SINGAPORE – Board members of the operators of critical services in Singapore will need to go through cyber security training, as part of new requirements that will be codified within the first quarter of 2026.
These board members will also need to enhance their supervision and responsibility over the critical information infrastructure (CII) as well as adjacent systems, said Minister for Digital Development and Information Josephine Teo on Nov 12.
These critical sectors include energy, healthcare, telecommunications, finance and media.
Chief information security officers should also be provided direct access to the board as part of the updated Cybersecurity Code of Practice, said Mrs Teo, adding that threat actors will stop at nothing to steal data from CII operators and disrupt services.
The updates come after the Government announced in October that it
will be sharing classified threat intelligence
with these organisations to prevent cyber attacks that could jeopardise national security.
“What we would like for CII owners to do is to have a clear-eyed view of what they are up against, and to take the necessary action to better protect Singaporeans,” said Mrs Teo.
Speaking on the sidelines of the annual Critical Infrastructure Defence Exercise (Cidex) for the nation’s 11 critical sectors, she said the update comes at a time when the threat landscape has shifted considerably. The code was last updated in 2022.
CII operators that are found to have been negligent in securing their systems in the wake of an attack would face penalties, as outlined in the Cybersecurity Act. This would include those that do not follow the requirements in the updated code.
