Singapore's Cybersecurity Act places legal duties on owners of designated critical information infrastructure, not on most software vendors directly. A vendor feels it through customer contracts, supply chain incident reporting and, in a few cases, licensing. Prepare by knowing which customers are covered and what evidence they will ask for.
This is a summary of public material from the Cyber Security Agency of Singapore (CSA), not legal advice.
Who does the Act apply to?
The Act sets a process for designating critical information infrastructure (CII): computer systems that essential services depend on, in sectors such as energy, water, banking and finance, healthcare, transport and government. CII owners must protect these systems. The Commissioner of Cybersecurity can investigate threats and incidents, with powers scaled to severity.
The Act also licenses cybersecurity service providers. According to CSA, licensing currently covers only penetration testing and managed security operations centre monitoring. If you sell either, read the licensing rules before you sell in Singapore.
What changed in 2024?
CSA says amendments were passed in Parliament in May 2024. They keep CII owners responsible even when they adopt models such as cloud computing, and require them to report more incident types, including incidents in their supply chains. They also add three categories:
- Systems of Temporary Cybersecurity Concern, higher-risk systems tied to temporary events.
- Entities of Special Cybersecurity Interest, entities that hold sensitive information or perform a function of national interest.
- Foundational Digital Infrastructure, such as cloud and data centre operators, which must follow codes and standards of practice and report prescribed incidents.
If you host or operate infrastructure that others depend on, the third category may reach you directly. Check CSA's current pages for the status of each provision, since parts of an amended Act come into force at different times.
How does it reach a software vendor in practice?
Through the customer. A bank that owns CII wants to know which of your components run in its environment, how fast you tell it about a vulnerability or breach, and whether you patch within a stated time. Your contract becomes the place where a statutory duty turns into a requirement for you.
Constructed example: a vendor supplies a reporting library embedded in a CII owner's trading platform. A flaw is found in one of the library's dependencies. The owner has to decide whether this is a reportable supply chain incident and needs facts from the vendor within hours. A vendor with a current component inventory answers in minutes. One without it takes days.
Steps to prepare
- Ask customers in covered sectors whether they are CII owners or work with them, and what clauses they plan to add.
- Keep a current software bill of materials for each product you ship into those accounts.
- Define what you consider a security incident, who decides, and how fast you notify customers.
- Set patch timelines by severity and write them into your documentation.
- Keep evidence of testing, access control and change management in one place.
- Read CSA's codes of practice for the infrastructure types you serve.
- If you offer penetration testing or managed monitoring, confirm your licensing position.
Where Safeguard fits
Safeguard produces SBOMs and scans dependencies, which helps with steps two and four. It does not make you compliant with the Act, and nothing here claims it does.
Quick check
Is my SaaS company regulated directly by the Act?
Usually not, unless you provide designated infrastructure, fall into a new category such as foundational digital infrastructure, or sell licensable services. Ask counsel and check CSA.
Why would a customer ask me about supply chain incidents?
CSA says the 2024 amendments require CII owners to report more incident types, including those in their supply chains, so they need quick facts from suppliers.
Sources
- Cyber Security Agency of Singapore, Cybersecurity Act
- Singapore Statutes Online, Cybersecurity Act 2018
Last reviewed: 18 October 2026.
