What evidence should you keep for Singapore's Cybersecurity Act?

Which evidence you need depends on how the Cybersecurity Act classifies you. The Cyber Security Agency of Singapore (CSA) names several regulated groups: owners of Critical Information Infrastructure, entities of special cybersecurity interest, foundational digital infrastructure providers and licensed service providers. Identify your group first, then keep dated records for its duties.

Which groups does the Act regulate?

CSA's page lists the Act's objectives and the groups it reaches.

• Critical Information Infrastructure (CII) owners. CII is computer systems directly involved in providing essential services. The CII sectors are Energy, Water, Banking and Finance, Healthcare, Transport (land, maritime and aviation), Infocomm, Media, Security and Emergency Services, and Government. The 2024 amendments say owners remain responsible for the cybersecurity and cyber resilience of the CII even when they use cloud computing, and must report more types of incidents, such as those in their supply chains.
• Systems of Temporary Cybersecurity Concern (STCCs). Higher-risk systems because of temporary events or situations.
• Entities of Special Cybersecurity Interest (ESCI). Entities that hold sensitive information or perform a function of national interest.
• Foundational Digital Infrastructure (FDI). Providers of foundational digital services such as cloud providers and data centres, who must follow cybersecurity codes and standards of practice and report prescribed incidents.
• Licensed providers. CSA licenses two types of service provider: penetration testing and managed security operations centre monitoring.

CSA also describes the Commissioner of Cybersecurity's power to investigate threats and incidents, and a framework for sharing cybersecurity information.

What is a sensible evidence structure?

We could not fetch the Act or the codes of practice for this post, so we do not list exact statutory deadlines or audit frequencies. Read the Cybersecurity Act on Singapore Statutes Online, and the relevant code of practice, and add those dates to this structure. The structure itself follows the duties CSA names.

Build one folder per duty:

1. Scope and designation. Your sector, the systems in scope, and any notice you received. Without this nothing else is anchored.
2. Ownership. For each system in scope, the owner, the operator and any cloud or third party involved. The amendments make cloud use no excuse, so keep the contract and the responsibility split.
3. Protection. Policies, risk assessments, test reports and remediation records for those systems.
4. Supply chain. An inventory of software and service suppliers for in-scope systems and the way you would learn about an incident at one of them.
5. Incident handling. The procedure, the contact list, drill records, and a log of incidents with what you reported and when.
6. Information requests. A log of any request from CSA and your response.
7. Licensing. If you provide penetration testing or managed SOC monitoring, your licence and the records the licensing terms require.

Constructed example: a hospital group owns a CII scheduling system hosted by a cloud provider and built on a vendor's scheduling software. The evidence folder holds the system description, the cloud contract section on incident notice, the vendor list with component versions, and the last drill report. When the vendor reports a breach, the group can show how it learned about it and what it did.

How do you prove supply chain control?

Because incidents in supply chains are called out by CSA, show a live inventory. A software bill of materials per in-scope system, with a date, is concrete evidence of what the system contains. Pair it with a record of how you receive supplier vulnerability notices.

What to do

1. Decide which group you fall in, and write down the basis.
2. Obtain the Act and the applicable code of practice, and extract the exact duties and time limits.
3. Create the seven evidence folders above, one per duty.
4. Assign an owner to each folder.
5. Generate an SBOM for every in-scope system and refresh it on release.
6. Run an incident drill and keep the report.
7. Review the folders each quarter and note gaps with dates.

Safeguard SBOM generation, dependency scanning and compliance automation can help keep the supply chain and evidence records current. They do not determine your classification or certify compliance.

Quick check

Sources

• Cybersecurity Act, Cyber Security Agency of Singapore, page last updated 16 July 2026, fetched 18 October 2026

Last reviewed: 18 October 2026.