Singapore Cybersecurity Act

CII cybersecurity requirements: software inventory, patch management, vulnerability reporting.


Short name	SG Cyber
Region	Asia-Pacific
Country or scope	Singapore
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers SG Cyber

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for SG Cyber.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for SG Cyber and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`SG-CSA-10` Code of Practice Compliance: Asset Inventory	CII owners must comply with applicable codes of practice, which require maintaining an inventory of hardware and software assets supporting the CII (Cybersecurity Act 2018 s.10; CCoP asset management requirements)	Scan
`SG-CSA-PATCH` Patch Management Readiness	The Cybersecurity Code of Practice requires timely patching of CII systems, which presupposes known versions for the software components in scope (CCoP under Cybersecurity Act 2018 s.10)	Scan
`SG-CSA-14` Incident Assessment Readiness	CII owners must report prescribed cybersecurity incidents, and assessing whether a disclosed vulnerability or incident affects the CII requires identifiable software components (Cybersecurity Act 2018 s.14 incident reporting duty)	Scan
`SG-CSA-RISK` Risk Assessment of CII Software	CII owners must conduct regular cybersecurity risk assessments of the CII, requiring complete records (name and version) of the software composing it (Cybersecurity Act 2018 s.15 audits and risk assessments)	Scan
`SG-CSA-VENDOR` Supply Chain Visibility	The 2024 amendments and CCoP place expectations on managing supply chain risk to CII, requiring the supplier of software components to be known (Cybersecurity (Amendment) Act 2024; CCoP supply chain provisions)	Scan
`SG-CSA-INTEG` System Integrity Safeguards	Codes of practice require measures to protect the integrity of CII systems and detect unauthorized modification, supported by integrity hashes on software components (CCoP system integrity requirements under Cybersecurity Act 2018 s.10)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`SCA-CII-1`	Designate and Register Critical Information Infrastructure
`SCA-CCOP-2`	Conduct Cybersecurity Risk Assessments of CII
`SCA-CCOP-3`	Audit CII Cybersecurity Posture Annually
`SCA-CCOP-4`	Conduct Penetration Testing of CII
`SCA-IR-1`	Report Cybersecurity Incidents to CSA Within Prescribed Period
`SCA-IR-2`	Maintain and Test a Cybersecurity Incident Response Plan
`SCA-ACCESS-1`	Enforce Least Privilege and Multi-Factor Authentication
`SCA-SUPPLY-1`	Assess Cybersecurity Risks in the ICT Supply Chain
`SCA-PATCH-1`	Apply Security Patches to CII Systems Promptly
`SCA-LOG-1`	Maintain Audit Logs for CII Systems
`SCA-NETW-1`	Segment CII from Non-Critical Networks

Policy templates

Written for SG Cyber:

Operator of Critical Information Infrastructure Cybersecurity Policy
ICT Supply Chain Cybersecurity Policy (Singapore)

And 22 from the standard set, adapted to SG Cyber.