What to expect in the Cybersecurity Act propose amendments

This was the first time amendments to the cybersecurity law were proposed.

The Cyber Security Agency of Singapore (CSA) has filed a bill that aims to update the cybersecurity law to keep up with developments in the threat landscape.

This will be the first time the Cybersecurity Act 2018 will be amended if approved. The initial reading was conducted in Parliament on 3 April 2024. 

According to Minister for Communications and Information Josephine Teo, the Cybersecurity (Amendment) Bill seeks to amend the existing measure to “reflect the increasing importance of ensuring the cybersecurity of the digital infrastructure and services that power our digital economy and enable citizens to meet their day-to-day needs, beyond the current Critical Information Infrastructure (CII) it covers today.”

MORE LIKE THIS: CSA, NTT sign MOU on cybersecurity collaboration

The proposed amendments will specifically update provisions on cybersecurity of CII and expand the agency’s oversight to cover the cybersecurity of Systems of Temporary Cybersecurity Concern (STCC). 

CSA will create two new classes of regulated entities, namely the Entities of Special Cybersecurity Interest (ESCI) and Foundational Digital Infrastructure (FDI). 

The bill also wants to ensure that CII owners ensure their cybersecurity and cyber resilience as they integrate new technological and business models. This will give CSA more awareness about possible threats that could affect services covered by CII.

Given that some systems may be exposed to higher risks, the bill hopes to allow the CSA to secure STCCs especially those critical to Singapore, and are most likely targeted by attacks due to some events. 

The Cybersecurity (Amendment) Bill will allow the CSA to designate and regulate the ESCI if it holds sensitive information or performs functions of national interest.

Companies are also covered by the bill by requiring them to provide digital infrastructure services foundational to Singapore’s economy. This includes following cybersecurity codes and standards, and reporting incidents that fall under the CSA.