Singapore’s Amendment Act at one: two-hour clock and STCCs

On 31 October 2025 Singapore brought key parts of its Cybersecurity (Amendment) Act 2024 into force. One year on, Critical Information Infrastructure owners face a two-hour incident clock for some events, virtual systems can be designated as CII, and a new class of temporary high-risk systems sits under the Commissioner’s eye. Here is what the first year of the amended Act changed, and what operators should still be checking.

Applies to: Singapore (CII owners, provider-owned and virtual CII, and STCC owners). Not UK, EU or US law.

What commenced a year ago

The Cyber Security Agency of Singapore (CSA) announced (opens in a new tab) that key provisions of the Cybersecurity (Amendment) Act, passed on 7 May 2024, would commence on 31 October 2025. The commencement notification (S 677/2025) and the matching Critical Information Infrastructure amendment regulations (S 678/2025) were published on 15 October 2025 and took effect on that day.

The 2018 Cybersecurity Act already gave CSA powers over Critical Information Infrastructure. The 2024 amendments updated those rules for a world of virtual systems and short-lived high-risk platforms, and expanded what has to be reported.

Provider-owned and virtual CII

CSA’s notice is clear on the reason: CII owners increasingly rely on virtual computers and systems to deliver essential services. The amendments give the Commissioner of Cybersecurity power to designate those systems as CII, so they meet the same Act requirements as physical infrastructure.

Once designated, provider-owned CII owners must, among other duties set out in the amended Act:

  • Cause a compliance audit at least once every two years (or more often if the Commissioner directs), by an auditor the Commissioner approves or appoints.
  • Conduct a cybersecurity risk assessment at least once a year, in the prescribed form.
  • Furnish a copy of each audit or assessment report to the Commissioner within 30 days of completion.

Failure without reasonable excuse can mean a fine of up to S$100,000, up to two years’ imprisonment, or both, plus a further fine for continuing offences. The Commissioner can also order a re-audit, appoint an auditor at the owner’s cost, or authorise an inspection.

The two-hour reporting clock

Incident reporting expanded in two directions. CII owners must report to CSA within two hours of becoming aware of:

  • Incidents suspected of being caused by an Advanced Persistent Threat (APT).
  • Incidents that disrupt essential services on non-interconnected systems under the CII owner’s control.

CSA’s stated aim is faster national situational awareness and a coordinated response when one is needed. Two hours is among the shortest public cyber-reporting clocks anywhere; most Western regimes still talk in days. Treat the Singapore clock as a runbook design constraint, not a press-release deadline. (Our forthcoming country-by-country clocks piece will put the figures side by side once each is checked against primary law.)

Systems of Temporary Cybersecurity Concern

The amendments also create Systems of Temporary Cybersecurity Concern (STCCs): computers or systems, located wholly or partly in Singapore, that the Commissioner can designate for a limited period because temporary events raise the cyber risk to a level that could harm national interests. CSA’s examples include systems supporting a government election or vaccine distribution in a pandemic.

STCC owners must take cybersecurity measures and report incidents affecting the STCC for the period the designation lasts. The designation notice sets a first and last day (maximum one year); the Commissioner can withdraw or extend it. If you run platforms that spike for national events, assume you could be brought into scope at short notice and keep a lightweight STCC playbook ready.

What did not commence

Not every 2024 reform lit up on 31 October 2025. Parts dealing with Entities of Special Cybersecurity Interest and major foundational digital infrastructure service providers were held back from that commencement. Operators in those categories should not assume the amended Act already covers them; watch for a further commencement notification.

What to check this week

  • If you own or operate CII in Singapore, confirm whether any virtual or provider-owned systems have been, or should be, designated, and that your audit and annual risk-assessment calendar is current.
  • Rehearse the two-hour APT and essential-service disruption reports. Detection-to-CSA handoff has to survive nights, weekends and outsourced SOCs.
  • If you run event-driven or surge platforms in Singapore, draft an STCC response: who speaks to CSA, which controls you can turn on in hours, and how you would report.
  • Cross-check against other short clocks you already track. Our forthcoming country-by-country incident-reporting piece (planned for early November) will put Singapore’s two hours next to CRA 24h, NIS2 24h, SEC four business days and the rest.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)