Singapore’s cybersecurity bill passed in parliament

A bill designed to make Singapore’s critical services more resilient to cyberattacks has been passed in parliament. The Cybersecurity Bill mandates that owners of computer systems deemed to be providing essential services, known as critical information infrastructures (CIIs), must comply with codes of best practice, report any cybersecurity incidents, undergo regular cybersecurity risk assessments and submit to a cybersecurity audit conducted by a third party. The Bill, a draft of which was issued for public consultation back in July 2017, is intended to harmonise the current requirements for CIIs in both the public and private sector and to supersede any privacy rules that prevent disclosure of cybersecurity information. The Bill also grants much more power to Singapore’s Cyber Security Agency (CSA), allowing it to decide which organisations are designated as CIIs and to take action regarding any reported cybersecurity incidents or reports. The CSA’s chief executive will also be responsible for administering the Bill. Another aspect to the legislation is the introduction of a licensing framework for providers of two specific cybersecurity services – penetration testing and managed security operations centre monitoring. According to the Bill’s main sponsor, minister for communications and information Yaacob Ibrahim, the licensing framework is intended to be “light touch” at the outset, although companies that fail to attain a licence could be hit with a SGD50,00 fine or two years in jail. Similarly, CIIs that comply with the Bill’s requirements will not be penalised in the event of a cybersecurity breach but non-compliance could result in a SGD100,000 penalty or two years in jail. Dr Yaacob said the recent escalation of cyberattacks on public sector bodies such as the hacking of power grids in the Ukraine and the WannaCry ransomware attack, which led to a cancellation of 6,900 appointments by the UK’s National Health Service, had prompted the Singapore government to introduce legislation specifically for cyber security. In introducing the Bill, Dr Yaacob also had to field questions from other MPs about safeguards to ensure that authorities do not intrude on personal privacy in their enforcement of cybersecurity measures, and the criteria used for deciding an incident is major enough for the authorities’ powers to be exercised. There were also questions as to how the legislation may be applied to essential services supplied from providers outside of the country Another MP asked about the potential cost of implementing the bill and its requirements and what measures are in place to ensure those costs are not passed down to end consumers. While Dr Yaacob did ensure the house that “the powers under the Bill are not intended to intrude into privacy”, he also conceded that those CIIs which had not already invested in cybersecurity may face additional costs. But he added that such investment would create long-term benefits for companies beyond merely compliance. “If organisations follow good security-by-design practices, they will spend less overall in the long run to fix cybersecurity issues,” he said. The legislation has also been welcomed by insurers. “[Regulation] is essential if cyber defence is going to be maximised at every level and to ensure the matter is given proper management attention at the leadership level,” said Nicholas Tey, regional manager, financial lines at Beazley. “Although there have been some concerns in terms of the burden on business, the costs of non-compliance and lack of defence will be much higher than any audit or investment in cybersecurity and go to the heart of safeguarding the future of the business,” said Mr Tey.

Singapore’s cybersecurity bill passed in parliament

Want to read this article?

Read Next

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Markel launches professional indemnity solution in Australia

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Markel launches professional indemnity solution in Australia

Want to read this article?

Read Next

Marsh tracks slowdown in global Q1 rate hikes

Markel names head of terrorism in London

Allstate posts nat cat loss of $343m for March

UAE flash flood losses manageable as insurers adapt to changing weather

Markel launches professional indemnity solution in Australia

Related Articles