TRW & Co · Cybersecurity
Cybersecurity Act Amendments and CII Owner Obligations
The amended Cybersecurity Act in Singapore now follows essential services into the cloud. Since 31 October 2025, provider-hosted systems can be designated as CII and more incidents must be reported to CSA within two hours. An updated code of practice will add board accountability and certification, while new rules reach cloud and data centre providers.
Key pointA two-hour reporting duty is only as fast as your slowest supplier: contracts with providers of systems connected to CII must require near-immediate escalation, or the owner cannot comply.
At a glance
In force since 2025
Key provisions of the Cybersecurity (Amendment) Act, passed on 7 May 2024, came into force on 31 October 2025 for CII owners and temporary-concern systems.
Two-hour reporting window
CII owners must report newly covered incidents, including suspected advanced persistent threats and disruptive incidents on other owned systems, within two hours of awareness.
Cloud-hosted CII covered
CSA can designate virtual and provider-hosted systems as CII; essential service providers must secure equivalent protections from system owners by contract.
Code of practice update
CSA announced in July 2026 an updated CII code requiring board-level cyber resilience frameworks, Cyber Trust Mark Level 5 and interconnected system oversight.
Digital infrastructure linked
The Digital Infrastructure Bill, passed on 7 October 2026, amends the Cybersecurity Act and adds IMDA licensing for major data centres and cloud providers.
Swipe or scroll →
The amended Cybersecurity Act in Singapore: the short answer
The Cybersecurity Act in Singapore has moved from a regime focused on physical systems owned by critical information infrastructure (CII) owners to one that follows essential services into the cloud and across supply chains. The Cybersecurity (Amendment) Act, passed on 7 May 2024, brought key CII provisions into force on 31 October 2025, and the Cyber Security Agency of Singapore (CSA) is now updating its codes of practice to match.
For CII owners, three changes matter most. Virtual and provider-hosted systems can now be designated as CII. More types of incidents must be reported, within two hours of becoming aware of them. And the forthcoming update to the Cybersecurity Code of Practice for CII will require stronger board oversight, Cyber Trust Mark Level 5 certification and oversight of systems that connect to CII.
Cloud and data centre providers are also drawn in, both through the amendments and through the Digital Infrastructure Bill passed in October 2026, which amends the Cybersecurity Act and is designed to work alongside it.
Who is a CII owner and who else is regulated
Under the Cybersecurity Act 2018, the Commissioner of Cybersecurity designates a computer or computer system as CII if it is necessary for the continuous delivery of an essential service and its loss or compromise would debilitate that service. Essential services are listed across sectors such as energy, water, banking and finance, healthcare, transport, infocomm, media, security and emergency services, and government.
The owner of a designated system is the CII owner. Designation is made by written notice, so an organisation knows if it is a CII owner. Designated owners must, among other things, comply with codes of practice and standards, conduct regular audits and risk assessments, take part in cybersecurity exercises and report prescribed incidents, and they must notify CSA of material changes to the design, configuration or ownership of the CII. The harder question since the amendments is whether an organisation is affected indirectly, as a provider, supplier or interconnected system.
| Class | Who it covers | Core obligations | Intensity |
|---|---|---|---|
| CII owners | Owners of designated systems necessary for essential services | Codes of practice, audits, risk assessments, exercises, incident reporting | Highest |
| Essential service providers using third-party-owned CII | Providers whose CII is owned by a third party, including cloud-hosted | Secure CII-equivalent protections from the owner by contract or binding commitment | High, through contract |
| Systems of Temporary Cybersecurity Concern | Systems at heightened risk for a limited period, such as election or vaccine distribution systems | Cybersecurity measures and incident reporting during designation | High, time-limited |
| Entities of Special Cybersecurity Interest | Entities holding sensitive information or performing functions of national interest | Standards and codes set or approved by CSA; prescribed incident reporting | Lighter than CII |
| Major foundational digital infrastructure providers | Large cloud computing and data centre facility providers | Cybersecurity codes or standards; prescribed incident reporting | Lighter than CII |
| Licensed cybersecurity service providers | Providers of licensable services such as penetration testing and managed security operations monitoring | Licence conditions; records available for CSA inspection | Licence-based |
CSA's announcement of the 31 October 2025 commencement concerned the CII and temporary-concern provisions. Organisations that may fall within the newer classes should check the current commencement position and any CSA designation or consultation that applies to them, rather than assume the duties are already live or not yet relevant.
Cloud-hosted and provider-owned CII
The most significant structural change is that the Cybersecurity Act in Singapore now recognises that essential services increasingly run on systems the CII owner does not own. CSA can designate virtual computers and systems as CII, and the amendments allow systems located wholly outside Singapore to be regulated where they are necessary for an essential service in Singapore and would qualify as CII if located here.
Where an essential service provider relies on CII owned by a third party, the provider remains responsible for the cybersecurity of that system. It must obtain, by contract or other binding commitment, protections from the system owner that allow it to meet CII-level obligations. The cloud provider is not directly regulated under that part; the essential service provider carries the duty and must secure it through its contracts.
In practice, owners should expect to need, at a minimum: a right to receive security information and audit results; incident notification fast enough to support CSA reporting; cooperation with CSA inspections and directions; clarity on where data and workloads sit; and change-control rights over material modifications to the hosted environment. Where a hyperscale provider will not negotiate bespoke terms, owners should document how its standard assurances and the forthcoming cloud companion guides meet each requirement.
This makes the cloud contract a regulatory document. Our cloud and outsourcing team regularly reviews these terms for audit rights, incident notification, data location and cooperation with CSA.
Incident reporting: what changed and how fast
Incident reporting is where the amended Cybersecurity Act in Singapore bites hardest day to day. In addition to incidents affecting the CII itself, CII owners must now report incidents suspected of being caused by advanced persistent threats, and incidents that disrupt the essential service on other systems under the owner's control even if they are not interconnected with the CII. The amendments also extend reporting to incidents in supplier systems that connect to or communicate with the CII.
CSA has confirmed that these reports must be made within two hours of the CII owner becoming aware of the occurrence. That window leaves no time to convene a committee. Owners need pre-agreed triggers, named reporters available around the clock and suppliers contractually obliged to escalate immediately. Our cybersecurity and incident response practice builds these playbooks with clients.
- Detect and log. Record the time the organisation becomes aware of a potential reportable incident; this starts the clock.
- Triage against triggers. Check pre-agreed criteria: CII affected, suspected advanced persistent threat, essential-service disruption on other owned systems, or supplier incident affecting connected systems.
- Report to CSA. Submit the initial report within the prescribed window using CSA's channel, even if facts are incomplete.
- Coordinate other notifications. Assess parallel duties, such as PDPA breach notification and sector regulators; see our guide to data breach response.
- Investigate and update. Provide follow-up information as required and preserve evidence.
- Review and remediate. Fix root causes, update risk assessments and test the lessons in the next exercise.
Check whether your supplier contracts are faster than your reporting duty. If a managed service provider has twenty-four hours to tell you about an incident on a system connected to your CII, you cannot meet a two-hour reporting window.
The updated Code of Practice and board accountability
On 22 July 2026 CSA announced an update to the Cybersecurity Code of Practice for CII, last revised in 2022, to address advanced persistent threats and AI-enabled attacks, together with a new Code of Practice for cloud services covering CII hosted in the cloud. Both were expected in the later part of 2026, and CSA worked with major cloud providers on companion guides showing how cloud controls can be implemented in each provider's environment.
The announced changes place cybersecurity squarely on the board agenda. Boards will be expected to maintain a documented cyber resilience framework covering risk tolerance, mitigation, transfer and recovery, reviewed at least annually. CII owners will need Cyber Trust Mark Level 5 certification, oversight of interconnected systems that communicate with CII, a comprehensive cybersecurity exercise plan and stronger network architecture management, monitoring and detection.
Effective dates and transition arrangements should be confirmed against the final codes when published.
What boards should do before the code lands
Boards of CII owners do not need to wait for the final text to start. Under the Cybersecurity Act in Singapore, the direction is clear enough to act on: agree who owns the cyber resilience framework, set a risk tolerance statement the board can actually use, and decide how residual risk will be transferred, for example through insurance or contracts. Management should map the gap between current controls and Cyber Trust Mark Level 5, and budget for the work.
Directors should also ask for a list of interconnected systems that communicate with CII, including those run by suppliers and group companies, because oversight of those systems is one of the announced requirements and is often the least documented part of the estate.
New duties for cloud and foundational digital infrastructure
The amendments introduced a class of major foundational digital infrastructure providers, initially aimed at large cloud computing and data centre facility services, with lighter-touch duties to follow CSA-issued or approved codes and standards and to report prescribed incidents. In September 2026 the Government introduced the Digital Infrastructure Bill, passed on 7 October 2026, which creates IMDA licensing for major data centres and cloud providers and includes related amendments to the Cybersecurity Act.
The Ministry of Digital Development and Information and IMDA have said they will streamline requirements under the two laws, and reporting is expected to be coordinated so that providers are not reporting the same event twice in different formats. Our separate note on Digital Infrastructure Act licensing explains the licensing thresholds.
For a CII owner, the practical effect is positive: its largest cloud and data centre providers will increasingly be under direct regulatory obligations of their own, which should make it easier to obtain the security information and incident notifications that the owner needs. It does not, however, shift the owner's own duties onto the provider.
Enforcement and penalties
Before the amendments, non-compliance with CII obligations was enforced mainly through criminal penalties. The amended Cybersecurity Act in Singapore adds a civil penalty route: the Commissioner may, with the Public Prosecutor's consent, apply to court for a civil penalty, with CSA weighing the risk created, how egregious the conduct was and the facts of the case. CSA can also inspect a CII where an owner appears non-compliant or has given false or incomplete information.
Maximum amounts are set out in the Act and differ by obligation. Rather than rely on summaries, boards should have the current figures confirmed against the amending Bill and the consolidated Act when assessing exposure.
Illustrative scenario: a hospital group moves to the cloud
This scenario is illustrative only and uses generic parties. A designated CII owner in healthcare migrates its patient administration system to a public cloud platform. The system remains essential to its service.
The owner updates its cloud contract to secure audit rights, prompt incident notification, cooperation with CSA and alignment with the forthcoming cloud code of practice. It maps every system that communicates with the CII, including a third-party appointment-booking service, and requires that supplier to notify it immediately of incidents.
When the booking supplier detects suspicious activity late one evening, the supplier escalates within minutes, the owner's duty officer assesses the trigger criteria and a report is made to CSA within the window. The board's annual review of the resilience framework later records the incident and the improvements made.
Risks and common mistakes
Assuming cloud hosting moves the duty to the provider
The amendments keep responsibility with the essential service provider. If the cloud contract does not give the owner the information, audit and cooperation rights needed to meet CII obligations, the owner is exposed. Standard cloud terms rarely provide this by default, so negotiation or an addendum is usually needed.
Missing reportable incidents outside the CII boundary
Incidents on non-interconnected systems that disrupt the essential service, suspected advanced persistent threat activity and supplier incidents can all be reportable. Security teams used to a narrow CII perimeter may not escalate them. Update triage criteria and train the people who make the first call.
Leaving cybersecurity to the CISO alone
The updated code of practice places explicit expectations on boards and senior management, including an annually reviewed cyber resilience framework. Directors should receive regular reporting, approve risk tolerance and record their review. Delegation without oversight will be hard to defend after a serious incident.
Using unlicensed cybersecurity service providers
Certain services, such as penetration testing and managed security operations monitoring, require a licence to be provided in Singapore. Engaging an unlicensed provider can create problems for both parties. Check licence status during procurement, alongside the PDPA and confidentiality terms the engagement needs.
Cross-border angle and what to do now
Regional groups often run security operations, cloud tenancies and suppliers from outside Singapore. The Cybersecurity Act in Singapore does not allow CSA to enforce outside Singapore, but it does expect the Singapore CII owner to secure equivalent protection wherever the system sits. Group contracts and intra-group service agreements should reflect that. We coordinate with counsel in Bangladesh, the UK, the UAE and China where group arrangements span those markets.
- Confirm which of your systems are designated, and which third-party systems support them.
- Update incident triage to cover the expanded categories and the two-hour window.
- Align supplier and cloud contracts with reporting, audit and cooperation needs.
- Prepare for the updated code: board framework, Cyber Trust Mark Level 5, exercise plan.
- Check whether the Digital Infrastructure Bill or the newer classes affect your group.
Further detail is available from the CSA announcement on the 31 October 2025 commencement. To review your position under the Cybersecurity Act in Singapore, please contact TRW & Co. Where Singapore court representation is required, we work alongside Singapore-qualified counsel.
Frequently asked questions
01How do I know if my organisation is a CII owner in Singapore?
CII status is not self-assessed. The Commissioner of Cybersecurity designates a computer or computer system as CII by written notice where it is necessary for the continuous delivery of an essential service. If you have not received a designation notice, you are not a CII owner, but you may still be affected as a supplier, a provider hosting CII, an interconnected system owner, or under the newer classes such as foundational digital infrastructure.
02What is the incident reporting deadline under the Cybersecurity Act?
For the incident types added by the amendments, including incidents suspected of being caused by advanced persistent threats and incidents disrupting the essential service on other systems under the CII owner's control, CSA has confirmed that reports must be made within two hours of becoming aware of the occurrence. Owners should build triage criteria, on-call reporting arrangements and supplier escalation duties that make this window achievable.
03Does the Cybersecurity Act apply to cloud service providers?
In several ways. Where CII is hosted by a cloud provider, the essential service provider must obtain CII-equivalent protections from it by contract. The amendments also introduced a class of major foundational digital infrastructure providers, initially aimed at large cloud and data centre services, with lighter duties. Separately, the Digital Infrastructure Bill creates IMDA licensing for major cloud providers meeting revenue thresholds.
04What penalties apply for breaching CII obligations?
Breaches can lead to criminal penalties and, following the amendments, civil penalties sought by the Commissioner through the court with the Public Prosecutor's consent. CSA considers the risk created, the seriousness of the conduct and the circumstances. Maximum amounts differ by obligation and should be checked against the current Act. CSA can also inspect CII where an owner appears non-compliant.
05What will the updated CII Code of Practice require?
CSA has announced that CII owners will need to strengthen board and senior management accountability, including a documented cyber resilience framework reviewed at least annually, attain Cyber Trust Mark Level 5 certification, oversee interconnected systems, maintain a comprehensive exercise plan and improve network architecture management and detection. A separate code of practice for cloud services will cover CII hosted in the cloud.
06Do we need a licence to provide penetration testing in Singapore?
Yes. Penetration testing and managed security operations centre monitoring are licensable cybersecurity services under the Cybersecurity Act, and providers offering them in Singapore need a licence from CSA's licensing office. Organisations engaging these services should check that the provider is licensed, and licensed providers must keep records that CSA may inspect.
Sources and official materials
- CSA: Provisions in the Cybersecurity (Amendment) Act to come into force on 31 October 2025 — Provider-owned CII, two-hour reporting and temporary-concern systems
- CSA: Cybersecurity Code of Practice for CII to be updated — Board accountability, Cyber Trust Mark Level 5 and cloud code
- Cybersecurity Act 2018 (Singapore Statutes Online) — Consolidated legislation
- Cybersecurity (Amendment) Bill (Bill No. 15/2024) — Text of the 2024 amendments
- MDDI: New Digital Infrastructure Bill — Licensing of major data centres and cloud providers
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
