s notification criteria (PDPC). PDPA compliance does not satisfy the separate duties in the Cybersecurity Act Singapore enforces.
Infocomm Media Development Authority (IMDA)
IMDA regulates the infocomm and media sectors and is their sector lead. Its Telecommunications Cybersecurity Code of Practice is mandatory for major internet service providers.
That code sits alongside the Cybersecurity Act Singapore relies on for critical systems. The 2024 amendments also created a regime for major Foundational Digital Infrastructure providers, including certain cloud and data centre services, but those provisions had not commenced as of September 2026.
Monetary Authority of Singapore (MAS)
MAS oversees technology and cyber risk in financial services. Its Technology Risk Management and Cyber Hygiene Notices are legally binding, while its guidelines set out best practices.
These rules apply regardless of CII status. Where an institution owns CII, they sit alongside the Cybersecurity Act Singapore applies to CII and meeting one does not satisfy the other.
Why does Cybersecurity Compliance Matter in Singapore?
Singapore is highly digitalised and everyday services depend on a few critical systems. CSA notes that attacks on CII can have a debilitating effect on the economy and society.
Strong cybersecurity compliance protects critical services and sensitive data. It supports the system and helps recovery. Today organizations are connected to various third party vendors, suppliers, and cloud systems. Attackers may get multiple entry points from the weaker links instead of targeting the organizations directly.
For organisations within the expanded scope of the Cybersecurity Act Singapore, compliance is a legal duty. For others, it helps to create a strong trust of customers, partners, and regulators.
What is the Singapore Cybersecurity Act?
The Cybersecurity Act 2018 establishes Singapore’s legal framework for the oversight and maintenance of national cybersecurity. Its objectives are to protect CII against cyber-attacks, authorise CSA to prevent and respond to threats, enable cybersecurity information sharing and license service providers. Only penetration testing and managed security operations centre (SOC) monitoring currently need a licence.
Parliament passed amendments on 7 May 2024, and key provisions commenced on 31 October 2025. Under the Cybersecurity Act Singapore amended in 2024-
- CII can include virtual systems
- Providers of essential services remain responsible for third-party-owned CII
- Systems of Temporary Cybersecurity Concern (STCCs) is introduced. It is for systems which face higher risk for a limited period.
- Regime for Entities of Special Cybersecurity Interest enacted (but had not commenced as of September 2026)
- Regime for major Foundational Digital Infrastructure (FDI) providers were enacted (but had not commenced as of September 2026)
What are the Key Requirements Under Singapore’s Cybersecurity Act?
In the Cybersecurity Act Singapore operates today, obligations depend on an organisation’s role. Most fall on owners of designated CII or STCCs and on essential service providers relying on third-party-owned CII.
Critical Information Infrastructure Protection
CSA describes CII as computer systems directly involved in providing essential services, so they face closer oversight. The Commissioner designates CII by notice and owners must follow the Commissioner’s codes of practice and standards.
Those codes are where the Cybersecurity Act Singapore uses to protect CII becomes concrete. The Cybersecurity Code of Practice for CII issued on 29 July 2026 adds board accountability, Cyber Trust Mark Level 5 certification and oversight of interconnected systems.
Cybersecurity Risk Management
Risk management means identifying assets, threats, vulnerabilities, and supplier dependencies, then deciding whether to accept, avoid, transfer, or reduce each risk.
CII owners must conduct regular cybersecurity risk assessments. CSA also expects senior management to approve risk-treatment plans and accept any remaining risks. Other organisations can follow the same approach as a good risk-management practice.
Cybersecurity Audits and Assessments
Audits check that required controls exist and work. CII owners must have their CII audited at least every two years or more often if directed, by an auditor the Commissioner approves or appoints.
Vulnerability scans and penetration tests catch the vulnerabilities early and documentation tells auditors what has been done.
Cybersecurity Incident Reporting
Reporting duties in the Cybersecurity Act Singapore strengthened in 2024 give CSA early warning. CII owners must report prescribed incidents, including certain supply-chain incidents. Since 31 October 2025, these include suspected advanced persistent threat (APT) attacks and disruptions to essential services through non-interconnected systems the owner controls. Such incidents must be reported within 2 hours of becoming aware.
STCC owners must also report incidents affecting their systems. These requirements apply only to regulated entities.
Which Businesses and Sectors Must Comply with Singapore’s Cybersecurity Act?
Energy:
Power and gas industry serves homes and businesses. Essential services can stop if the control systems are disrupted.
Water:
Any tampering of controls of water treatment and distribution is related to supply and quality of water. It can create a huge public health issue.
Banking and Finance:
Payment and banking systems underpin economic activity, and institutions also answer to MAS.
Healthcare:
Clinical systems support patient care, an essential service and hold sensitive records.
Transport:
Land, air, and maritime transport systems support movement of people and goods. Cyber incidents can cause wider operational disruption.
Infocomm:
Telecommunications and digital network infrastructure support the connectivity that many other essential services depend on.
Media:
Media infrastructure supports the delivery of information and communication services that may be important during normal operations and emergencies.
Security and Emergency Services:
Systems supporting police, civil defence and other emergency services are critical because disruption can affect public safety and emergency response.
Government:
Government systems support the delivery of public services and the operation of essential state functions.
Working in these industries does not by itself bring a company within the Cybersecurity Act Singapore designed for critical systems. CSA does not publish its CII list, so businesses must confirm applicability through official designation and current CSA requirements.
How Can Organisations Prepare for Singapore’s Cybersecurity Requirements?
Preparation differs for CII owners, suppliers, and unregulated businesses. These steps are a starting point, not legal advice.
1. Confirm what applies:
Check whether you fall within any part of the Cybersecurity Act Singapore has brought into force and which sector rules and PDPA duties apply.
2. Map systems and dependencies:
Record critical systems, data flows, cloud services, and suppliers.
3. Assess gaps:
Compare current controls with applicable requirements and a recognised framework.
4. Prioritise high-risk systems:
Rank vulnerabilities by likelihood and impact.
5. Implement controls:
Pair technical measures such as patching with policies and training.
6. Control access:
Enforce strong authentication, least privilege and managed privileged accounts.
7. Prepare to respond:
Set up monitoring and an incident response plan that reflects reporting deadlines.
8. Test controls:
Use vulnerability assessments, penetration tests, and exercises.
9. Keep evidence:
Record risk decisions, test results, and remediation.
10. Reassess regularly:
Review risks as systems, suppliers, and threats change.
How Does Singapore’s Cybersecurity Act Compare to Global Standards?
The Cybersecurity Act Singapore adopted in 2018 is legislation that places legal duties on specific organisations. The NIST Cybersecurity Framework (CSF) 2.0 is voluntary and ISO/IEC 27001 is a certifiable international standard for information security management systems.
NIST CSF groups outcomes under Govern, Identify, Protect, Detect, Respond and Recover. ISO/IEC 27001 requires risk assessment, controls, monitoring, and continual improvement. The Act’s CII regime covers similar ground through board accountability, risk assessments, codes of practice, incident reporting, and audits.
Both frameworks can support a mature programme, but ISO/IEC 27001 certification does not establish compliance with the Act and following NIST CSF does not guarantee it.
What are the Key Risks and Consequences of Cybersecurity Non-Compliance in Singapore?
For regulated entities, the first risk is enforcement. Under the Cybersecurity Act Singapore has applied since 2018, non-compliance with CII obligations is enforced through criminal penalties. The Commissioner can issue written directions, and the amended Act lets CSA inspect a CII whose owner appears not to have complied. PDPA penalties are separate.
The wider costs can be larger: outages, lost access to data, recovery costs and exposed personal or commercial information. For CII, disruption can reach essential services. Contracts add exposure, since providers relying on third-party-owned CII must secure comparable standards through binding commitments. Reputational damage can outlast the technical disruption.
Best Practices for Singapore Cybersecurity Compliance
Compliance works best as routine security work, not a one-off project.
Strengthen Application and Access Security
Applications and accounts are common entry points. Multi-factor authentication, least privilege and tight control of privileged accounts limit what stolen credentials unlock. APIs need authentication and secrets should never be hardcoded.
Application hardening, prompt vulnerability remediation and, for mobile apps, protection against tampering all reduce the attack surface. None is written into the Cybersecurity Act Singapore passed in 2018 or its amendments; they are risk-based controls.
Monitor and Respond to Security Threats
Centralised logging across servers, applications and cloud services helps analysts spot anomalies and clear escalation gets alerts to people who can act.
Response procedures should set out roles, containment steps and reporting deadlines and tested backups support recovery. Threat intelligence and automation help but still need human judgement.
Review and Update Security Controls
Controls weaken without maintenance. Updates, infrastructure changes and new threats or vulnerabilities open gaps, so regular testing and periodic risk reviews should feed updated policies and controls. For CII owners, that discipline also supports the audits built into the Cybersecurity Act Singapore updated in 2024.
How can DoveRunner improve your organisation’s Cybersecurity in Singapore?
Mobile apps extend the attack surface of banks, healthcare providers, transport operators, and digital services. Once published, an app runs on devices the organisation does not control. Attackers can decompile it, modify it, attach debuggers, manipulate it at runtime, or run it on rooted, jailbroken, or emulated devices.
DoveRunner Mobile App Security addresses this layer of risk. Its capabilities include code protection through obfuscation and encryption, integrity protection and anti-tampering, anti-debugging, and runtime application self-protection (RASP). It also offers root, jailbreak, and emulator detection, with real-time threat monitoring through a dashboard (DoveRunner).
These controls can help organisations reduce application-layer risks such as unauthorised modification, reverse engineering, and runtime manipulation. Monitoring data can also support incident detection by showing when and how an app is targeted. Not every capability suits every organisation, and the right mix depends on each app’s risk.
Application protection can form one part of a wider cybersecurity risk-management programme. Using DoveRunner does not make an organisation compliant with the Cybersecurity Act Singapore enforces and DoveRunner does not certify compliance. Regulatory compliance also depends on governance, infrastructure security, incident management, and organisational processes.
Frequently Asked Questions About Singapore Cybersecurity Compliance
What is Singapore’s Cybersecurity Act?
The Cybersecurity Act 2018 is Singapore’s legal framework for overseeing and maintaining national cybersecurity. It protects Critical Information Infrastructure, authorises CSA to respond to cyber threats, supports information sharing and licenses certain cybersecurity service providers. Amendments in force since October 2025 extend it to virtual and third-party-owned CII and to Systems of Temporary Cybersecurity Concern.
Who Must Comply with Singapore’s Cybersecurity Act?
Only specific groups carry duties under the Cybersecurity Act Singapore currently enforces: owners of designated CII or STCCs and essential service providers relying on third-party-owned CII. Licensed penetration testing and managed SOC providers have duties too. Regimes for Entities of Special Cybersecurity Interest and major digital infrastructure providers had not commenced as of September 2026.
What are the Key Requirements of the Cybersecurity Act?
CII owners must –
- Provide information about their CII when require
- Follow codes of practice
- Report prescribed incidents and arrange audits at least every two years
- Conduct periodic risk assessments
- Comply with written directions and join exercises when directed
What is Critical Information Infrastructure (CII) in Singapore?
CSA describes CII as computer systems directly involved in providing essential services. A system can be designated when it is necessary for the continuous delivery of an essential service, and its loss or compromise would have a debilitating effect on that service. Under the Cybersecurity Act Singapore has in place, designation is by notice and the list is not published.
What Happens if an Organisation Does Not Comply with the Cybersecurity Act?
For CII owners and other regulated entities, breaching statutory obligations can lead to criminal penalties. The Commissioner can also issue written directions and, under the amended Act, inspect a CII whose owner appears not to have complied. Penalties vary by provision, so check the current text on Singapore Statutes Online; PDPA penalties are separate.
How Can Organisations Prepare for Cybersecurity Act Compliance?
Organizations can prepare for Cybersecurity Act Compliance by-
- Confirming which cybersecurity act requirements are applicable
- Map critical systems and suppliers
- Assess gaps and fix high-risk weaknesses first
- Set up monitoring and incident response
- Maintain records of assessments, controls and remediation
- Review controls as systems change
- Seek guidance from CSA or a legal adviser where obligations are unclear
