SingaporeCybersecurity Act 2018, Compliance with Codes of Practice and Standards of Performance
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to an owner of provider-owned critical information infrastructure, a designated provider responsible for third-party-owned critical information infrastructure, an owner of a system of temporary cybersecurity concern, an entity of special cybersecurity interest or a major foundational digital infrastructure service provider, each as the Commissioner of Cybersecurity designates; reached by declaring that you operate an essential service.
- Comply with the codes of practice and standards of performance the Commissioner issues or approves and that apply to you, unless the Commissioner has waived them for you (section 35A(6) and (7)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Commissioner of Cybersecurity, who issues or approves the codes and standards and may waive them.
Settledness
- As of
- Open questions
- What penalty attaches to failing to comply with a code of practice under section 35A(6)?
What this law does
Section 35A(1)(a) of the Act lets the Commissioner of Cybersecurity issue or approve codes of practice and standards of performance for owners of provider-owned critical information infrastructure, designated providers responsible for third-party-owned critical information infrastructure, owners of systems of temporary cybersecurity concern, entities of special cybersecurity interest and major foundational digital infrastructure service providers.
Section 35A(6) requires each of those persons to comply with the codes of practice and standards of performance that apply to the person, subject to section 35A(4) and (7). Section 35A(7) lets the Commissioner waive the application of a code of practice or standard of performance to a person, generally or for a stated time, and the amended section took effect on .
When LexLint raises it
When your app profile says your app runs an essential service.