private buildings and other facilities in the center of commerce NCSP and industry”. The 2022 expanded this list and adopted the Cll list from the Cybersecurity Singapore . The list includes, but not limited to, government business media, and emergency services, The term national security system process outsourcing, healthcare, banking, financial, bower, telecommunications, “any information’? system water, transport and logistics. This was also classified according Services, Strategy of CLASSIFICATION OF NATIONAL SECURITY SYSTEM telecommunication by any agency to system) used or operated to a third party security risk, and cybersecurity The function, operation or use of which: commitment to national security; adopting clear policy objectives at the iii. Involves Command highest level of government. The strategy shall include the steps to enhance security level components of information system and networks that constitute Cll. Risk assessment shall be conducted based on the Risk Assessment approach, the government and Approach. The its risks in the of the strategy, planning, management, reporting processes, policies, values and culture”°. control of military forces; Guidelines for implementing management of a weapon or weapons system; or approach by the government v. Critical to the direct fulfillment of military must conduct the three stages of risk assessment: is risks. The management implementation, on its mission critical To implement the risk-based management for Cll protection shall manage policy based tional environment needs. risk must be integrated into the overall governance, iv. Involves equipment that is integral part the applications). protection of the Cll by identifying, analyzing, ii. Involves cryptologic activities related to protect itself and public Cll starts with objectives, business processes and opera- management and evaluating i. Involves intelligence activities; Furthermore, government’s agement personnel government The function, operation, or use of which: risk. limited to payroll, finance, logistics, and through the Risk Management security risk, network security risk, Internet resiliency to operate against information and Cll owners Shall formulate their risk man- The methodologies by an agency”: Utilities, and Transport that cuts across all sectors. Our Cll must have the DICT. Under the guidelines, critical systems business applications (including but not RISK MANAGEMENT APPROACH means, (including or outsourced that are used for routine administrative and identification, analysis, and evaluation. In the formulation of the risk evaluation criteria, the primary and mandatory consideration shall be on the NSS and Cll. The risk management policy that government agencies shall develop appropriate to their agency’s mandate and mission, must be aligned with NCSP vision and mission objectives. the risk shall be formulated through or intelligence missions. analysis of vulnerabilities and threats to the Cll. A periodic review on the national risk Protected management established for information that have been process will help implement the risk management strategy at every level. at all times by procedures specifically authorized under criteria in an Executive Order or an Act of Congress to be It is however emphasized, that the owners of Clls will have the primary responsibility to secure and protect these systems. The government can only do so much having very limited resources such as manpower financial resources. and But together with other kept classified in the interest of national security or foreign policy. Exclusions from National Security System Clarification There is also the need to have a distinction system and Cll owners, we will be able to between create multi-layers of security and defend our and those that are not covered cyberspace and protect our Cll. a National Security System (NSS) by the parameters for classifying the NSS. The systems that are not included are systems 18 Singapore’s Critical Infrastructure Sectors, Singapore’s Cybersecurity Strategy, pp. 11 19 National Institute of Standards and Technology. (2003). Information Security: Guideline for Identifying an Information System as a National Security System (NIST-SP 800-59). U.S. Department of Commerce. Barker, W.C. 20 International Organization for Standardization. (2012). Risk Management 31000:2009). Published in Switzerland. 28 — Principles and Guidelines (ISO/IEC 29