Singapore's Cybersecurity Act 2018 makes owners of critical information infrastructure legally responsible for protecting it, and the 2024 amendments extended that duty to cloud-hosted and overseas systems, supplier systems and new categories of regulated entity. The Cybersecurity (Amendment) Act 2024 was passed by Parliament on 7 May 2024 and its first set of provisions came into force on 31 October 2025, while the provisions for Entities of Special Cybersecurity Interest and Foundational Digital Infrastructure still awaited commencement when this guide was checked in October 2026. This guide covers who is regulated, what CII owners must do (including the two-hour incident report), audits and risk assessments, penalties and the voluntary Cyber Essentials and Cyber Trust marks. It is written for CISOs, compliance leads and security architects at essential service providers, their cloud and managed service suppliers, and multinational groups with Singapore operations.
Key takeaways
- The Act regulates CII, not every organisation. Duties fall on owners of systems designated as critical information infrastructure in 11 essential service sectors, plus newer categories designated by the Commissioner of Cybersecurity.
- Cloud and overseas systems can now be CII. Since 31 October 2025 virtual systems and systems wholly outside Singapore can be designated, and essential service providers that rely on third-party-owned CII must secure binding commitments from the owner.
- Reportable incidents expanded, and the clock is two hours. CII owners must report prescribed incidents, including those on interconnected and supplier systems and those suspected to involve advanced persistent threats, to CSA within two hours of becoming aware of them.
- Audits every 2 years, risk assessments every year. Section 15 requires a compliance audit at least once every two years by an approved auditor and a risk assessment at least once a year, with reports to the Commissioner within 30 days.
- Several 2024 provisions are not yet in force. ESCI (Part 3C), Foundational Digital Infrastructure (Part 3D) and the civil penalty regime await commencement, and a separate Digital Infrastructure Bill for data centres and cloud providers was passed in October 2026.
Scope: who and what is covered
The Act is administered by the Cyber Security Agency of Singapore (CSA) through the Commissioner of Cybersecurity. Part 3 applies to CII located wholly or partly in Singapore, the Act binds the Government (though the Government cannot be prosecuted), and since the 2024 amendments "computer" and "computer system" include virtual computers and systems for specified parts of the Act.
CII is a computer system directly involved in providing an essential service, designated by the Commissioner under section 7. CSA lists 11 CII sectors: energy, water, banking and finance, healthcare, transport (land, maritime and aviation), infocomm, media, security and emergency services, and government.
| Category | Where in the Act | Who it catches | Status (October 2026) |
|---|---|---|---|
| Provider-owned CII | Part 3, section 7 | Owners of designated systems, including virtual systems and, under section 7(1A), systems located wholly outside Singapore | In force; overseas and virtual extension from 31 October 2025 |
| Third-party-owned CII | Part 3A | Essential service providers that rely on CII owned by someone else, such as a cloud provider | In force from 31 October 2025 |
| Systems of Temporary Cybersecurity Concern (STCCs) | Part 3B | Systems at high risk for a limited period, such as during a major national event, where compromise could seriously harm national interests | In force from 31 October 2025; designation up to one year at a time |
| Entities of Special Cybersecurity Interest (ESCIs) | Part 3C | Entities that hold sensitive information or perform functions of national interest; the list will not be published | Passed, awaiting commencement |
| Foundational Digital Infrastructure (FDI) | Part 3D | Major providers of services foundational to the economy, initially cloud computing and data centre facility services | Passed, awaiting commencement |
| Licensable cybersecurity service providers | Part 5 | Providers of penetration testing and managed security operations centre (SOC) monitoring services | In force; CSA describes the approach as light-touch |
The Act sits alongside, not inside, Singapore's personal data regime: the Personal Data Protection Act 2012 (PDPA), enforced by the Personal Data Protection Commission, governs personal data and its breach notification separately. Financial institutions designated as CII also face the Monetary Authority of Singapore's technology risk requirements; see the MAS Technology Risk Management Guide.
Key obligations
Once a system is designated, the owner takes on a set of continuing duties. The table summarises the main ones for provider-owned CII.
| Obligation | Section | What is required |
|---|---|---|
| Comply with codes of practice and standards | Section 11 | Meet the Cybersecurity Code of Practice for CII (CCoP) and any standards of performance; waivers can be requested under section 11(7) |
| Report incidents | Section 14 | Notify the Commissioner of prescribed incidents in the prescribed form and period; establish mechanisms to detect threats and incidents as set out in the applicable code |
| Audit | Section 15(1)(a) | Compliance audit at least once every 2 years (or more often if directed) by an auditor approved or appointed by the Commissioner |
| Risk assessment | Section 15(1)(b) | Cybersecurity risk assessment at least once a year in the prescribed form and manner |
| Submit reports | Section 15(2) | Copy of each audit and risk assessment report to the Commissioner within 30 days of completion |
| Re-audit after change | Section 15(6) | The Commissioner may require another audit or assessment after a material change to the CII |
| Third-party-owned CII | Part 3A | Obtain legally binding commitments from the owner to provide system information, maintain prescribed standards and notify material changes |
What counts as a reportable incident
Section 14(1), as amended with effect from 31 October 2025, requires the owner to report prescribed incidents affecting:
- The CII itself: section 14(1)(a).
- Interconnected systems under the owner's control: any computer or system that is interconnected with, or communicates with, the CII (section 14(1)(b)).
- Other systems under the owner's control: new section 14(1)(ba), covering, for example, an incident on a non-interconnected system that disrupts the essential service.
- Supplier systems: new section 14(1)(bb), covering a supplier's system that is interconnected with or communicates with the CII.
- Anything else the Commissioner directs: section 14(1)(c), by written direction to the owner.
Law firm summaries of the commencement (Rajah and Tann Asia, Hogan Lovells) report that incidents reasonably suspected to involve advanced persistent threats are also reportable, and that CII owners must notify CSA within two hours of becoming aware of a prescribed incident. The precise period, form and list of prescribed incidents sit in subsidiary regulations; confirm the current text on Singapore Statutes Online before building a playbook around it. Earlier guidance on the 2018 regulations required supplementary written details within 14 days of the first notification. The two-hour clock runs from awareness, not confirmation, so the decision to report must be made by an on-call role, not a weekly committee. See the NIST SP 800-61 Incident Response Guide for the wider response process.
STCC owners
Owners of a designated STCC must provide information when required, comply with written directions (which may include prescribed standards, codes of practice and appointing an approved auditor) and report incidents affecting the system or systems interconnected with it during the designation period.
Timeline and current status
| Date | Event |
|---|---|
| 2018 | Cybersecurity Act 2018 enacted, creating the CII regime, the Commissioner's investigation powers and the licensing framework (Part 5 commenced by later notification) |
| 4 July 2022 | CCoP Second Edition (CCoP 2.0) took effect, with a 12-month grace period for compliance by existing and newly designated CII |
| 7 May 2024 | Cybersecurity (Amendment) Act 2024 (Act 19 of 2024) passed by Parliament |
| 31 October 2025 | First provisions in force: virtual and overseas CII, Part 3A third-party-owned CII, expanded section 14 reporting including supplier systems, Part 3B STCCs, extended appeals (section 35B) and new powers over licensees |
| 7 October 2026 | Digital Infrastructure Bill passed (first reading 8 September 2026), to be administered by IMDA for major data centres and cloud service providers; commencement dates not yet stated in the sources checked |
| Pending | Part 3C ESCIs, Part 3D FDI and the revised civil penalty regime await commencement notifications |
The Digital Infrastructure Bill covers co-location and cloud data centres with at least 10 MW of critical IT load and cloud providers whose IaaS and PaaS services earn at least S$100 million average annual revenue from Singapore users. Their duties include security risk management, business continuity and disaster recovery planning and reporting of specified incidents to IMDA, and the government has said it will streamline requirements between the Bill and the Cybersecurity Act. How this interacts with the dormant Part 3D is not yet clear, so cloud and data centre providers should track both.
Enforcement and penalties
Non-compliance by CII owners is currently enforced through criminal offences, each requiring that the owner acted "without reasonable excuse".
| Offence | Maximum penalty |
|---|---|
| Failing to report a prescribed incident (section 14(3)) | Fine up to S$100,000, imprisonment up to 2 years, or both |
| Failing to carry out an audit or risk assessment, comply with related directions, or obstructing them (section 15(7)) | Fine up to S$100,000, imprisonment up to 2 years, or both; further fine up to S$5,000 per day for continuing offences |
| Failing to furnish an audit or assessment report (section 15(8)) | Fine up to S$25,000, imprisonment up to 12 months, or both; further fine up to S$2,500 per day |
| STCC owner failing to report incidents or implement required measures | Fine up to S$100,000, imprisonment up to 2 years, or both |
| Using CSA's gazetted symbols without permission | Offence since 31 October 2025 |
The 2024 amendments also introduce civil penalties, imposed through court action with the Public Prosecutor's consent, but that regime had not commenced when checked. The Commissioner has investigation powers that scale with the severity of the threat or incident, and new powers to inspect provider-owned CII in certain non-compliance cases (section 15(4)).
What it means for AI agents and non-human identities
The Act does not mention AI agents or machine identities, but its duties reach them in four ways.
- Supplier and interconnected systems: section 14 reporting now covers systems that communicate with the CII. An integration account, API key or AI agent with access to CII is exactly such a connection, and its compromise can be a reportable incident. Inventory these connections before an incident, not during the two-hour window.
- Cloud CII and third-party commitments: CII owners remain responsible when they use cloud. Cloud workload identities, service principals and federated roles that administer CII are part of the CII's attack surface (MITRE ATT&CK T1078.004 Cloud Accounts), and Part 3A commitments should cover how the provider protects administrative credentials.
- Detection mechanisms: section 14(2) requires mechanisms to detect threats as set out in the code of practice. Abuse of valid machine credentials (T1078) and of trusted supplier connections (T1199) is hard to see without baselining what each non-human identity normally does.
- Audit evidence: a biennial audit tests access control. Orphaned service accounts and long-lived tokens with no owner are common findings and are simple to fix in advance.
AI agents deployed on or against CII inherit all of this: give each agent its own identity, scope its tools and credentials, log its actions, and include it in the risk assessment. See the Agentic AI Identity Guide, the Service Account Security Guide and the Third-Party Access Guide. For AI governance in Singapore and elsewhere, see the Global AI Regulation Map.
Compliance steps
- Confirm your position. Establish whether you own designated CII, provide an essential service that relies on third-party-owned CII, supply services to a CII owner, or are a likely STCC, ESCI or FDI candidate. Suppliers are affected through section 14(1)(bb) even without designation.
- Map the CII boundary. List the CII, every interconnected system, every supplier connection and every human and non-human identity with administrative access, including cloud and overseas components now in scope.
- Gap assess against CCoP 2.0. Use the current code of practice as the control baseline; where a requirement cannot be met, document mitigating controls and seek a section 11(7) waiver rather than silently deviating.
- Build the two-hour reporting path. Define who can declare a reportable incident, pre-fill CSA's notification form with static details, test the path in a tabletop exercise and put supplier incident notification into contracts so you learn of supplier incidents in time.
- Update supplier and cloud contracts. For third-party-owned CII, obtain the binding commitments Part 3A requires: system information, prescribed standards and notice of material changes. Use licensed providers for penetration testing and managed SOC services.
- Schedule assessments. Run the annual risk assessment and the biennial audit by an approved auditor, submit reports within 30 days and plan a re-assessment for any material change.
- Measure. Track time from detection to CSA notification, percentage of CII-connected identities with a named owner, percentage of supplier connections covered by notification clauses, audit findings closed on time and coverage of CII and interconnected systems in monitoring.
- Watch commencement. Monitor CSA and Singapore Statutes Online for Part 3C, Part 3D, civil penalties and the Digital Infrastructure Bill's commencement.
Voluntary marks for everyone else
Organisations outside the Act can still show their posture through CSA's cybersecurity certification marks, launched in 2022. Cyber Essentials is aimed at small and medium-sized enterprises and covers basics such as backups, access control and incident response. Cyber Trust is risk-based for larger organisations, with five preparedness tiers each covering 10 to 22 domains. Both are voluntary, certify an organisation's measures rather than products, and are assessed by independent certification bodies. They are not a substitute for CCoP compliance. For comparison with the UK scheme of the same name, see the Cyber Essentials Guide.
How it compares with NIS2
Both regimes impose security and reporting duties on essential services, but they differ in mechanics: NIS2 applies by sector and size criteria and starts with a 24-hour early warning, while the Singapore Act applies by individual designation and requires a two-hour report for prescribed incidents. Groups operating in both should keep one incident classification scheme with jurisdiction-specific clocks. See the NIS2 Directive Guide.
Practitioner checklist
- Confirm whether you own CII, rely on third-party-owned CII, supply a CII owner or are a likely STCC, ESCI or FDI.
- Map the CII boundary, including virtual, cloud and overseas components, interconnected systems and supplier connections.
- Inventory every human and non-human identity with administrative access to CII, each with a named owner.
- Gap assess against CCoP 2.0 and document any section 11(7) waiver requests.
- Build and rehearse a two-hour notification path to CSA, triggered on awareness.
- Require suppliers connected to CII to notify you of incidents fast enough for you to meet your own deadline.
- Obtain Part 3A binding commitments from owners of third-party-owned CII you rely on.
- Run annual risk assessments and biennial audits by an approved auditor, and submit reports within 30 days.
- Use CSA-licensed providers for penetration testing and managed SOC monitoring.
- Track commencement of Parts 3C and 3D, civil penalties and the Digital Infrastructure Bill.
Standards and references
- Singapore Statutes Online: Cybersecurity Act 2018
- Cyber Security Agency of Singapore: Cybersecurity Act
- Rajah and Tann Asia: Cybersecurity Act amendments in force from 31 October 2025
- Allen and Gledhill: Amendments to Cybersecurity Act 2018 in force on 31 October 2025
- Hogan Lovells: Provisions in Singapore's Cybersecurity (Amendment) Act came into force
- Rajah and Tann Asia: Digital Infrastructure Bill passed in Parliament
- Industrial Cyber: CSA publishes CCoP 2.0 for owners of critical information infrastructure
- MITRE ATT&CK: Cloud Accounts
Related NHI Mgmt Group resources: Critical Infrastructure Identity Security Guide · Global Cybersecurity Regulatory Map · Global Privacy Regulatory Map · Identity Security Regulatory Map. This guide summarises Singapore's Cybersecurity Act 2018 and the Cybersecurity (Amendment) Act 2024 as they stood in October 2026 and is not legal advice.