IMDA Issues New Guidelines for Cloud Services and Data Centres

Cloud service and data centre operators must perform background checks of all employees and due diligence on third-party service providers under new advisory guidelines released by the Infocomm Media Development Authority (IMDA) on Feb 25.

- Lee Li Ying

The move comes as the Government seeks to fortify the digital infrastructure that underpins key services such as banking, e-commerce and telecommunications, and mitigate the risk of damage to Singapore's economy and digital way of life from infrastructure outages.

Parts of these guidelines are likely to be incorporated into the upcoming Digital Infrastructure Act that will hold cloud service providers and data centre operators accountable to higher security and resilience standards. The Act is set to be tabled in Parliament later in 2025.

The new legislation was first mooted in March 2024 on the back of widespread outages of digital services both locally and overseas.

In October 2023, more than 2.5 million payment and ATM transactions could not be completed by two banks due to a fault in the cooling system of a data centre used by the banks.

In April 2023, a fire in a Global Switch data centre in Paris brought down Google Cloud services in Europe for weeks for some customers.