Introduction to Cybersecurity Act by NTUC LearningHub

Background and Circumstances on why the Act was enacted

• Objectives of the Act
• Reasons why the Act came about
• Global development and standards

Key legislative requirements of the Act

• Definition of what constitutes Essential Services and what makes up the Critical Information Infrastructure

• • Definition of what is a cybersecurity threat and cybersecurity incident

• • Computers and systems are considered Critical Information Structure

• • Services that are considered essential services

• Regulation and obligations of owners of Critical Information Infrastructure (CII)

• • Duties of owners of CII, including

• • •   Compliance with any codes of practice implemented the Commissioner

• • •   Giving information relating to CII

• • •   Notification obligations

• • •   Carrying out risk assessments, regular audits and exercises

• • Effect of rules of professional conduct, privilege or immunity on disclosure obligations

• • Appeals to the Minister

• Responses to cybersecurity threats and incidents

• • Power to investigate

• • Duties of incident response officer

• • Statements made by persons during investigations

• • Severe cybersecurity threats or incidents

• • Emergency cybersecurity measures

• The Licensing regime for Cybersecurity Providers

• • Cybersecurity services that need to be licensed

• • Requirements for individuals or businesses to qualify for a license

• • Conditions for license

• • Record-keeping requirements

• • Revocation and suspension of license

• The duties and powers of Commissioner of Cybersecurity, including the power to exercise and duty to take possession of computers and equipment
• Offences and penalties under the Act

• • Unlicensed cybersecurity service providers

• • Financial penalties

• • Liability for offences by corporations

• • Liability of unincorporated associations or partnerships

• • Power of officers to enter into premises for searches, etc.

• Preservation of secrecy
• Protection for informers
• Effect of provisions under the Computer Misuse & Cybersecurity Act

Potential issues in implementation and application of the Act

• Issues on the effect of Act on existing laws, especially personal data protection and privacy laws
• Whether organisations will be additionally burdened by obligations under the Act
• Implications on innovation, e.g. for startups

Develop a Process to detect and report cybersecurity threats and incidents

• Factors to consider
• Example of a workflow to detect and report threats and incidents

Training and Communications to Staff

• Considerations when developing a Training and Communications Plan
• Example of a Training and Communications Plan