Singapore to equip critical information infrastructure owners with proprietary threat detection systems

CII auditors will be given until the end of 2026 to obtain this mark at the organisation level for systems that support its business operations or services.

“With Singapore’s rapid digital transformation, many businesses are becoming increasingly reliant on technology,” said CSA and IMDA.

“It is important for organisations, especially CIIOs and their vendors that have access to sensitive data or critical systems, to adhere to a common set of standards to stay ahead of emerging cyber threats.”

The authorities will do more to protect citizens against malicious actors, said Mr Tan.

For one, it will ensure that the digital products that are sold in Singapore have “baseline security safeguards” that make them harder to be compromised, he added.

Currently, all residential routers sold in Singapore must meet CLS level 1 requirements, such as having unique default passwords, vulnerability management processes and keeping software updated.

While CLS Level 1 provides basic protections, the evolving cyber threat landscape requires more robust defences, said CSA and IMDA in a factsheet.

“Current Level 1 requirements, while addressing fundamental vulnerabilities, are insufficient against more sophisticated attacks that exploit weaknesses in data encryption, authentication mechanisms, and secure storage,” added the authorities.

​​Last year, Singapore took part in a global operation, where it was found that attackers infected over 2,700 Singapore devices, including routers.