Cyber security compliance in Singapore

Which cyber security rules apply in Singapore?

Three regulators cover almost everyone. The Cyber Security Agency administers the Cybersecurity Act 2018: designated owners of critical information infrastructure in eleven sectors follow the Cybersecurity Code of Practice, are audited every two years and must now hold the Cyber Trust mark at Advocate level; every other organisation can use the same agency's Cyber Essentials and Cyber Trust marks as a voluntary, certified baseline. The Monetary Authority of Singapore holds banks, insurers, capital-markets and payment institutions to its Technology Risk Management Guidelines and to two binding Notices — Technology Risk Management and Cyber Hygiene — plus its business continuity and outsourcing rules. The Personal Data Protection Commission enforces the Personal Data Protection Act on every organisation handling personal data.

A Singapore bank is therefore a CII owner under CSA, an FI under MAS and a data controller under the PDPC at once, which is why GRCLens runs the four Singapore catalogues on one control model.

What does the CSA Code of Practice require of a CII owner?

The 2026 Code has twelve sections, of which sections 2 to 12 are audited under section 15 of the Act: audit remediation, governance (Board training every 12 months and a threat briefing every 6 months, a named senior cybersecurity officer, risk management, cloud and outsourcing oversight), asset identification, protection, detection and threat hunting, incident response and cybersecurity exercises, backup and business continuity, training, operational technology security for OT CII, DNSSEC where the CII exposes DNS, and — new in 2026 — the security of systems interconnected with the CII.

Most of it applied from 29 July 2026. Forty-two clauses — the new Board and senior-management duties, asset management, one monitoring clause, most of the exercise requirements and all of section 12 — have a Compliance Date of 29 July 2027 for existing owners, and every CII owner must hold the Cyber Trust mark at Advocate level by 31 December 2027. Non-compliance is enforced through a written direction from the Commissioner; breaching the direction is the offence.

What does MAS require for technology risk management?

Two layers. The Technology Risk Management Guidelines, unchanged since 18 January 2021, are MAS's own supervisory expectations rather than a standard of care — para 2.2 says implementation should be commensurate with the FI's risk and complexity, but MAS considers an FI's observance of them in supervision. On top of the Guidelines sit two binding Notices issued under section 29(1) of the Financial Services and Markets Act 2022, both effective 10 May 2024: FSM-N05 (Technology Risk Management) and FSM-N06 (Cyber Hygiene).

FSM-N05 fixes numbers the Guidelines leave to judgement: identify critical systems, cap cumulative unscheduled downtime at 4 hours per critical system per rolling 12 months (not an availability percentage), validate a 4-hour recovery time objective at least every 12 months, notify MAS within 1 hour of a relevant incident, and file a root cause and impact report within 14 days. FSM-N06 makes six cyber hygiene practices binding: administrative account security, patch timeliness, written security standards, network perimeter defence, malware protection, and multi-factor authentication for administrative accounts on critical systems and for internet access to customer information. MAS is separately consulting (10 June to 31 July 2026) on adding IT asset management, capacity management, immutable backups and continuous monitoring duties, expected in force around 2027.

What are Singapore's Cyber Trust and Cyber Essentials marks?

CSA runs two voluntary cybersecurity certification marks, both relaunched on 15 April 2025 to add cloud, OT and AI security to what was previously classical-IT-only scope. Cyber Essentials is prescriptive and aimed at resource-constrained SMEs: a fixed set of 75 requirements and recommendations across nine sub-domains (people, hardware and software, data, virus and malware protection, access control, secure configuration, software updates, backups, incident response), certifying for two years, and an organisation must meet every requirement to pass. Cyber Trust is risk-based and tiered for more digitalised organisations: a guided risk assessment places the organisation into one of five cybersecurity preparedness tiers — Supporter, Practitioner, Promoter, Performer, Advocate — each requiring more of Cyber Trust's 22 cybersecurity preparedness domains, certifying for three years with annual surveillance audits.

The two marks interlock rather than sit side by side: Cyber Trust's own text maps the Cyber Essentials requirements to its Supporter tier and the recommendations to Practitioner, so an SME that has Cyber Essentials has already met the bottom two tiers of Cyber Trust in the domains that carry hygiene content. Certification is independent, run by CSA-appointed certification bodies in two stages — a documentation review, then an on-site check of roughly three months of operating evidence — and Cyber Trust is only issued where at least 80% of applicable statements are answered Yes, under 20% are Not applicable and none are No.

What does Singapore's PDPA require?

The Personal Data Protection Act 2012, as amended by the Personal Data Protection (Amendment) Act 2020, requires a designated Data Protection Officer with published contact details, a lawful basis (consent, deemed consent, or a named First Schedule exception) for every collection, use and disclosure, purpose limitation and notice, access and correction rights, reasonable security and retention limitation, and — since 1 February 2021 — a mandatory notifiable-data-breach regime.

A data breach that results in, or is likely to result in, significant harm, or affects 500 or more individuals, must be assessed in a reasonable and expeditious manner and notified to the Commission no later than 3 calendar days after that assessment, with affected individuals notified as soon as practicable. Financial penalties of up to 10% of Singapore annual turnover above S$10 million, or S$1 million, have applied since 1 October 2022. Data portability (Part 6B) was enacted in 2020 but has not been brought into force.

How GRCLens runs the Singapore frameworks together

MAS TRM (with the binding Notices), the CSA Code of Practice, the Cyber Trust and Cyber Essentials marks and the PDPA share one control model in GRCLens with ISO/IEC 27001, NIST CSF and the Australian and Malaysian frameworks, so a bank that is also a CII owner evidences a control once for MAS, CSA and its auditors. The MAS one-hour and four-hour clocks, the CCoP's 2027 compliance dates, the Cyber Trust tier the organisation is pursuing and the PDPC's three-day breach clock are tracked as their own indicators. The platform can be hosted in Singapore or fully on-premises.

Official portals and publications

• CSA — Codes of Practice
• MAS Notice FSM-N06 Cyber Hygiene
• CSA cybersecurity certification for organisations
• PDPC regulatory guidance