Singapore's Cybersecurity Act sets up national oversight with four jobs: protect critical information infrastructure, let the Cyber Security Agency respond to incidents, enable information sharing, and license certain security service providers. A 2024 amendment added incident reporting through supply chains and new regulated classes, including cloud providers and data centres.
Who does the Act regulate?
The Cyber Security Agency of Singapore (CSA) explains the Act in four objectives. It is easiest to read them as four groups of people.
Owners of critical information infrastructure (CII). CII is computer systems directly involved in providing essential services. CSA lists the sectors: energy, water, banking and finance, healthcare, transport (land, maritime and aviation), infocomm, media, security and emergency services, and government. The Act provides a framework for designating CII and gives owners clarity on their duty to protect it. The Commissioner of Cybersecurity issues codes of practice or standards of performance to regulate CII owners, and CSA's list shows a Cybersecurity Code of Practice for Critical Information Infrastructure 2026 dated 29 July 2026.
The authorities. The Act empowers the Commissioner to investigate cybersecurity threats and incidents, with powers calibrated to the severity of the threat and the measures needed.
Anyone asked for information. The Act provides a framework for CSA to request information and for protecting and sharing it.
Service providers. CSA says it takes a light-touch approach and licenses only two types of provider at present: penetration testing and managed security operations centre monitoring. Their reason is that such providers access sensitive client information.
What changed with the amendments?
Parliament passed amendments in May 2024. CSA describes these changes.
- CII owners stay responsible even when they use cloud or other new models, and they must report more types of incidents, such as those happening in their supply chains.
- Systems of Temporary Cybersecurity Concern (STCCs) are computer systems that carry higher risk because of temporary events or situations, which CSA can proactively secure.
- Entities of Special Cybersecurity Interest (ESCI) can be designated and regulated if they hold sensitive information or perform a function of national interest.
- Foundational Digital Infrastructure (FDI) providers, such as cloud service providers and data centres, are regulated, must follow cybersecurity codes and standards of practice, and must report prescribed incidents.
CSA's page was last updated on 16 July 2026. The statute itself is on Singapore Statutes Online, and its explanatory statement and the amendment bill are linked from CSA's page.
What does it mean for a software company?
Most software companies are not CII owners. The effect reaches you in three ways.
First, if you sell to a CII owner, expect contract clauses and questionnaires. The supply chain incident reporting change means your customer may need to know quickly when something at your end affects their CII. Make sure your contract names a contact and a timeline you can meet.
Second, if you provide cloud or hosting services that become designated FDI, you would be regulated directly. Check CSA's current designations.
Third, if you offer penetration testing or managed security monitoring in Singapore, check whether the licensing framework applies to you.
A constructed example
A software vendor hosts a patient scheduling product used by a hospital group. The hospital's CII owner asks the vendor to notify within a fixed number of hours of any incident touching the service, and to name an on-call contact. The vendor adds a clause, sets up an alerting rota, and runs a drill where a fictional vulnerability in a dependency is reported at midnight. The drill shows the notification path takes six hours, so they shorten it before signing.
What to do
- Find out whether any of your customers are CII owners or designated entities in Singapore.
- Read the Act on Singapore Statutes Online and the Code of Practice that applies to your customers.
- Add an incident notification contact and timeline to contracts, and test it.
- Keep an up-to-date inventory of the components and services in your product, so you can say quickly whether an incident affects a customer.
- Check whether you could be treated as a provider that falls under licensing.
- Review CSA announcements for new designations.
- Ask your lawyer in Singapore about duties specific to your situation.
Safeguard dependency inventory and compliance automation can help you answer customer questions about components and controls. Nothing in this post is legal advice, and Safeguard does not certify compliance.
Quick check
Does the Cybersecurity Act apply to every company in Singapore?
No. It targets CII owners, designated entities and systems, foundational digital infrastructure providers and licensed service providers, plus information requests and CSA's response powers.
Which two services need a licence?
Penetration testing and managed security operations centre monitoring, according to CSA.
Sources
Last reviewed: 18 October 2026.
