Background

Since the implementation of the CA in 2018, Singapore's business landscape has undergone further digital transformation, with businesses incorporating technological tools such as cloud computing and adopting novel business models that increasingly engage third-party service providers within the supply chain.

Rapid digitalisation thus poses new cyber-threat risks and considerations, which the CAB seeks to address to update and safeguard the security of Singapore's cyberspace.

Key changes in the CAB

1. Expanding the definition of the critical information infrastructure (CII) by introducing a separate category of "non-provider-owned CII"

Currently, the CA regulates CII, which are computers or computer systems that are necessary for the continuous delivery of essential services in Singapore. CII tends to be owned by providers of essential services, but providers have increasingly been engaging vendors to provide computing services, and these computers or infrastructure share the same cybersecurity exposure as CII. The CAB thus proposes to broaden CII-related obligations to encompass situations involving "non-provider-owned CII".

The responsibility for the cybersecurity of the essential service will still rest with the provider of the essential service. The provider of the essential service will be required to, amongst other things, provide the Commissioner with information on non-provider-owned CII and obtain various legally binding commitments from its computing vendor to ensure that the provider of the essential service is able to discharge its duties under the Act.

2. Expanding the scope of incident reporting

Considering the increasing sophistication of threat actors that target innocuous connections to access critical networks, in relation to provider-owned CII, the CAB seeks to impose wider duties on providers to report incidents on any part of the network under the provider's control, or incidents in respect of the network under the control of a supplier to the owner that is interconnected or communicates with the provider-owned CII, as opposed to incidents relating specifically to the provider-owned CII.

The expanded scope of incident reporting aims to bolster the CSA's situational awareness of the risks of disruption to essential services, enabling the CSA to pre-emptively identify and mitigate such threats.

3. Broaden the Commissioner of Cybersecurity's purview beyond CII owners to include three new categories

The CAB proposes to extend the regulatory oversight of the Commissioner to include key systems to Singapore's cyber ecosystem that are not classified as CII.

The three new categories are as follows:

• Foundational Digital Infrastructure services (FDI)
  • Digital infrastructure that promotes the availability, latency, throughput or security of digital services, including those providing cloud computing or data centre facility services.
  • The CSA may designate the provider of an FDI service as a "major FDI service provider" if it is satisfied that (i) the service is provided to or from Singapore, and (ii) any impairment or loss of the FDI service could lead to disruption to a large number of businesses or organisations that rely on or are enabled by the FDI service.
• Entities of Special Cybersecurity Interest (ESCI)
  • Entities that handle sensitive data or perform critical functions for Singapore which, if disrupted, are expected to result in significant detriment to the defence, foreign relations, economy, public health, public safety or public order of Singapore.
• Systems of Temporary Cybersecurity Concern (STCC)
  • Computer systems that are temporarily critical to Singapore's interests, but are at high risk of cyber-attacks during this critical period. 
  • The CSA may designate a computer or computer system as an STCC for a period of up to one year if it is satisfied that the risk of cyberattack is high and that compromise or loss of the STCC will result in a significant detriment on national security, defence, foreign relations, economy, public health, public safety or public order of Singapore.

The three categories of FDI services, ESCI and STCC will be subject to several duties, which include the provision of cybersecurity-related information to the CSA and notification of the CSA of any prescribed cybersecurity incidents. Further, these systems are to be subject to further incident reporting requirements and applicable cybersecurity standards.

Non-compliance with obligations concerning FDI services and ESCI may result in financial penalties, while non-compliance relating to STCC is proposed to amount to an offence.

4. Strengthen Licensing Officers' powers

Under Part 5 of the present CA, persons engaging in the business of providing licensable cybersecurity services (e.g., penetration testing) must obtain a cybersecurity service provider's licence, and the terms and grant of the licence are determined by licensing officers. The CAB will amend the CA to confer licensing officers with monitoring powers, such as powers to enter, inspect and examine licensees' place of business and records.

Key takeaways

The proposed amendments to the CA seek to keep pace with developments in technology and industry practices, as well as the consequential increase of cybersecurity challenges. Operators of cloud services and data centres may also need to evaluate the impact of obligations outlined in the CAB. Businesses will need to remain alert to future developments and adopt a flexible attitude in operationalising necessary changes. Finally, as alluded to in the CAB, the CSA is likely to provide further clarity through the publication of additional codes of conduct and guidelines.

* * * * *

© 2024 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.