The main changes for CII operators

1. Government-developed threat detection will be deployed across network segments

CII owners will work with the Cyber Security Agency of Singapore (CSA) to deploy locally developed threat-detection systems across relevant network segments. The objective is to improve visibility and identify malicious activity not only within a formally designated CII system, but also across connected parts of the operating environment.

This is important because attackers may use less-protected systems as an entry point into critical infrastructure. Singapore has said that threat actors are increasingly targeting non-CII systems for precisely that reason.

2. Cybersecurity becomes a full-board responsibility

The revised approach moves cybersecurity accountability beyond the IT department or a single designated executive. The entire board and senior management will be expected to oversee cyber risk and recovery.

Boards must maintain a documented cyber-resilience framework that addresses:

• the organisation’s tolerance for cyber risk;
• measures to mitigate and manage that risk;
• possible risk-transfer arrangements; and
• recovery priorities and capabilities.

The framework must be reviewed at least annually.

That requirement turns cyber resilience into a recurring governance duty rather than a one-time compliance exercise. It also gives directors a clearer role in deciding how much risk the organisation is willing to accept and how it will continue operating after a serious incident.

3. Oversight will extend to connected systems

CII owners will need to maintain oversight of systems that connect to, communicate with or support their CII. The updated requirements also call for stronger network architecture, monitoring and detection management, along with comprehensive cybersecurity exercise plans for coordinated incident response.

The practical implication is that operators will need a more complete map of their dependencies. Systems outside the formal CII designation may still require closer scrutiny if they can provide a pathway into critical services or affect recovery after an attack.

4. Supporting non-CII systems must reach Cyber Trust Mark Level 5

CII owners will be required to attain Cyber Trust Mark (CTM) Level 5 by the end of 2027 for non-CII systems they control that support their business operations or services. This extends assurance requirements beyond the systems formally designated as critical infrastructure.

Level 5 is the highest tier in Singapore’s Cyber Trust framework. The broader certification programme covers areas including classical cybersecurity, cloud security, operational-technology security and AI security.

The aim is to reduce the gap between a highly protected CII system and the surrounding corporate infrastructure that may share credentials, administration tools, networks or recovery processes with it.

Why Singapore is tightening the rules

AI is compressing the time available to defend systems

Singapore’s CSA says the updated code is intended to address APT and AI-enabled threats. AI can help attackers operate with greater speed, scale and sophistication, increasing pressure on organisations to detect suspicious activity earlier and respond across their environments rather than relying on narrow perimeter controls.

The policy response is therefore not limited to adding another technical safeguard. It combines detection, governance, certification and exercises so that operators can identify threats, make decisions quickly and recover critical services if prevention fails.

UNC3886 showed the strategic value of telecommunications infrastructure

The 2025 UNC3886 campaign targeted Singapore’s four major telecommunications operators. Singapore described the activity as a deliberate, targeted and well-planned campaign by an actor with advanced capabilities.

CSA has also identified UNC3886 as a state-sponsored APT group that uses sophisticated techniques, including living-off-the-land methods and zero-day exploits, while targeting high-value strategic assets such as critical infrastructure.

Singapore responded with Operation CYBER GUARDIAN, a coordinated effort involving government agencies and telecommunications companies. Authorities said the operation contained the incident without disruption to telecommunications services and found no evidence that customer data had been compromised.

The absence of a reported service disruption does not make the incident irrelevant to other sectors. It demonstrates why telecommunications, energy, healthcare, finance, transport and other essential services are treated as strategic targets—and why Singapore is extending controls to the systems and suppliers surrounding CII.

Cloud and third-party security are the next major layer

Singapore plans to introduce a separate, legally binding Cybersecurity Code of Practice for Cloud Services later in 2026. The code is expected to address the secure deployment, operation and management of CII systems hosted in cloud environments.

CSA has worked with AWS, Google Cloud and Microsoft Azure on provider-specific implementation guidance covering appropriate configurations and the use of cloud-native security capabilities.

The certification deadlines also reach into the cybersecurity supply chain:

• CII auditors must attain CTM Level 5 by the end of 2026.
• Licensed penetration-testing and managed security operations centre providers must attain CTM Level 3 by the end of 2026.
• CII owners must attain CTM Level 5 for relevant supporting systems by the end of 2027.

These measures reflect a broader principle: a critical operator’s security depends not only on its own controls, but also on the organisations that audit, monitor, test and host its systems.

What remains unclear

The updated CII requirements are now listed by CSA, but the detailed obligations under the separate cloud code are still developing. Public material identifies the planned timing and broad focus of the cloud rules, while precise requirements for cloud providers, subcontractors and shared-responsibility arrangements have not yet been fully specified.

For CII operators, the immediate priority is therefore to assess the entire dependency chain: designated CII, connected systems, cloud workloads, recovery environments, suppliers and outsourced security services. The direction of Singapore’s policy is clear even where implementation details remain to be published—the protected boundary is becoming the whole operating ecosystem, not just the system carrying the CII label.

The main changes for CII operators

1. Government-developed threat detection will be deployed across network segments

CII owners will work with the Cyber Security Agency of Singapore (CSA) to deploy locally developed threat-detection systems across relevant network segments. The objective is to improve visibility and identify malicious activity not only within a formally designated CII system, but also across connected parts of the operating environment.

This is important because attackers may use less-protected systems as an entry point into critical infrastructure. Singapore has said that threat actors are increasingly targeting non-CII systems for precisely that reason.

2. Cybersecurity becomes a full-board responsibility

The revised approach moves cybersecurity accountability beyond the IT department or a single designated executive. The entire board and senior management will be expected to oversee cyber risk and recovery.

Boards must maintain a documented cyber-resilience framework that addresses:

• the organisation’s tolerance for cyber risk;
• measures to mitigate and manage that risk;
• possible risk-transfer arrangements; and
• recovery priorities and capabilities.

The framework must be reviewed at least annually.

That requirement turns cyber resilience into a recurring governance duty rather than a one-time compliance exercise. It also gives directors a clearer role in deciding how much risk the organisation is willing to accept and how it will continue operating after a serious incident.

3. Oversight will extend to connected systems

CII owners will need to maintain oversight of systems that connect to, communicate with or support their CII. The updated requirements also call for stronger network architecture, monitoring and detection management, along with comprehensive cybersecurity exercise plans for coordinated incident response.

The practical implication is that operators will need a more complete map of their dependencies. Systems outside the formal CII designation may still require closer scrutiny if they can provide a pathway into critical services or affect recovery after an attack.

4. Supporting non-CII systems must reach Cyber Trust Mark Level 5

CII owners will be required to attain Cyber Trust Mark (CTM) Level 5 by the end of 2027 for non-CII systems they control that support their business operations or services. This extends assurance requirements beyond the systems formally designated as critical infrastructure.

Level 5 is the highest tier in Singapore’s Cyber Trust framework. The broader certification programme covers areas including classical cybersecurity, cloud security, operational-technology security and AI security.

The aim is to reduce the gap between a highly protected CII system and the surrounding corporate infrastructure that may share credentials, administration tools, networks or recovery processes with it.

Why Singapore is tightening the rules

AI is compressing the time available to defend systems

Singapore’s CSA says the updated code is intended to address APT and AI-enabled threats. AI can help attackers operate with greater speed, scale and sophistication, increasing pressure on organisations to detect suspicious activity earlier and respond across their environments rather than relying on narrow perimeter controls.

The policy response is therefore not limited to adding another technical safeguard. It combines detection, governance, certification and exercises so that operators can identify threats, make decisions quickly and recover critical services if prevention fails.

UNC3886 showed the strategic value of telecommunications infrastructure

The 2025 UNC3886 campaign targeted Singapore’s four major telecommunications operators. Singapore described the activity as a deliberate, targeted and well-planned campaign by an actor with advanced capabilities.

CSA has also identified UNC3886 as a state-sponsored APT group that uses sophisticated techniques, including living-off-the-land methods and zero-day exploits, while targeting high-value strategic assets such as critical infrastructure.

Singapore responded with Operation CYBER GUARDIAN, a coordinated effort involving government agencies and telecommunications companies. Authorities said the operation contained the incident without disruption to telecommunications services and found no evidence that customer data had been compromised.

The absence of a reported service disruption does not make the incident irrelevant to other sectors. It demonstrates why telecommunications, energy, healthcare, finance, transport and other essential services are treated as strategic targets—and why Singapore is extending controls to the systems and suppliers surrounding CII.

Cloud and third-party security are the next major layer

Singapore plans to introduce a separate, legally binding Cybersecurity Code of Practice for Cloud Services later in 2026. The code is expected to address the secure deployment, operation and management of CII systems hosted in cloud environments.

CSA has worked with AWS, Google Cloud and Microsoft Azure on provider-specific implementation guidance covering appropriate configurations and the use of cloud-native security capabilities.

The certification deadlines also reach into the cybersecurity supply chain:

• CII auditors must attain CTM Level 5 by the end of 2026.
• Licensed penetration-testing and managed security operations centre providers must attain CTM Level 3 by the end of 2026.
• CII owners must attain CTM Level 5 for relevant supporting systems by the end of 2027.

These measures reflect a broader principle: a critical operator’s security depends not only on its own controls, but also on the organisations that audit, monitor, test and host its systems.

What remains unclear

The updated CII requirements are now listed by CSA, but the detailed obligations under the separate cloud code are still developing. Public material identifies the planned timing and broad focus of the cloud rules, while precise requirements for cloud providers, subcontractors and shared-responsibility arrangements have not yet been fully specified.

For CII operators, the immediate priority is therefore to assess the entire dependency chain: designated CII, connected systems, cloud workloads, recovery environments, suppliers and outsourced security services. The direction of Singapore’s policy is clear even where implementation details remain to be published—the protected boundary is becoming the whole operating ecosystem, not just the system carrying the CII label.