Public Consultation on the Cybersecurity (Amendment) Bill

Some respondents shared with CSA that the proposals to regulate CII owners’ use of distributed system architecture or computing vendors would create statutory obligations (directly or indirectly) for the cloud service providers (“CSPs”) or computing vendors keen to serve PES.

In this respect, some respondents sought clarification on whether CSPs providing cloud computing solutions to support the virtualisation of the CII or computing vendors supplying the CII itself to PES would also be regulated by CSA as CII owners, or if the “liabilities” of that CII owner or PES could “flow through” to the CSPs or computing vendors.

Several respondents expressed that the draft legal text that set out the amendments relating to the use of "non-provider-owned" CII was difficult to follow.

Finally, a number of respondents have asked if a CII owner can be designated as a PES at the same time and whether the designation of PES would happen immediately after the amended act is passed.

The proposed amendments to Part 3 and 3A of the draft Bill are not intended to regulate (a) CSPs providing cloud solutions to support the CII or (b) the computing vendors of a PES as CII owners.

The statutory responsibilities imposed on a CII owner under Part 3 of the Act, or a designated PES under Part 3A, cannot be passed on to the CSP or the computing vendor. This will also apply to any penalties that are imposed on the CII owner or PES for non-compliance.

In response to the feedback received, CSA will:

a. Introduce additional provisions, relating to virtual computers or virtual computer systems, to clarify that it is the person who has:

1. control over the operations of the virtual computer or virtual computer system;

2. the right and ability to perform security configuration and management tasks in respect of the virtual computer or virtual computer system, including to make any modification as necessary for the cybersecurity of the virtual computer or virtual computer system; and

3. where applicable, responsibility for security of the virtual computer or virtual computer system under a person’s contractual arrangement with a CSP,
   who will be considered the owner of a virtual CII system. This will effectively mean that the existing CII owner, who has the necessary control over the said CII system, will continue to be responsible for the system, even after virtualisation, and not the CSP.

b. Simplify the draft legal text by replacing references to a “non-provider”, which was used in the consultations draft to refer to the computing vendor that provides the CII to a PES, with “third-party”.

To clarify, a PES who relied on an outsourced CII to deliver the essential services (but does not own it) would not be considered as a CII owner for that CII. Nevertheless, the PES will still be required to meet the obligations under Part 3A of the Act.

Finally on the designation of a PES, CSA would like to clarify that designation will involve a considered process. For example, CSA will first need to work very closely with any parties that we identify as potential providers of essential services and the relevant sector regulator to understand the operating environment and the computer or computer system involved for delivering the essential services before we decide if there is a basis to proceed with designation.

There was feedback that there could be an increase in compliance costs that CII owners would have to bear with respect to the proposed expansion to their incident reporting obligations.

For example, some respondents expressed concerns that the expanded scope of the incident reporting obligations was broad and could lead to a higher compliance burden on the CII owner. Some respondents sought clarity on whether the new incident reporting requirements extended to computer or computer systems outside of Singapore. Some respondents also raised questions as to what is considered as “interconnected” when it relates to incident reporting involving the supply chain.

Similarly for the Part 3A provisions relating to PES, respondents commented that it would be difficult to secure a legally binding commitment from computing vendors for the use of the outsourced CII without significant additional costs given the bargaining powers such computing vendors wield.

Finally, some respondents also queried if it would be feasible for the Commissioner to require a PES to cease the use of the outsourced CII in the event if the PES is not able to secure a legally binding commitment, given that this may potentially disrupt the delivery of essential services.

The proposed expansion of incident reporting requirements is intended to address evolving tactics of Advanced Persistent Threat (“APT”) actors and cybercriminals that involve exploiting supply chains and other peripheral systems to attack CII and to disrupt the delivery of essential services.

To help CII owners manage the compliance burden, CSA will work with CII owners to develop a pragmatic approach to the submission of incident reports including those involving the supply chain. In this respect, CSA will continue to work with CII owners in operationalizing the new incident reporting requirements before the requirements come into force.

The decision to use an outsourced- CII from a third-party computing vendor is a business decision that a CII owner may undertake depending on its own assessment of the costs and benefits involved. As the national cybersecurity authority, CSA holds the view that all CIIs, regardless of whether they are outsourced or owned by CII owners should be subjected to similar levels of cybersecurity requirements and this is why we have introduced a new Part 3A to the Act to address such situations.

Likewise, if CSA is of the view that the PES is unable to meet its obligations under the new Part 3A of the Act, CSA may take further actions, including asking the PES to cease the use of the outsourced CII to deliver the essential services.

Some respondents sought clarification on the extent to which the Commissioner would be able to exercise the proposed new power to conduct on-site inspections for provider-owned CII.

For example, some respondents suggested that the inspections be used to address material compliance gaps that pose a significant risk to the CII or the delivery of essential services. Some respondents requested to have clear guidelines and safeguards put in place to prevent the abuse of this power (e.g. using this power to obtain the CII owner’s business confidential information.) One respondent suggested that CSA should provide notice to CII owners before conducting on-site inspections.

There are safeguards provided in the proposed amendment to prevent CSA from obtaining confidential information beyond the scope of what is necessary for the on-site inspection. For example, the proposed amendment makes it clear that it must first appear to the Commissioner that the CII owner has not complied with something they ought to have complied with or has submitted false, misleading, inaccurate or incomplete information. Thereafter, the Commissioner may only exercise this power to conduct on-site inspections to ascertain compliance or the accuracy or completeness of information submitted.

CSA understands the concerns raised by the respondents, and as far as possible, CSA will endeavour to give notice to CII owners prior to conducting on-site inspections pursuant to this proposed amendment.

Feedback was received on how CSA intends to operationalise proposed amendments.

For example, several respondents asked CSA to provide further details on the incident reporting parameters and cybersecurity codes of practice or standards of performance that could be issued or approved if the amendments were passed. A few respondents suggested that CSA consider harmonizing any codes or standards adopted with sector regulations (if any), and with international best practice.

CSA has communicated that further industry consultations will be conducted on the development of the incident reporting parameters and applicable cybersecurity codes or standards. CSA remains committed to this.

As stated in the public consultation paper, CSA intends to take reference from international best practices and will work closely with sectoral regulators towards the harmonisation of any new sectoral regulations in Singapore.

Several respondents said that it was unclear from the draft Bill what entities could be designated as ESCI, and that this could create uncertainty. One respondent asked if CSA would reconsider our position on not disclosing the list of ESCI.

The key reason for regulating ESCI for cybersecurity is that they are entities that hold sensitive information and/or play nationally important roles or functions. A cyberattack on these entities could have significant detrimental effect on the defence, foreign relations, economy public health, public safety, or public order of Singapore. As ESCIs could come from a range of sectors, it is important for the proposed draft provisions to be drafted in a manner that would allow CSA to work with these entities on their cybersecurity in our evolving threat landscape.

CSA does not intend to publish the full list of designated ESCI for security reasons. Examples of ESCIs could include autonomous universities. CSA will engage entities before they are designated as ESCI.

Feedback was received on the limits of proposed monitoring powers.

For example, some respondents said that there should be clear boundaries for monitoring powers, and the conditions under which the monitoring powers will be activated. Some respondents also suggested that the exercise of the powers should be limited to ascertaining whether the licensee had complied with licence conditions

The intention of providing monitoring powers for CSA is to ensure that Part 5 of the Act can be properly executed. As a matter of good regulatory practice, CSA will endeavour to inform the licensee the basis for exercising any of the monitoring powers.

CSA does not agree that the exercise of the monitoring powers should be limited to ascertaining whether the licensee had complied with license conditions, as the scope in ensuring the proper execution of Part 5 extends beyond ascertaining compliance with license conditions (such as to assess compliance with the duty to keep proper records or to assess if a license should be revoked or suspended).