Policy Briefing — Singapore Consults on Cybersecurity (Amendment) Bill

Executive briefing: On 8 April 2024 the Cyber Security Agency of Singapore (CSA) opened a public consultation on the proposed Cybersecurity (Amendment) Bill 2024. The draft bill broadens Singapore’s 2018 Cybersecurity Act beyond Critical Information Infrastructure (CII) owners, empowering the Commissioner to oversee entities of special cybersecurity interest, systems of temporary concern, and key vendors supporting essential services. Organisations providing large-scale digital infrastructure, cloud services, or mission-critical operational technology in Singapore must prepare for direct regulatory obligations once the bill is tabled in Parliament.

Key proposals

Entities of Special Cybersecurity Interest (ESCIs). CSA proposes designating major data centres, cloud service providers, and other foundational digital infrastructure operators as ESCIs, subjecting them to incident reporting, risk management, and compliance audits even if they do not operate CIIs.
Systems of Temporary Cybersecurity Concern. Large-scale events or temporary systems whose disruption could affect national interests would face time-bound duties covering incident reporting, risk assessments, and protection measures.
Supply-chain obligations. CII owners and designated providers must ensure key third parties comply with codes of practice, provide access to logs and facilities, and notify CSA of cybersecurity incidents affecting the essential service.

Implementation timeline

Consultation phase. Feedback on the amendment proposals runs through spring 2024; CSA will refine legislative clauses before introducing the bill in Parliament.
Secondary instruments. Post-enactment, CSA will issue subsidiary legislation defining thresholds for ESCIs, specifying reportable incident timelines, and detailing audit and compliance procedures.
Transition planning. Existing CIIs and prospective ESCIs should expect grace periods but will need to demonstrate roadmap alignment once commencement orders activate the new duties.

Program actions

Scope analysis. Identify Singapore-hosted infrastructure, platforms, and services that meet the proposed ESCI definitions or support essential services to prepare designation dossiers.
Vendor governance. Update contracts with managed service providers and operational technology partners to guarantee log access, security controls, and joint incident reporting aligned with CSA expectations.
Incident readiness. Align detection, response, and notification playbooks with CSA’s proposed reporting timelines so operations and legal teams can file statutory reports without delay.

Sources

Zeph Tech is guiding Singapore operators through ESCI scoping assessments, supplier assurance updates, and consultation responses.