SingaporeCybersecurity Act 2018, Report of Cybersecurity Incidents on Third-Party-Owned Critical Information Infrastructure
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to a provider of an essential service that the Commissioner of Cybersecurity has designated as responsible for the cybersecurity of third-party-owned critical information infrastructure, such as a cloud-hosted system; reached by declaring that you operate an essential service.
- Notify the Commissioner of a prescribed cybersecurity incident in respect of the infrastructure, or of a computer or system under your or the owner's control that is interconnected with it, in the prescribed form and manner and within the prescribed period (section 16I(4)).
- Obtain a legally binding commitment from the infrastructure's owner to notify you of prescribed incidents within the prescribed period (section 16I(1)).
- Establish the mechanisms and processes for becoming aware of cybersecurity threats and incidents that an applicable code of practice sets out (section 16I(5)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 16I(6) makes failing without reasonable excuse to comply with section 16I(4) an offence punishable by a fine of up to 100,000 Singapore dollars or imprisonment of up to 2 years or both.
Penalty structure
Section 16I(6) sets a fine of up to 100,000 Singapore dollars, or imprisonment of up to 2 years, or both, for failing to comply with section 16I(4).
- Rule
- Fixed only
- As of
- Currency
- SGD
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The Commissioner of Cybersecurity, who receives the notifications; an offence is prosecuted in the courts.
Settledness
- As of
- Open questions
- What period applies to the section 16I(4) notification, given that the Act leaves it to the prescribed period and the regulations read for this row cover provider-owned infrastructure only?
What this law does
Section 16I(4) of the Act requires a designated provider responsible for third-party-owned critical information infrastructure to notify the Commissioner of a prescribed cybersecurity incident, in the prescribed form and manner and within the prescribed period after becoming aware of it. Section 16I(1) requires the provider to obtain a legally binding commitment from the infrastructure's owner to notify the provider of prescribed incidents within the prescribed period.
Section 16I(5) requires the provider to establish the mechanisms and processes for becoming aware of cybersecurity threats and incidents that an applicable code of practice sets out. Failing without reasonable excuse to comply with section 16I(4) is an offence punishable by a fine of up to 100,000 Singapore dollars or imprisonment of up to 2 years or both, and the section took effect on .
When LexLint raises it
When your app profile says your app runs an essential service.