Board members of critical services operators must go for cyber security training

They must also enhance supervision over critical information infrastructure: Minister

- Sarah Koh

Board members of the operators of critical services in Singapore will need to go through cyber security training, as part of new requirements that will be codified within the first quarter of 2026.

These board members will also need to enhance their supervision and responsibility over the critical information infrastructure (CII) as well as adjacent systems, said Minister for Digital Development and Information Josephine Teo on Nov 12.

These critical sectors include energy, healthcare, telecommunications, finance and media.

Chief information security officers should also be provided direct access to the board as part of the updated Cybersecurity Code of Practice, said Mrs Teo, adding that threat actors will stop at nothing to steal data from CII operators and disrupt services.

The updates come after the Government announced in October that it will be sharing classified threat intelligence with these organisations to prevent cyber attacks that could jeopardise national security.

"What we would like for CII owners to do is to have a clear-eyed view of what they are up against, and to take the necessary action to better protect Singaporeans," said Mrs Teo.

Speaking on the sidelines of the annual Critical Infrastructure Defence Exercise (Cidex) for the nation's 11 critical sectors, she said the update comes at a time when the threat landscape has shifted considerably. The code was last updated in 2022.