§ 4 — Appointment of Commissioner of Cybersecurity and other officers

4.—(1) The Minister may appoint, from public officers or employees of a statutory body under the charge of the Minister —(a)

a Commissioner of Cybersecurity; and

(b)

a Deputy Commissioner and one or more Assistant Commissioners of Cybersecurity, to assist the Commissioner in the discharge of the Commissioner’s duties and functions.

(2) The Minister may appoint as an Assistant Commissioner under subsection (1)(b) in respect of a provider‑owned critical information infrastructure or a system of temporary cybersecurity concern —(a)

a public officer of another Ministry; or

(b)

an employee of a statutory body under the charge of another Minister,

where that other Ministry or statutory body has supervisory or regulatory responsibility over an industry or a sector to which the owner of the provider‑owned critical information infrastructure or the system of temporary cybersecurity concern (as the case may be) belongs.

[Act 19 of 2024 wef 31/10/2025]

(2A) The Minister may appoint as an Assistant Commissioner under subsection (1)(b) in respect of a designated provider responsible for third‑party‑owned critical information infrastructure, an entity of special cybersecurity interest or a major foundational digital infrastructure service provider —(a)

a public officer of another Ministry; or

(b)

an employee of a statutory body under the charge of another Minister,

where that other Ministry or statutory body has supervisory or regulatory responsibility over an industry or a sector to which the designated provider responsible for third‑party‑owned critical information infrastructure, entity of special cybersecurity interest or major foundational digital infrastructure service provider (as the case may be) belongs.

[Act 19 of 2024 wef 31/10/2025]

(3) The Commissioner may in writing appoint such number of public officers as cybersecurity officers as the Commissioner thinks necessary for carrying this Act into effect.

(4) Subject to any general or special directions of the Minister, the Commissioner is responsible for the administration of this Act, and has and may perform such duties and functions as are imposed, and exercise such powers as are conferred, upon the Commissioner by this Act.

(5) The Deputy Commissioner has and may exercise all the powers, duties and functions of the Commissioner except those exercisable under section 7, 9, 9A, 16A, 16C, 16D, 17, 17B, 17C, 18, 18B, 18C, 18G, 18I or 18J.[Act 19 of 2024 wef 31/10/2025]

(6) Subject to such conditions or limitations as the Commissioner may specify, an Assistant Commissioner or a cybersecurity officer has and may exercise all the powers, duties and functions of the Commissioner as may be delegated to that Assistant Commissioner or cybersecurity officer in writing, except —(a)

in the case of an Assistant Commissioner, those powers, duties or functions exercisable under this subsection, or section 6, 7, 9, 9A, 16A, 16C, 16D, 17, 17B, 17C, 18, 18B, 18C, 18G, 18I, 18J, 20(5), 37A or 37C; and[Act 19 of 2024 wef 31/10/2025]

(b)

in the case of a cybersecurity officer, those powers, duties or functions exercisable under this subsection, or section 6, 6A, 7, 9, 9A, 12, 16A, 16C, 16D, 16G, 17, 17B, 17C, 17E, 18, 18B, 18C, 18E, 18G, 18I, 18J, 18L, 20(5), 35A, 37A or 37C.[Act 19 of 2024 wef 31/10/2025]

—(1) The Minister may appoint, from public officers or employees of a statutory body under the charge of the Minister —(a)

a Commissioner of Cybersecurity; and

(b)

a Deputy Commissioner and one or more Assistant Commissioners of Cybersecurity, to assist the Commissioner in the discharge of the Commissioner’s duties and functions.

(2) The Minister may appoint as an Assistant Commissioner under subsection (1)(b) in respect of a provider‑owned critical information infrastructure or a system of temporary cybersecurity concern —(a)

a public officer of another Ministry; or

(b)

an employee of a statutory body under the charge of another Minister,

where that other Ministry or statutory body has supervisory or regulatory responsibility over an industry or a sector to which the owner of the provider‑owned critical information infrastructure or the system of temporary cybersecurity concern (as the case may be) belongs.

[Act 19 of 2024 wef 31/10/2025]

(2A) The Minister may appoint as an Assistant Commissioner under subsection (1)(b) in respect of a designated provider responsible for third‑party‑owned critical information infrastructure, an entity of special cybersecurity interest or a major foundational digital infrastructure service provider —(a)

a public officer of another Ministry; or

(b)

an employee of a statutory body under the charge of another Minister,

where that other Ministry or statutory body has supervisory or regulatory responsibility over an industry or a sector to which the designated provider responsible for third‑party‑owned critical information infrastructure, entity of special cybersecurity interest or major foundational digital infrastructure service provider (as the case may be) belongs.

[Act 19 of 2024 wef 31/10/2025]

(3) The Commissioner may in writing appoint such number of public officers as cybersecurity officers as the Commissioner thinks necessary for carrying this Act into effect.

(4) Subject to any general or special directions of the Minister, the Commissioner is responsible for the administration of this Act, and has and may perform such duties and functions as are imposed, and exercise such powers as are conferred, upon the Commissioner by this Act.

(5) The Deputy Commissioner has and may exercise all the powers, duties and functions of the Commissioner except those exercisable under section 7, 9, 9A, 16A, 16C, 16D, 17, 17B, 17C, 18, 18B, 18C, 18G, 18I or 18J.[Act 19 of 2024 wef 31/10/2025]

(6) Subject to such conditions or limitations as the Commissioner may specify, an Assistant Commissioner or a cybersecurity officer has and may exercise all the powers, duties and functions of the Commissioner as may be delegated to that Assistant Commissioner or cybersecurity officer in writing, except —(a)

in the case of an Assistant Commissioner, those powers, duties or functions exercisable under this subsection, or section 6, 7, 9, 9A, 16A, 16C, 16D, 17, 17B, 17C, 18, 18B, 18C, 18G, 18I, 18J, 20(5), 37A or 37C; and[Act 19 of 2024 wef 31/10/2025]

(b)

in the case of a cybersecurity officer, those powers, duties or functions exercisable under this subsection, or section 6, 6A, 7, 9, 9A, 12, 16A, 16C, 16D, 16G, 17, 17B, 17C, 17E, 18, 18B, 18C, 18E, 18G, 18I, 18J, 18L, 20(5), 35A, 37A or 37C.[Act 19 of 2024 wef 31/10/2025]