Singapore has just raised the bar for protecting critical services, and this is not a polite reminder — it is a directive with teeth. New mandatory rules under the updated Cybersecurity Code of Practice will force owners of critical infrastructure to change how decisions are made, how risks are detected, and how resilience is designed. The government is not experimenting; the response is surgical, rapid and uncompromising.
Why this matters now
The recent breach attributed to the state‑sponsored group UNC3886 against four major telcos served as a brutal wake‑up call. A homegrown intrusion detection tool, developed by the Ministry of Defence’s Centre for Strategic Infocomm Technologies, has already been pushed into select systems. That move signals one thing unmistakably: advanced persistent threats are expected, and local solutions will be part of the frontline defence.
Advances in artificial intelligence have turned what used to be careful, patient reconnaissance into lightning‑fast exploitation. Models that can search for unknown vulnerabilities and even craft exploits mean attackers can operate at a scale and speed that was impossible a few years ago. A recent report from Check Point Research highlights how automation is already shouldering the heavy lifting for cyberattacks. This is not a hypothetical future. It is the present.
“Sophisticated threat actors will be relentless in their search for vulnerabilities and will not hesitate to exploit every opening to go in deep into interconnected systems.” — Minister Josephine Teo
Boardroom accountability: no more token representation
Old practice: assign one director to nod knowingly at every briefing and tick a box. New reality: the entire board is now on the hook. The updated code requires full board engagement, not just cursory oversight. Every director must understand the organisation’s cyber risk posture, review a documented cyber resilience framework annually, and be able to explain risk tolerance, mitigation and recovery strategies.
That shift from siloed responsibility to collective accountability will sting at first. Boards that treated cybersecurity as an IT problem will be forced to treat it as a core business risk. That is the correct approach — and it is overdue.
Standards raised: Cyber Trust mark level 5 and cloud rules
Non‑CII systems that support CII operations must secure the Cyber Trust mark level 5 within a fixed window. Level 5 is not symbolic; it demands readiness across 22 domains, from governance to secure access controls. CII owners have until the end of 2027 to comply. Consider this an institutional sprint. Time is finite, and the checklist is rigorous.
On the cloud front, a legally binding code will arrive later in 2026 to mandate vendor safeguards and operational controls for CII systems hosted in the cloud. Companion guides, co‑authored with major cloud providers, will clarify how to implement requirements in AWS, Google Cloud and Microsoft Azure environments. Those guides will be practical playbooks — but responsibility remains squarely with the CII owners.
What this means for SMEs supporting CII
Small and medium enterprises that feed into critical services can no longer be complacent. Expect tighter scrutiny from customers and partners. Expect audits and contractual demands for higher assurance. And expect to be part of supply chain compliance conversations that were previously optional.
- Inventory every asset, map dependencies to CII services and prioritise based on impact.
- Segment networks and enforce least privilege — keep breaches contained.
- Adopt robust detection and response tooling; look for integration with national detection frameworks where possible.
- Prepare governance documentation: risk appetite, playbooks, recovery timelines and escalation paths.
- Plan for certification timelines now; treat the Cyber Trust mark as a project with milestones, not a checkbox.
Anecdote from the field
At a closed briefing not long ago, a CEO watched a timeline of an attack unfold across screens. Each slide pulled the room tighter: reconnaissance, lateral movement, data staging. The CEO’s silence said more than words. That pause was a small, concentrated moment of shock and clarity — the kind that compels change faster than policy memos ever could. Decision‑makers left that room with a new urgency; board agendas were rewritten within days.
Practical next steps — be decisive
This is not the time for tentative pilots. Start with governance and detection. Patch the obvious holes. Run tabletop exercises and then run them again under stress. Bring the board into a focused session on cyber risk before the next quarterly meeting. Engage cloud vendors early and demand clarity on shared responsibility. Translate technical controls into business outcomes, and then hold leadership accountable for delivery.
Regulation is tightening because threats have evolved. The new code turns policy into mandate, and that’s intentional. Organisations that respond with speed, discipline and transparent governance will survive. Those that treat rules as burdens will discover painfully fast that breaches are expensive, reputationally debilitating, and wholly avoidable with the right resolve.
Act now. Build resilience. Make accountability non‑negotiable. The future of critical services depends on it.