In more detail
At the Committee of Supply 2024, MCI announced that the Taskforce is studying the introduction of the DIA. The Taskforce is led by MCI and comprises members from Smart Nation Group, Cyber Security Agency of Singapore, Info-communications Media Development Authority, and Government Technology Agency.
The CS Act governs the cybersecurity and resilience of critical information infrastructure (CII), which are computers or computer systems necessary for the continuous delivery of essential services. However, MCI notes that recent technological disruptions, such as a four-hour-long data center outage on 14 October 2023, was not a result of cyberattacks. Nonetheless, the impact on consumers was significant as it caused widespread disruption of banking services by several major banks in Singapore.
The DIA is intended to complement the government's other regulatory levers. It addresses issues and risks beyond cybersecurity to cover a broader range of resilience risks faced by digital infrastructure and service providers (e.g., misconfigurations in technical architecture, fires, water leaks, cooling system failures, etc.). The Taskforce has stated that it intends to draw inspiration from similar legislation from the European Union, Australia and Germany in drafting the DIA, so incident reporting requirements and requirements to comply with baseline resilience and security standards are to be expected.
The Taskforce is still in the process of identifying the entities that will be subject to the DIA and formulating the requirements that regulated entities will be subject to. This entails studying the ecosystem in Singapore to identify digital infrastructures that would systemically impact Singapore’s economy and society if disrupted. Examples provided in the press release by MCI on 1 March 2024 include data centers and cloud services, as well as services that support the delivery of many widely-used digital services (e.g., banking and payments, ride-hailing, and digital identities). Significantly, these digital services are outside the scope of the CS Act.
Separately, we flag that the MCI has also proposed amendments to the CS Act, which were released for public consultation earlier this year. As part of the amendments, the scope of the CS Act will be expanded beyond CII to regulate foundational digital infrastructure (e.g., cloud service providers and data centers) and key entities that hold sensitive data and perform important public functions. For more information, refer to our earlier client alert dated 14 March 2024. The DIA will be drafted to complement the amended CS Act.
* * * * *
We will continue to monitor these developments as details are released to assess how it may affect you. In particular, digital services providers that provide banking and payments, ride-hailing or digital identity services would be well advised to pay close attention to this space.
© 2024 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
