Singapore Cybersecurity Strategy 2026 – What Organisations Should Know About Cybersecurity Standards and Resources

Introduction

Digital technologies play a vital role in how we work and interact. Singapore’s dependence on digital systems means that vulnerabilities and disruptions can have a significant impact on its economy and public services. The Government has thus put strong focus on Singapore’s cybersecurity, including the introduction of the Singapore Cybersecurity Strategy (“SCS“) in 2016.

In recent years, cyber threats have been growing more severe, with the rise of Advanced Persistent Threat (“APT“) actors, as well as the transformative impact of artificial intelligence (“AI“) and quantum computing. These threats are exacerbated by increasingly complex technology dependencies and geopolitical tension.

In light of this, Singapore has launched SCS 2026 on 14 October 2026, updating the SCS to respond to the evolving cyber landscape. SCS 2026 sets out four strategic pillars, supported by two foundational enablers:

• • Pillar 1: Defend critical infrastructure
  • Pillar 2: Secure our wider cyberspace
  • Pillar 3: Strengthen capabilities for AI and quantum 
  • Pillar 4: Enhance resilience through global partnerships 
  • Enabler 1: Build a world-class cybersecurity ecosystem 
  • Enabler 2: Level up our cyber workforce

SCS 2026 sets the direction for Singapore’s cybersecurity, but what does it mean for businesses in Singapore? In this regard, businesses should: (i) keep track of the changing cybersecurity legislation, guidelines and obligations to ensure compliance; (ii) capitalise on the resources that will be made available to them in the development of their cybersecurity capabilities; and (iii) be aware of the ongoing national cybersecurity initiatives.

This Update highlights the key features of SCS 2026 and sets out the next steps that businesses should take in their cybersecurity journey.

Pillar 1: Defend Critical Infrastructure

Singapore’s Critical Information Infrastructure (“CII“) provides essential services for Singaporeans. To reinforce CII resilience, SCS 2026 aims to strengthen national cyber defence through centralised capabilities, and to uplift CII owners’ capabilities.

National capabilities: The Cyber Security Agency (“CSA“) is building a National Cybersecurity Command Centre to combine threat intelligence from government, CII owners, commercial firms and international partners. A Digital Defence Hub will help CII owners deal with APTs.

Legislative changes: The Government will update cybersecurity standards to keep pace with evolving threats.

• • The Cybersecurity Act 2018 and the Cybersecurity Code of Practice (“CCoP“) will be strengthened.
  • Sector-specific obligations will be tightened.
  • Supervision and assurance will become more continuous and risk-based.
  • The Government will review its powers to take pre-emptive action, such as proactive scanning and taking down malicious infrastructure. 

Support for CII owners: The Government will support CII owners in building up their threat detection, mitigation and response capabilities. This includes:

• • sharing of classified threat intelligence;
  • government monitoring of CII owners’ attack surfaces and continuous testing of their security controls;
  • deployment of a threat detection system; and
  • co-funding for commercial network detection and response tools, and for AI-enabled defence tools. 

Workforce and leadership: CSA will curate cybersecurity training for CII board members and senior executives. CSA will also continue to support leadership programmes for cybersecurity practitioners. 

Pillar 2: Secure Our Wider Cyberspace

This pillar aims to raise the level of cybersecurity across Singapore’s entire ecosystem, beyond just CII owners, to protect businesses, organisations and individuals. To achieve this, the Government will protect upstream to minimise organisations’ and individuals’ exposure to cyber threats, as well as drive organisations to strengthen their cybersecurity posture.

Upstream protections: A national Protective Domain Name Service will automatically block access to known malicious domains. The Singapore Police Force (“SPF“) will also detect and disrupt scam websites at scale using their Scam Analytics and Tactical Intervention System.

Internet of Things devices: By the end of 2027, all home routers sold in Singapore must reach at least Level 2 under the Cybersecurity Labelling Scheme (“CLS“). A minimum level for IP cameras is being considered, and the requirements may later extend to other devices. 

Scams: The SPF Cyber Command was set up on 3 July 2026, bringing together SPF’s anti-scam and cybercrime capabilities. A National Scams List will be established to let the Government share scam indicators with industry partners including banks, telcos and digital service providers.

Higher-risk organisations: Organisations such as government vendors managing critical systems or sensitive data will have to adopt the Cyber Essentials Mark, the Cyber Trust Mark or equivalent standards.

Support and insurance: The Government will continue to equip organisations with practical tools and support to uplift their own cybersecurity posture, such as the Chief Information Security Officer (“CISO“)-as-a-Service and the Infocomm Media Development Authority’s SMEs Go Digital programme. The Government will also explore cyber insurance pilots. 

Help for Small and Medium Enterprises (“SMEs”): The Government will support SMEs in their cybersecurity efforts.

• • The Singapore Business Federation’s Cyber Resilience Centre, set up in October 2025, offers health clinics, cyber drills and recovery support.
  • A Cyber Incident Helpline will be launched in 2026 to provide organisations with practical assistance when cyber incidents occur. It will provide initial incident triage, advisory support and referrals to relevant service providers and resources, helping organisations understand the next steps to contain an incident and begin recovery.

Pillar 3: Strengthen Capabilities for AI and Quantum

With disruptive technologies such as AI and quantum computing reshaping cybersecurity, the Government seeks to leverage AI to strengthen cyber defence, support the secure adoption of AI, and prepare upstream for quantum-enabled threats.

AI tools for cyber defence: The Government will invest in building the capabilities needed to use leading AI models securely for cyber defence. Government-developed tools include:

• • CSA’s AEGIS attack surface scouting tool and JEWEL AI-assisted web testing specialist;
  • GovTech’s MAIA AI-assisted penetration testing capability; and
  • Centre for Strategic Infocomm Technologies’ AETHER malware analysis tool. 

Support for adopting AI tools: The Government will support wider adoption of AI-enabled cybersecurity capabilities across organisations, with priority given to CII owners. Support includes funding through the AI for Cyber Experimentation Sandbox, access to government tools where appropriate, and published guidance. 

Government resources on securing AI systems: Organisations can draw on government resources to guide them in the securing of their AI systems. This includes:

• • Security Assessment Handbook for Coding Assistants, which provides security practitioners and developers with a practical methodology to assess the security of agentic AI coding assistants and determine appropriate safeguards for their deployments;
  • 2024 Guidelines and Companion Guide on Securing AI Systems, which lays out the foundational security principles for system owners to secure the use of AI;
  • June 2026 Addendum on Securing Agentic AI, which outlines practical controls to mitigate agentic AI risks; and
  • TR 147, issued on June 2026, which sets out cybersecurity practices for large language model (LLM) applications, whether built in-house or bought from third parties.

For more information, see our October 2024 Update on “CSA Launches Guidelines on Securing Artificial Intelligence Systems” and our July 2026 Update on “CSA Releases Addendum on Securing Agentic AI”.

Quantum-safe migration: The Government will accelerate national quantum-safe migration by working with the industry to plan, prioritise, and execute the transition.

• • CII owners must meet three milestones: (i) submit migration plans to CSA by 31 March 2027; (ii) factor quantum-safe considerations into the procurement of new CII systems from 1 January 2028; and (iii) complete migration by 31 December 2031.
  • Other organisations exposed to quantum risks are encouraged to complete migration by 2035.

The Government has provided resources to help organisations move from quantum-safe planning to implementation.

• • The first is the Advisory on Quantum-Safe Migration for Organisations, which outlines practical and low-risk steps drawn from CSA’s Quantum-Safe Migration Handbook.
  • The second is the Quantum-Safe Kickstarter Grant, which provides time-bound seed funding for organisations to pilot quantum-safe solutions and address practical migration challenges.

Pillar 4: Enhance Resilience Through Global Partnerships

To strengthen Singapore’s position in a fragmented digital world, the Government will advance cyber diplomacy, rules-based cyber cooperation, and cooperation with major technology firms to co-create solutions. 

International forums: Singapore International Cyber Week, Asia-Pacific’s most established cybersecurity event, will continue. A new Digital Defence Symposium will also be set up.

Regional and multilateral cooperation: Singapore will continue to support the ASEAN-Singapore Cybersecurity Centre of Excellence (“ASCCE“). In particular, Singapore has announced that it will commit a further S$30 million over the next five years to strengthen regional cybersecurity capacity building through the ASCCE. The programmes will focus on priority areas including cyber incident response, protection of CII, AI-related cybersecurity risks and cyber diplomacy.

Industry partnerships: Singapore offers itself as a testbed through regulatory sandboxes, innovation challenges and outcome-based procurement. Priority areas include agentic AI security, Operational Technology (“OT“) protection, cloud resilience, software supply chain assurance and quantum-safe migration. 

Cloud guidance: CSA has worked with Cloud Service Providers (“CSPs“) to produce CSP-specific guides to the Cybersecurity Code of Practice for Cloud Services.

Enabler 1: Build a World-class Cybersecurity Ecosystem

The Government aims to develop stronger local capabilities for national resilience amidst greater geopolitical contestation, moving from broad-based help to a targeted focus on priority capabilities. 

Company programmes: The Government will focus existing programmes under the CyberSG Talent, Innovation and Growth Collaboration Centre on AI-enabled security and quantum-safe migration.

Industry alignment: A new CyberSG CISO Advisory Committee will help match innovation to real industry needs. 

Research programmes and testbeds: Two Signature Programmes in AI security and OT security will run under the National Cyber Research & Development Programme. The testbeds iTrust, the National Cybersecurity Lab and the National Integrated Centre for Evaluation (NiCE) will be enhanced. 

Foreign firms: The Government will attract leading international firms to embed sophisticated cybersecurity capabilities within the local ecosystem through government use cases, formalised arrangements, and incentives.

Enabler 2: Level Up the Cyber Workforce

Over the next five years, Singapore aims to professionalise the cybersecurity workforce, deepen national cyber capabilities, and broaden the national cyber talent pipeline. 

Professional accreditation: A Cybersecurity Professional Accreditation Framework (“CPA Framework“) will be piloted from the second quarter of 2027. The CPA Framework will establish clear professional standards and recognise the competencies of cybersecurity professionals.

• • As a first step, CSA will establish a national cybersecurity competency framework that covers different cybersecurity roles and proficiency levels.
  • Building on these competency standards, the CPA Framework will enable cybersecurity professionals to seek professional titles relevant to their areas of specialisation. 

Skills frameworks: The ICT Skills Framework for Cybersecurity and the OT Cybersecurity Competency Framework will be refreshed to include AI-related competencies. 

Training for CII owners: CSA is rolling out training for boards, CISOs and practitioners. 

What Businesses Should Look Out and Prepare For

SCS 2026 has significant implications for businesses. Here, we highlight the key elements that businesses should look out and prepare for.

• • CII owners should expect stricter regulation. The Cybersecurity Act 2018 and the CCoP will be strengthened, sector obligations will be tightened and supervision will become more continuous. CII owners should also review their governance, monitoring and board oversight.
  • Diarise the quantum-safe deadlines. CII migration plans are due by 31 March 2027, procurement must factor in quantum-safe requirements from 1 January 2028 and migration must be complete by 31 December 2031. Other organisations should aim to finish by 2035.
  • Vendors and suppliers should get certified. Government vendors and suppliers to CII owners should expect to need the Cyber Essentials Mark, the Cyber Trust Mark or equivalent, possibly enforced through procurement rules.
  • Device makers and retailers should check CLS compliance. Home routers must reach at least CLS Level 2 by the end of 2027, and IP cameras may be next.
  • Put AI governance in place. Organisations seeking to develop and deploy AI tools should utilise available government resources, such as the Guidelines on Securing AI Systems, the Agentic AI Addendum and TR 147.
  • Manage your technology dependencies. Map supply chain and third-party risks and keep business continuity plans up to date.
  • Use the support available. The Government has provided a slew of support measures that organisations should consider, including CISO-as-a-Service, SMEs Go Digital, the Cyber Resilience Centre and its Cyber Incident Helpline, and the AI for Cyber Experimentation Sandbox.
  • Invest in your people. Ahead of the implementation of the CPA Framework, organisations should plan for accreditation and train boards and staff.

Concluding Words

It has been amply demonstrated that cybersecurity is not an optional matter for businesses and organisations; rather, it should be a priority focus. The threats of cybersecurity lapses are real – CSA’s Singapore Cybersecurity Health Report 2025, released on 14 October 2026, revealed that cyber incidents remain widespread, with almost nine in 10 organisations surveyed reporting at least one incident in 2025. Tellingly, the report also found room for improvement in the adoption of essential cybersecurity measures. Adoption of essential cybersecurity measures remains uneven across the five categories under CSA’s Cyber Essentials Mark, and organisations continue to face practical challenges in strengthening their cybersecurity.

Businesses should be guided by SCS 2026 to set the course for their cybersecurity efforts and frameworks. With the ever-changing nature of cyber threats, businesses must keep ahead of the curve to ensure that they do not fall behind in race against threat actors. Parties with further queries on SCS 2026 or other cybersecurity matters should feel free to contact our team set out on this page.

For regional technology law matters, please see Rajah & Tann Asia’s Regional Data & Digital Economy Practice for more information.