CII Designation in Singapore: A Cybersecurity Act Guide

Nobody applies to become a CII owner. The designation finds you: the Commissioner of Cybersecurity reviews organisations whose systems support essential services and designates the ones the country cannot afford to lose. Some companies find out during a sector regulator's onboarding. Others discover it when a CSA officer makes contact about systems they have operated for years. Either way, the duties are statutory, the deadlines are real, and the penalties for ignoring them are not.

This guide walks through the designation regime under the Cybersecurity Act 2018, as amended, what the law requires of designated owners, and how the Cybersecurity Code of Practice 2026 changes the compliance picture. If you have already been designated, the practical question is what to do next; there is a section for that too.

What counts as CII under the Act

The Act defines critical information infrastructure as a computer or system necessary for the continuous delivery of an essential service, where loss or compromise would have a debilitating effect on the availability or integrity of that service, or on national security, defence, foreign relations, the economy, public health, public safety, or public order. Two parts of that definition do the work. The first is the service test: the Act protects the delivery of the service, not technology for its own sake. The second is the consequence test: the harm must be debilitating, which is why a thousand-company sector contains a much smaller set of designated owners.

The Act also reaches beyond the machines. Obligations attach to the designated operator, and they cover the people and processes around the systems, not just the systems themselves.

Which sectors have CII

The First Schedule to the Act lists the sectors in which essential services exist. They include energy, info-communications, water, healthcare, banking and finance, security and emergency services, aviation, land transport, maritime, and media. The list tells you where designations are possible, not which companies hold them; CSA does not publish a register of CII owners, for reasons that should be obvious.

Two consequences follow. First, operating in a listed sector does not make you a CII owner; designation is a case-by-case decision on the specific systems and the specific consequences of losing them. Second, the amended Act added categories beyond the classic list, including systems of temporary cybersecurity concern and entities of special cybersecurity interest, which let the regulator examine and impose duties below the full CII threshold. Cloud providers can now be designated as responsible for third-party CII. The perimeter is wider than it was in 2018.

How designation works

The Commissioner reviews organisations against the statutory criteria, working with sector regulators, and issues a written notification of designation. The notification prescribes the computer or systems to which the CII duties apply, and the obligations attach from that point. Designation is not permanent wallpaper: CSA reviews designations, and they change when the business, the service, or the systems change. Companies that acquire, divest, or migrate infrastructure should expect the designation to be revisited.

What triggers a fresh look? Sector regulator engagement, market entry into an essential service, and infrastructure changes large enough to alter the consequence picture. An organisation that thinks it may meet the test can raise the question with CSA directly; the review does not require an application, but a self-assessment helps the conversation. We support that preparation work through cybersecurity risk assessments in Singapore, which map the essential-service dependency and consequence picture the Commissioner will examine.

The obligations that attach

Once designated, a CII owner carries standing statutory duties:

• Incident reporting. Prescribed cybersecurity incidents must be reported to the Commissioner within regulated timeframes, and "prescribed" is broader than most teams assume before their first tabletop exercise.
• Periodic risk assessments and audits. Cybersecurity risk assessments and audits run on a regulated cycle, by approved or competent assessors, with findings tracked to closure.
• Periodic penetration testing. Live testing of the designated systems on a regulated cycle, with remediation evidence. CREST-certified testing is the recognised form for regulated engagements in Singapore.
• Compliance with the Code of Practice. The Cybersecurity Code of Practice sets the control baseline for CII, and it was rewritten in 2026 (more below).
• Changes notified. Changes to the designated systems, and to the business circumstances behind the designation, must be reported so the regulator's picture stays current.

Breach these duties and the enforcement path runs through financial penalties under the Act, with directional powers on top: the Commissioner can require remediation of non-compliant systems. The larger cost, in practice, is the sector regulator's loss of confidence, which outlasts any fine.

CCoP 2026: what changed for CII owners

CSA released the Cybersecurity Code of Practice 2026 on 29 July 2026, superseding the 2022 version. The full clause-by-clause comparison is in our CCoP 2026 analysis; the short version for a designated owner:

• The perimeter grew. New Section 12 imposes CII-grade controls, from asset inventory through monitoring, on systems interconnected to CII even when those systems are not themselves designated. Compliance lands on 29 July 2027.
• The board is on the hook. Clauses in Section 3 require a board-level cyber resilience framework covering risk tolerance, mitigation, transfer, and recovery, with senior management accountability, board training, and threat briefings every six months.
• Certification is now mandatory at the top tier. Clause 3.3.1 requires Cyber Trust Mark Advocate (Tier 5) certification or its equivalent; existing CII owners must certify by 31 December 2027.

During the transition, existing CII owners keep complying with the previous Code until the new dates bite. The practical read: Section 12 is the largest workload for most owners, because enterprise systems that were never held to CII-grade controls now are.

Practical next steps for a newly designated owner

1. Read the designation letter closely. It prescribes which systems carry the duties. Everything starts from that scope, and misunderstandings about it cause most early friction.
2. Gap assessment against CCoP 2026. Measure the designated systems and their interconnected estate against the 2026 Code, not the 2022 one the transition still runs on; the 2027 dates arrive faster than remediation programs do.
3. Stand up incident reporting. The statutory reporting clock starts when an incident is detected, which rehearsed teams can meet and unprepared ones cannot. Test the path before you need it.
4. Calendar the testing cycles. Risk assessments, audits, and penetration testing all run on regulated cycles. Missing a cycle is a compliance finding in itself, so treat the calendar as a control.
5. Brief the board properly. The CCoP 2026 governance clauses expect structured, documented board engagement. Waiting until enforcement is the expensive version of learning this.

Support for each of these steps, from gap assessment through Section 12 remediation and Cyber Trust Mark readiness, sits in our CCOP compliance practice for Singapore CII owners.

CII and the Cybersecurity Act: FAQ

What is Critical Information Infrastructure in Singapore?

Under Singapore's Cybersecurity Act, CII is any computer or system that is necessary for the continuous delivery of an essential service, and whose loss or compromise would lead to a debilitating effect on the availability or integrity of that service, or on national security, defence, foreign relations, the economy, public health, public safety, or public order. The designated operator, not the technology alone, is regulated.

Which sectors have CII in Singapore?

The Act's First Schedule lists sectors in which essential services exist, including energy, info-communications, water, healthcare, banking and finance, security and emergency services, aviation, land transport, maritime, and media. Operating in a listed sector does not make a company a CII owner; designation is a case-by-case decision by the Commissioner, based on the service and the consequences of its loss.

How does an organisation become a CII owner?

The Commissioner of Cybersecurity reviews organisations against the statutory criteria and designates those whose systems meet the essential-service test. The organisation receives written notification of its designation, the duties attach from that point, and the regulator prescribes the computer or systems to which the CII obligations apply. CSA also reviews designations periodically, so they can change as the business changes.

What are the obligations of a CII owner under the Cybersecurity Act?

Core duties include reporting prescribed cybersecurity incidents within regulated timeframes, conducting regular cybersecurity risk assessments and audits, performing penetration testing on a regulated cycle, and complying with the Code of Practice for CII. CCoP 2026 added Section 12 controls for systems interconnected to CII, board-level cyber resilience duties, and a Cyber Trust Mark Advocate certification deadline of 31 December 2027 for existing CII owners.

Does CCoP 2026 apply to organisations that are not CII owners?

The Code binds CII owners directly. Its reach extends further: Section 12 imposes CII-grade controls on systems that communicate with or connect to CII even when those systems are not designated, which pulls suppliers, vendors, and subsidiaries into scope. Organisations below that threshold are not regulated by the Act, but the controls cascade through procurement expectations.