Singapore Holds CII Senior Management Accountable for Cybersecurity Breaches

On July 22, 2026, Singapore's Minister for Digital Development and Information, Josephine Teo, announced updates to the Cybersecurity Code of Practice for Critical Information Infrastructure (CII) owners. The updates mandate that senior management be held directly accountable for cyber resilience, emphasizing the need for continuous monitoring and proactive threat detection. This initiative responds to the increasing use of AI by malicious actors to exploit vulnerabilities in CII systems. The updated code requires CII owners to maintain a documented cyber resilience framework and achieve Cyber Trust Mark Level 5 certification. The changes reflect a shift from perimeter defenses to active threat management, addressing the vulnerabilities that arise from poor cyber hygiene. The Cyber Security Agency of Singapore (CSA) will also release a new code for cloud services later this year. These measures aim to enhance the overall cybersecurity posture of critical sectors, including energy, healthcare, and finance.

Key Points: • Senior management of CII owners will be held accountable for cybersecurity breaches. • The updated Cybersecurity Code of Practice emphasizes continuous monitoring and proactive defense. • New guidelines will address vulnerabilities exploited by AI-driven cyber threats.