CHAPTER 1 Build Resilient Infrastructure Ensure policy and legislative frameworks remain fit-for-purpose to address growing cyber-physical risks The effects of cyberattacks are no longer contained in the digital domain. They are spilling into the physical realm, as evidenced by ransomware attacks on the Colonial Pipeline Company in the US and healthcare services in Ireland and New Zealand. Our policy and legislative frameworks must evolve and adapt to mitigate cyber-physical risks. This includes reviewing the Cybersecurity Act, as well Ensure government systems are secure and resilient To enable public service digitalisation, the Government will ensure that all government systems — including both CIIs and non-CII systems — are resilient, Critical Information Infrastructures in Singapore protected, and trusted by its users. Today, all government systems comply with tailored cybersecurity policies that are reviewed periodically. We will also modernise the cybersecurity architecture of government systems to stay ahead of technological CIIs are digital systems that support the delivery of essential developments. Cybersecurity is not only about technology, but also about people services. Today, CIIs have been identified from 11 critical and organisational processes. We will therefore also raise the level of cybersecurity sectors — Aviation, Banking & Finance, Energy, Government, Healthcare, Infocomm, Land Transport, Maritime, Media, Security & Emergency Services, and Water. competency across Government. We hope that the Government’s risk-based approach towards cybersecurity can serve as a guide for other organisations and enterprises looking to strengthen their cybersecurity posture. To ensure that our essential services are not disrupted by cyber threats, the Government has put in place a three-tier framework to strengthen the cyber resilience of CIIs. • as introducing policy initiatives Review cyber policies and enforce a tiered set of requirements in Government Modernise the cybersecurity architecture in Government Instructional Manual 8 (IM8) is the management The Government is implementing the and build up their capabilities. tool used in Government to safeguard Government Trust-based Architecture government ICT & Smart Systems (ICT&SS) (GTbA) that translates zero-trust Each CII sector has a sector lead, who works closely assets. The IM8 Policy on Security establishes principles to the Government context, tailored security hygiene practices for thereby strengthening the security of government systems, based on a system’s applications and systems. CSA, as the independent national authority on cybersecurity, monitors and regulates the CII sectors. At the same time, CSA actively supports sector leads such as the OT Cybersecurity and CII owners to improve their situational awareness Masterplan and OT Cybersecurity Competency Framework. • with CSA. They are the natural regulators of the CII owners and have a good grasp of the unique operating and business environment — and risks — and Digital Government Group (SNDGG) To complement the GTbA, the Government supports the implementation of IM8 security will operationalise the Government cybersecurity, usability, and cost. controls by providing consultancy services and Cybersecurity Operations Centre (GCSOC) deploying Chief Information Security Officers that can provide real-time monitoring, At the organisational level, CII owners are responsible (CISOs) across Government. The Government increase Government’s situational also conducts regular penetration testing on awareness, and allow a more rapid and government systems as part of the IM8 audit, accurate incident response. of their respective sectors. They are best placed to provide guidance on the appropriate balance point of • classification and criticality. The Smart Nation for managing their cybersecurity risks and are the first line defenders and responders. identifying vulnerabilities to be addressed before potential exploitation. 17 The Singapore Cybersecurity Strategy 2021 18