Runs an essential service, in Singapore

Cybersecurity Act 2018 (Act 9 of 2018), s. 14, with the Cybersecurity (Provider-Owned Critical Information Infrastructure) Regulations 2018 (S 519/2018), reg. 5 · Read the law's page

• Applies to the owner of provider-owned critical information infrastructure that the Commissioner of Cybersecurity has designated; reached by declaring that you operate an essential service.
• Notify the Commissioner of a prescribed cybersecurity incident in respect of the infrastructure, of an interconnected computer or system under your control, of a supplier's interconnected system, or of any other incident type the Commissioner specifies, in the prescribed form and manner (section 14(1)).
• For an incident in respect of the infrastructure, an interconnected system of yours, an interconnected system of a supplier, an incident type the Commissioner has specified, or one that disrupts or degrades delivery of the essential service, submit the first details within 2 hours after becoming aware of it, supplementary details within 72 hours, and a final incident report within 30 days after the supplementary submission (regulation 5(1) and (1A)).
• Establish the mechanisms and processes for detecting cybersecurity threats and incidents that an applicable code of practice sets out (section 14(2)).

Cybersecurity Act 2018 (Act 9 of 2018), s. 16I, as inserted by the Cybersecurity (Amendment) Act 2024 (Act 19 of 2024) · Read the law's page

• Applies to a provider of an essential service that the Commissioner of Cybersecurity has designated as responsible for the cybersecurity of third-party-owned critical information infrastructure, such as a cloud-hosted system; reached by declaring that you operate an essential service.
• Notify the Commissioner of a prescribed cybersecurity incident in respect of the infrastructure, or of a computer or system under your or the owner's control that is interconnected with it, in the prescribed form and manner and within the prescribed period (section 16I(4)).
• Obtain a legally binding commitment from the infrastructure's owner to notify you of prescribed incidents within the prescribed period (section 16I(1)).
• Establish the mechanisms and processes for becoming aware of cybersecurity threats and incidents that an applicable code of practice sets out (section 16I(5)).

Cybersecurity Act 2018 (Act 9 of 2018), s. 35A, as amended by the Cybersecurity (Amendment) Act 2024 (Act 19 of 2024) · Read the law's page

• Applies to an owner of provider-owned critical information infrastructure, a designated provider responsible for third-party-owned critical information infrastructure, an owner of a system of temporary cybersecurity concern, an entity of special cybersecurity interest or a major foundational digital infrastructure service provider, each as the Commissioner of Cybersecurity designates; reached by declaring that you operate an essential service.
• Comply with the codes of practice and standards of performance the Commissioner issues or approves and that apply to you, unless the Commissioner has waived them for you (section 35A(6) and (7)).