Designation of provider-owned critical information infrastructure
Open ↗7.—(1) The Commissioner may, by written notice to the owner of a computer or computer system, designate the computer or computer system as a provider-owned critical information infrastructure for the purposes of this Act, if the Commissioner is satisfied that —(a)
the computer or computer system is necessary for the continuous delivery of an essential service, and the loss or compromise of the computer or computer system will have a debilitating effect on the availability of the essential service in Singapore; and
(b)
the computer or computer system is located wholly or partly in Singapore.[Act 19 of 2024 wef 31/10/2025]
(1A) The Commissioner may, by written notice to the owner of a computer or computer system that is located wholly outside Singapore, designate the computer or computer system as a provider‑owned critical information infrastructure for the purposes of this Act, if the Commissioner is satisfied that —(a)
the computer or computer system is necessary for the continuous delivery of an essential service, and the loss or compromise of the computer or computer system will have a debilitating effect on the availability of the essential service in Singapore; and
(b)
the computer or computer system would have been designated as a provider‑owned critical information infrastructure under subsection (1) had it been located wholly or partly in Singapore.[Act 19 of 2024 wef 31/10/2025]
(2) A notice issued under subsection (1) or (1A) must —(a)
identify the computer or computer system that is being designated as a provider-owned critical information infrastructure;[Act 19 of 2024 wef 31/10/2025]
(b)
identify the owner of the computer or computer system so designated as a provider-owned critical information infrastructure;[Act 19 of 2024 wef 31/10/2025]
(c)
inform the owner of the computer or computer system, regarding the owner’s duties and responsibilities under this Act that arise from the designation;
(d)
provide the name and contact particulars of the officer assigned by the Commissioner to supervise the provider-owned critical information infrastructure in relation to its cybersecurity;[Act 19 of 2024 wef 31/10/2025]
(e)
inform the owner of the computer or computer system that any representations against the designation are to be made to the Commissioner by a specified date, being a date not earlier than 14 days after the date of the notice; and
(f)
inform the owner of the computer or computer system that the owner may appeal to the Minister against the designation, and provide information on the applicable procedure.[Act 19 of 2024 wef 31/10/2025]
(3) Any designation under subsection (1) or (1A) has effect for a period of 5 years, unless it is withdrawn by the Commissioner before the expiry of the period.[Act 19 of 2024 wef 31/10/2025]
(4) The person who receives a notice under subsection (1) or (1A) may request the Commissioner to proceed under subsection (5) upon showing proof that —(a)
the person is not able to comply with the requirements in this Part for the reason that the person has neither effective control over the operations of the computer or computer system, nor the ability or right to carry out changes to the computer or computer system; and
(b)
another person has effective control over the operations of the computer or computer system and the ability and right to carry out changes to the computer or computer system.[Act 19 of 2024 wef 31/10/2025]
(5) If the Commissioner is satisfied that the conditions mentioned in subsection (4)(a) and (b) are met, the Commissioner may amend the notice issued to the person under subsection (1) or (1A), and address and send that amended notice to the person mentioned in subsection (4)(b).[Act 19 of 2024 wef 31/10/2025]
(6) During the period when a notice amended under subsection (5) is in effect, the provisions of this Part apply to the person mentioned in subsection (4)(b) as if every reference to the owner of a provider-owned critical information infrastructure is a reference to the person mentioned in subsection (4)(b).[Act 19 of 2024 wef 31/10/2025]
(7) Where —(a)
a notice issued under this section and amended under subsection (5) is addressed and sent to the person mentioned in subsection (4)(b); and
(b)
the person mentioned in subsection (4)(b) then ceases to have the control, ability and right mentioned in that provision,
the owner of the provider-owned critical information infrastructure must notify the Commissioner of this without delay.
[Act 19 of 2024 wef 31/10/2025]
(8) Where a provider-owned critical information infrastructure is owned by the Government and operated by a Ministry, the Permanent Secretary allocated to the Ministry who has responsibility for the provider-owned critical information infrastructure is treated as the owner of the provider-owned critical information infrastructure for the purposes of this Act.[Act 19 of 2024 wef 31/10/2025]
(9) A notice issued under this section need not be published in the Gazette.[Act 19 of 2024 wef 31/10/2025]
Power to obtain information to ascertain if criteria for provider‑owned critical information infrastructure fulfilled
Open ↗8.—(1) This section applies where the Commissioner has reason to believe that a computer or computer system may fulfil the criteria to be designated as a provider-owned critical information infrastructure.[Act 19 of 2024 wef 31/10/2025]
(2) The Commissioner may, by notice given in the prescribed form and manner, require any person who appears to be exercising control over the computer or computer system, to provide to the Commissioner, within a reasonable period specified in the notice, such relevant information relating to that computer or computer system as may be required by the Commissioner for the purpose of ascertaining whether the computer or computer system fulfils the criteria to be designated as a provider-owned critical information infrastructure.[Act 19 of 2024 wef 31/10/2025]
(3) Without limiting subsection (2), the Commissioner may in the notice require the person who appears to be exercising control over the computer or computer system to provide —(a)
information relating to —(i)
the function that the computer or computer system is employed to serve; and
(ii)
the person or persons who is or are, or other computer or computer systems that is or are, served by that computer or computer system;
(b)
information relating to the design of the computer or computer system; and
(c)
any other information that the Commissioner may require in order to ascertain whether the computer or computer system fulfils the criteria to be designated as a provider-owned critical information infrastructure.[Act 19 of 2024 wef 31/10/2025]
(4) Any person who, without reasonable excuse, fails to comply with a notice issued under subsection (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000 or to imprisonment for a term not exceeding 2 years or to both and, in the case of a continuing offence, to a further fine not exceeding $5,000 for every day or part of a day during which the offence continues after conviction.
(5) Any person to whom a notice is issued under subsection (2) is not obliged to disclose any information that is subject to any right, privilege or immunity conferred, or obligation or limitation imposed, by or under any law, contract or rules of professional conduct in relation to the disclosure of such information.[Act 19 of 2024 wef 31/10/2025]
Withdrawal of designation of provider-owned critical information infrastructure
Open ↗9. The Commissioner may, by written notice, withdraw the designation of any provider-owned critical information infrastructure at any time if the Commissioner is of the opinion that the computer or computer system no longer fulfils the criteria to be designated as a provider-owned critical information infrastructure.[Act 19 of 2024 wef 31/10/2025]
Extension of designation of provider‑owned critical information infrastructure
Open ↗9A.—(1) At any time before the expiry of the designation of a provider‑owned critical information infrastructure, the Commissioner may, by written notice, extend the designation of the provider‑owned critical information infrastructure, if the Commissioner is of the opinion that the computer or computer system continues to fulfil the criteria to be designated as a provider‑owned critical information infrastructure.
(2) Any extension of a designation under subsection (1) has effect for a period of 5 years starting from the expiry of the earlier designation, unless the designation is withdrawn by the Commissioner before the extension takes effect or before the expiry of the period of extension.[Act 19 of 2024 wef 31/10/2025]
Furnishing of information relating to provider-owned critical information infrastructure
Open ↗10.—(1) The Commissioner may by notice given in the prescribed form and manner, require the owner of a provider-owned critical information infrastructure to furnish, within a reasonable period specified in the notice, the following:(a)
information on the design, configuration and security of the provider-owned critical information infrastructure;
(b)
information on the design, configuration and security of any other computer or computer system under the owner’s control that is interconnected with or that communicates with the provider-owned critical information infrastructure;
(c)
information relating to the operation of the provider-owned critical information infrastructure, and of any other computer or computer system under the owner’s control that is interconnected with or that communicates with the provider-owned critical information infrastructure;
(d)
any other information that the Commissioner may require in order to ascertain the level of cybersecurity of the provider-owned critical information infrastructure.[Act 19 of 2024 wef 31/10/2025]
(2) Any owner of a provider-owned critical information infrastructure who, without reasonable excuse, fails to comply with a notice mentioned in subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000 or to imprisonment for a term not exceeding 2 years or to both and, in the case of a continuing offence, to a further fine not exceeding $5,000 for every day or part of a day during which the offence continues after conviction.[Act 19 of 2024 wef 31/10/2025]
(3) The owner of a provider-owned critical information infrastructure to whom a notice is issued under subsection (1) is not obliged to disclose any information that is subject to any right, privilege or immunity conferred, or obligation or limitation imposed, by or under any law or rules of professional conduct in relation to the disclosure of such information, except that the performance of a contractual obligation is not an excuse for not disclosing the information.[Act 19 of 2024 wef 31/10/2025]
(4) The owner of a provider-owned critical information infrastructure is not treated as being in breach of any contractual obligation mentioned in subsection (3) for doing or omitting to do any act, if the act is done or omitted to be done with reasonable care and in good faith and for the purpose of complying with a notice issued under subsection (1).[Act 19 of 2024 wef 31/10/2025]
(5) If a material change is made by or on behalf of the owner of a provider-owned critical information infrastructure to the design, configuration, security or operation of the provider-owned critical information infrastructure after any information has been furnished to the Commissioner pursuant to a notice mentioned in subsection (1), the owner of the provider-owned critical information infrastructure must notify the Commissioner of the change not later than 30 days after the change is made.[Act 19 of 2024 wef 31/10/2025]
(6) For the purposes of subsection (5), a change is a material change if the change affects or may affect the cybersecurity of the provider-owned critical information infrastructure or the ability of the owner of the provider-owned critical information infrastructure to respond to a cybersecurity threat or incident affecting the provider-owned critical information infrastructure.[Act 19 of 2024 wef 31/10/2025]
(7) Any owner of a provider-owned critical information infrastructure who, without reasonable excuse, fails to comply with subsection (5) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $25,000 or to imprisonment for a term not exceeding 12 months or to both.[Act 19 of 2024 wef 31/10/2025]
[Act 19 of 2024 wef 31/10/2025]
Power of Commissioner to issue written directions
Open ↗12.—(1) The Commissioner may, if the Commissioner thinks —(a)
it is necessary or expedient for ensuring the cybersecurity of a provider-owned critical information infrastructure or a class of provider-owned critical information infrastructure; or
(b)
it is necessary or expedient for the effective administration of this Act,
issue a written direction, either of a general or specific nature, to the owner of a provider-owned critical information infrastructure or a class of such owners.
[Act 19 of 2024 wef 31/10/2025]
(2) Without limiting subsection (1), a direction under that subsection may relate to —(a)
the action to be taken by the owner or owners in relation to a cybersecurity threat;
(aa)
compliance with any prescribed technical or other standards relating to cybersecurity in respect of the provider‑owned critical information infrastructure;[Act 19 of 2024 wef 31/10/2025]
(b)
compliance with any code of practice or standard of performance applicable to the owner;
(c)
the appointment of an auditor approved by the Commissioner to audit the owner or owners on their compliance with this Act or any code of practice or standard of performance applicable to the owner or owners; or
(d)
any other matters that the Commissioner may consider necessary or expedient to ensure the cybersecurity of the provider-owned critical information infrastructure.[Act 19 of 2024 wef 31/10/2025]
(3) A direction under subsection (1) must specify a deadline for compliance, and may be revoked at any time by the Commissioner.[Act 19 of 2024 wef 31/10/2025]
(4) Before giving a direction under subsection (1), the Commissioner must, unless the Commissioner considers that it is not practicable or desirable to do so, give notice to the person or persons whom the Commissioner proposes to issue the direction —(a)
stating that the Commissioner proposes to issue the direction and setting out its effect; and
(b)
specifying the time within which representations or objections to the proposed direction may be made.
(5) The Commissioner must consider any representations or objections which are duly made before giving any direction.
(6) Any person who, without reasonable excuse, fails to comply with a direction under subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000 or to imprisonment for a term not exceeding 2 years or to both and, in the case of a continuing offence, to a further fine not exceeding $5,000 for every day or part of a day during which the offence continues after conviction.
Change in ownership of provider-owned critical information infrastructure
Open ↗13.—(1) Where there is any change in the beneficial or legal ownership (including any share in such ownership) of a provider-owned critical information infrastructure, the relevant person must inform the Commissioner of the change in ownership not later than 7 days after the date of that change in ownership.[Act 19 of 2024 wef 31/10/2025]
(2) Any person who, without reasonable excuse, fails to comply with subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000 or to imprisonment for a term not exceeding 2 years or to both.
(3) In subsection (1), the relevant person is —(a)
in the case of a transfer of the whole of the legal ownership of the provider-owned critical information infrastructure to another person — the person who was the owner of the provider-owned critical information infrastructure before the change in ownership; or[Act 19 of 2024 wef 31/10/2025]
(b)
in any other case, an owner of the provider-owned critical information infrastructure.[Act 19 of 2024 wef 31/10/2025]
[Act 19 of 2024 wef 31/10/2025]
Duty to report cybersecurity incident in respect of provider‑owned critical information infrastructure, etc.
Open ↗14.—(1) The owner of a provider-owned critical information infrastructure must notify the Commissioner of the occurrence of any of the following in the prescribed form and manner, within the prescribed period after becoming aware of such occurrence:(a)
a prescribed cybersecurity incident in respect of the provider-owned critical information infrastructure;[Act 19 of 2024 wef 31/10/2025]
(b)
a prescribed cybersecurity incident in respect of any computer or computer system under the owner’s control that is interconnected with or that communicates with the provider-owned critical information infrastructure;[Act 19 of 2024 wef 31/10/2025]
(ba)
a prescribed cybersecurity incident in respect of any other computer or computer system under the owner’s control that does not fall within paragraph (b);[Act 19 of 2024 wef 31/10/2025]
(bb)
a prescribed cybersecurity incident in respect of any computer or computer system under the control of a supplier to the owner that is interconnected with or that communicates with the provider‑owned critical information infrastructure;[Act 19 of 2024 wef 31/10/2025]
(c)
any other type of cybersecurity incident in respect of the provider-owned critical information infrastructure that the Commissioner has specified by written direction to the owner.[Act 19 of 2024 wef 31/10/2025]
(2) The owner of a provider-owned critical information infrastructure must establish such mechanisms and processes for the purposes of detecting cybersecurity threats and incidents in respect of the provider-owned critical information infrastructure, as set out in any applicable code of practice.[Act 19 of 2024 wef 31/10/2025]
(3) Any owner of a provider-owned critical information infrastructure who, without reasonable excuse, fails to comply with subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000 or to imprisonment for a term not exceeding 2 years or to both.[Act 19 of 2024 wef 31/10/2025]
[Act 19 of 2024 wef 31/10/2025]
Cybersecurity audits and risk assessments of provider‑owned critical information infrastructure
Open ↗15.—(1) The owner of a provider-owned critical information infrastructure must —(a)
at least once every 2 years (or at such higher frequency as may be directed by the Commissioner in any particular case), starting from the date of the notice issued under section 7, cause an audit of the compliance of the provider-owned critical information infrastructure with this Act, any prescribed technical or other standards relating to cybersecurity that are to be maintained in respect of the provider‑owned critical information infrastructure, and the applicable codes of practice and standards of performance, to be carried out by an auditor approved or appointed by the Commissioner; and[Act 19 of 2024 wef 31/10/2025]
(b)
at least once a year, starting from the date of the notice issued under section 7, conduct a cybersecurity risk assessment of the provider-owned critical information infrastructure in the prescribed form and manner.[Act 19 of 2024 wef 31/10/2025]
(2) The owner of the provider-owned critical information infrastructure must, not later than 30 days after the completion of the audit mentioned in subsection (1)(a) or the cybersecurity risk assessment mentioned in subsection (1)(b), furnish a copy of the report of the audit or assessment to the Commissioner.[Act 19 of 2024 wef 31/10/2025]
(3) Where it appears to the Commissioner from the report of an audit furnished under subsection (2), that any aspect of the audit was not carried out satisfactorily, the Commissioner may direct the owner of the provider-owned critical information infrastructure to cause the auditor to carry out that aspect of the audit again.[Act 19 of 2024 wef 31/10/2025]
(4) Where it appears to the Commissioner that —(a)
the owner of a provider‑owned critical information infrastructure has not complied with a provision of this Act, a prescribed technical or other standard relating to cybersecurity, or an applicable code of practice or standard of performance; or
(b)
any information provided by the owner of a provider‑owned critical information infrastructure under section 10 is false, misleading, inaccurate or incomplete,
the Commissioner may for the purpose of ascertaining the owner’s compliance with this Act, a prescribed technical or other standard relating to cybersecurity, or an applicable code of practice or standard of performance, or ascertaining the accuracy or completeness of the information (as the case may be) —
(c)
by order require an audit in respect of the provider‑owned critical information infrastructure to be carried out by an auditor appointed by the Commissioner, and the cost of such audit must be borne by the owner; or
(d)
authorise the Deputy Commissioner, an Assistant Commissioner, a cybersecurity officer or an authorised officer to carry out an inspection of the provider‑owned critical information infrastructure.[Act 19 of 2024 wef 31/10/2025]
(5) Where it appears to the Commissioner, from the report of a cybersecurity risk assessment furnished under subsection (2), that the assessment was not carried out satisfactorily, the Commissioner may either —(a)
direct the owner of the provider-owned critical information infrastructure to carry out further steps to evaluate the level of cybersecurity of the provider-owned critical information infrastructure; or[Act 19 of 2024 wef 31/10/2025]
(b)
appoint a cybersecurity service provider to conduct another cybersecurity risk assessment of the provider-owned critical information infrastructure, and the cost of such assessment must be borne by the owner.[Act 19 of 2024 wef 31/10/2025]
(6) Where the owner of a provider-owned critical information infrastructure has notified the Commissioner under section 10(5) of a material change made to the design, configuration, security or operation of the provider-owned critical information infrastructure, or the Commissioner otherwise becomes aware of such material change having been made, the Commissioner may by written notice direct the owner to carry out another audit or cybersecurity risk assessment in addition to the audit or cybersecurity risk assessment mentioned in subsection (1).[Act 19 of 2024 wef 31/10/2025]
(7) Any owner of a provider-owned critical information infrastructure who —(a)
without reasonable excuse, fails to comply with subsection (1);
(b)
fails to comply with the Commissioner’s direction under subsection (3), (5)(a) or (6); or
(c)
obstructs or prevents an audit mentioned in subsection (4) or a cybersecurity risk assessment mentioned in subsection (5)(b) from being carried out,
shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000 or to imprisonment for a term not exceeding 2 years or to both and, in the case of a continuing offence, to a further fine not exceeding $5,000 for every day or part of a day during which the offence continues after conviction.
[Act 19 of 2024 wef 31/10/2025]
(8) Any owner of a provider-owned critical information infrastructure who, without reasonable excuse, fails to comply with subsection (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $25,000 or to imprisonment for a term not exceeding 12 months or to both and, in the case of a continuing offence, to a further fine not exceeding $2,500 for every day or part of a day during which the offence continues after conviction.[Act 19 of 2024 wef 31/10/2025]
[Act 19 of 2024 wef 31/10/2025]
Cybersecurity exercises
Open ↗16.—(1) The Commissioner may conduct cybersecurity exercises for the purpose of testing the state of readiness of owners of different provider-owned critical information infrastructure in responding to significant cybersecurity incidents.[Act 19 of 2024 wef 31/10/2025]
(2) An owner of a provider-owned critical information infrastructure must participate in a cybersecurity exercise if directed in writing to do so by the Commissioner.[Act 19 of 2024 wef 31/10/2025]
(3) Any person who, without reasonable excuse, fails to comply with a direction under subsection (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000.
Source: Singapore Statutes Online (Attorney-General's Chambers), © Government of Singapore.
