{"id":11052,"date":"2025-11-13T01:14:48","date_gmt":"2025-11-12T17:14:48","guid":{"rendered":"https:\/\/sgbuzz.com\/?p=11052"},"modified":"2025-11-13T01:14:48","modified_gmt":"2025-11-12T17:14:48","slug":"board-members-of-critical-services-operators-will-soon-be-required-to-undergo-cyber-security-training","status":"publish","type":"post","link":"https:\/\/sgbuzz.com\/?p=11052","title":{"rendered":"Board members of critical services operators will soon be required to undergo cyber security training"},"content":{"rendered":"


\n<\/p>\n

\n

SINGAPORE – Board members of the operators of critical services in Singapore will need to go through cyber security training, as part of new requirements that will be codified within the first quarter of 2026.<\/p>\n

These board members will also need to enhance their supervision and responsibility over the critical information infrastructure (CII) as well as adjacent systems, said Minister for Digital Development and Information Josephine Teo on Nov 12.<\/p>\n

These critical sectors include energy, healthcare, telecommunications, finance and media.<\/p>\n

Chief information security officers should also be provided direct access to the board as part of the updated Cybersecurity Code of Practice, said Mrs Teo, adding that threat actors will stop at nothing to steal data from CII operators and disrupt services.<\/p>\n

The updates come after the Government announced in October that it <\/p>\n

will be sharing classified threat intelligence<\/p>\n

<\/a> with these organisations to prevent cyber attacks that could jeopardise national security.<\/p>\n

\u201cWhat we would like for CII owners to do is to have a clear-eyed view of what they are up against, and to take the necessary action to better protect Singaporeans,\u201d said Mrs Teo. <\/p>\n

Speaking on the sidelines of the annual Critical Infrastructure Defence Exercise (Cidex) for the nation\u2019s 11 critical sectors, she said the update comes at a time when the threat landscape has shifted considerably. The code was last updated in 2022.<\/p>\n

CII operators that are found to have been negligent in securing their systems in the wake of an attack would face penalties, as outlined in the Cybersecurity Act. This would include those that do not follow the requirements in the updated code.<\/p>\n

The Cybersecurity Act came into force in 2018, and <\/p>\n

was amended in 2024<\/p>\n

<\/a> to require CII operators in Singapore to declare any cyber-security outage and attack on their premises or along their supply chain that may cross borders.<\/p>\n

\u201cWhen it comes to cyber security, we need to hunt as a pack to identify where our weaknesses and vulnerabilities are; but we also need to defend as a team,\u201d Mrs Teo said, adding that Cidex hones this aspect.<\/p>\n

More than 250 participants from 33 governmental and private organisations are taking part in the exercise in 2025, which is being held at the Singapore Institute of Technology from Nov 11 to 14. The exercise has been held yearly since 2022 to test participants\u2019 skills against simulated cyber attacks. <\/p>\n

Participants include Changi Airport Group, telco M1, OCBC Bank and the Government Technology Agency, as well as others responsible for defending the nation\u2019s digital backbone, power grid, rail systems and telecommunications networks.<\/p>\n

The focus of the 2025 exercise is incorporating intelligence from ongoing cyber operations into the design of the attacks, said Singapore\u2019s Defence Cyber chief Clarence Cai. <\/p>\n

\u201cWe do this so that our defenders know what and, importantly, how to look for advanced actors in their networks when they return to their respective organisations,\u201d he said. <\/p>\n

This includes sophisticated attacks that originate in the IT space, that go on to disrupt infrastructure that controls physical systems and devices, he added.<\/p>\n

He said participants also benefit from the learnings of various industry players such as Google and Amazon Web Services, which have shared their observations on cyber threats across different cloud environments.<\/p>\n

Defence Minister Chan Chun Sing said that 2025\u2019s drill is the first where all 11 CIIs participated to attain three goals: vigilance, unity of action and resilience. <\/p>\n

\u201cVigilance means that we must keep everyone updated on the latest threats,\u201d he said. <\/p>\n

On unity of action, Mr Chan said the strength of the network is dependent on the weakest link. <\/p>\n

\u201cSo if there\u2019s one compromise in any part of the network, it actually compromises the entire network, which is why having all the various agencies coming together is so important,\u201d he said. <\/p>\n

But the most important goal, he said, is resilience, marked by how all the sectors\u2019 competency can be levelled up to bounce back from any setback as soon as possible. <\/p>\n