disclosure of such information, except that the performance of a contractual obligation is not an excuse for not disclosing the information. (7) The person examined under this section or to whom a notice under subsection (2) or an order under subsection (5) is issued, is not treated as being in breach of any contractual obligation mentioned in subsection (6) for doing or omitting to do any act, if the act is done or omitted to be done with reasonable care and in good faith and for the purpose of answering any question asked during the examination or complying with the notice or order. (8) Any person who — (a) wilfully misstates or without reasonable excuse refuses to give any information, provide any statement or produce any record, document or copy required of the person by an incident response officer under subsection (2); or (b) fails, without reasonable excuse, to comply with an order issued by a Magistrate under subsection (5), shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 6 months or to both. (9) In this section and sections 20, 21 and 22, “incident response officer” means the Commissioner, the Deputy Commissioner or any Assistant Commissioner, cybersecurity officer or authorised officer exercising the powers under this section or section 20, as the case may be. Powers to investigate and prevent serious cybersecurity incidents, etc. 20.—(1) Where the Commissioner receives information regarding a cybersecurity threat or incident which satisfies the severity threshold in subsection (3), the Commissioner may exercise, or may authorise the Deputy Commissioner, an Assistant Commissioner, a cybersecurity officer or an authorised officer to exercise, such of the powers mentioned in subsection (2) as are necessary to investigate the cybersecurity threat or incident, for the purpose of — (a) assessing the impact or potential impact of the cybersecurity threat or incident; (b) eliminating the cybersecurity threat or otherwise preventing any or further harm arising from the cybersecurity incident; or (c) preventing a further cybersecurity incident. (2) The powers mentioned in subsection (1) are the following: Singapore Statutes Online Published in Acts Supplement on 12 Mar 2018 PDF created date on: 30 Aug 2022