Singapore Cybersecurity Act
Cybersecurity Act 2018
Singapore's framework for protecting Critical Information Infrastructure (CII), administered by the Cyber Security Agency of Singapore (CSA).
In force: In force since 2018; amended in 2024 to widen its scope
Who it applies to
Owners of designated Critical Information Infrastructure, and, after the 2024 amendments, certain foundational digital infrastructure providers and other designated entities. Also licensed cybersecurity service providers.
Key requirements
- Comply with codes of practice and standards of performance for CII.
- Report prescribed cybersecurity incidents to the Commissioner of Cybersecurity.
- Conduct regular cybersecurity audits and risk assessments.
- Take part in national cybersecurity exercises.
- Licensing for certain cybersecurity services, such as penetration testing and managed SOC monitoring.
Breach and incident notification
Prescribed incidents are reported to the Commissioner within a short, fixed period measured in hours, as set in the regulations. Check CSA for the current requirements.
Penalties
Fines and, for some offences, imprisonment; the 2024 amendments added civil penalties.
Related frameworks
Shows up on these exams
Official source
Cyber Security Agency of Singapore: Cybersecurity ActNot legal advice
This is a study summary, not legal advice. Laws and their guidance change, and obligations depend on your facts and jurisdiction. Check the official source and the current, dated text, and consult a qualified lawyer before acting.
Go deeper
OT security lab
Practise this topic hands-on.
Compliance obligations lab
Practise this topic hands-on.
Singapore PDPA
Singapore - Privacy & data protection
CER Directive
European Union - Critical infrastructure
UK NIS Regulations
United Kingdom - Critical infrastructure
CIRCIA
United States (federal) - Critical infrastructure
SOCI Act
Australia - Critical infrastructure