SingaporeCybersecurity Act 2018, Report of Cybersecurity Incidents on Provider-Owned Critical Information Infrastructure
Cybersecurity Act 2018 (Act 9 of 2018) s. 14, with the Cybersecurity (Provider-Owned Critical Information Infrastructure) Regulations 2018 (S 519/2018), reg. 5
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to the owner of provider-owned critical information infrastructure that the Commissioner of Cybersecurity has designated; reached by declaring that you operate an essential service.
- Notify the Commissioner of a prescribed cybersecurity incident in respect of the infrastructure, of an interconnected computer or system under your control, of a supplier's interconnected system, or of any other incident type the Commissioner specifies, in the prescribed form and manner (section 14(1)).
- For an incident in respect of the infrastructure, an interconnected system of yours, an interconnected system of a supplier, an incident type the Commissioner has specified, or one that disrupts or degrades delivery of the essential service, submit the first details within 2 hours after becoming aware of it, supplementary details within 72 hours, and a final incident report within 30 days after the supplementary submission (regulation 5(1) and (1A)).
- Establish the mechanisms and processes for detecting cybersecurity threats and incidents that an applicable code of practice sets out (section 14(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 14(3) makes failing without reasonable excuse to comply with section 14(1) an offence punishable by a fine of up to 100,000 Singapore dollars or imprisonment of up to 2 years or both.
Penalty structure
Section 14(3) sets a fine of up to 100,000 Singapore dollars, or imprisonment of up to 2 years, or both, for failing to comply with section 14(1).
- Rule
- Fixed only
- As of
- Currency
- SGD
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The Commissioner of Cybersecurity, who receives the notifications; an offence is prosecuted in the courts.
Settledness
- As of
- Open questions
- Is a given customer the owner of designated provider-owned critical information infrastructure, a status the Commissioner confers by designation and the Act alone does not settle?
What this law does
Section 14(1) of the Act requires the owner of provider-owned critical information infrastructure to notify the Commissioner of Cybersecurity of a prescribed cybersecurity incident, in the prescribed form and manner and within the prescribed period after becoming aware of it. Regulation 5(1)(a) requires the owner to submit the first details of the incident within 2 hours after becoming aware of it.
Regulation 5(1)(b) requires supplementary details within 72 hours after becoming aware of the incident. Regulation 5(1)(c) requires a final incident report within 30 days, including any Sunday and public holiday, after the supplementary submission. Section 14(2) requires the owner to establish the mechanisms and processes for detecting cybersecurity threats and incidents that an applicable code of practice sets out.
Failing without reasonable excuse to comply with section 14(1) is an offence punishable by a fine of up to 100,000 Singapore dollars or imprisonment of up to 2 years or both. The first version of the Act in the statute database is dated .
When LexLint raises it
When your app profile says your app runs an essential service.