Singapore Cyber Hygiene Practice — Cybersecurity Code of Practice
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting. Framework text may require a separate license unless explicitly provided.
Overview
The Singapore Cyber Hygiene Practice — Cybersecurity Act Section 26/TM-CC01 establishes baseline cybersecurity requirements for Critical Information Infrastructure (CII) operators in Singapore. The practice defines minimum security controls that CII owners must implement to maintain basic cyber hygiene protecting systems critical to Singapore’s essential services.
Issued under the Cybersecurity Act by the Cyber Security Agency of Singapore (CSA), TM-CC01 applies to owners of designated Critical Information Infrastructure including systems supporting essential services in sectors such as energy, water, banking, healthcare, and transportation. It mandates implementation of prescribed cybersecurity practices across defined control domains.
CII owners implement TM-CC01 by assessing current practices against mandated controls, implementing required security measures, and maintaining compliance evidence for CSA regulatory oversight. The practice integrates with broader NIST CSF and ISO 27001 aligned security programs.
Why it Matters
Singapore’s Cyber Hygiene Practice establishes mandatory baseline security controls protecting critical infrastructure supporting the nation’s essential services from cyber threats.
Key benefits include:
- Meet CII regulatory requirements
Comply with mandatory CSA requirements for Critical Information Infrastructure operators in Singapore.
- Protect critical services
Implement baseline controls protecting systems supporting Singapore’s essential services from cyber attacks.
- Demonstrate security governance
Show CSA organized security program implementation aligned with national cybersecurity requirements.
- Support resilience
Build security foundations supporting continuity of critical infrastructure operations during cyber incidents.
- Enable CSA oversight
Maintain compliance evidence supporting CSA audit and oversight activities under the Cybersecurity Act.
How it Works
TM-CC01 organizes baseline security requirements across control domains including asset management, access control, network security, patch management, configuration management, and incident response. CII owners implement prescribed controls, maintain documentation, and undergo periodic CSA assessments.
Organizations implement TM-CC01 by mapping current security controls against prescribed requirements, addressing gaps, implementing required measures, and maintaining compliance evidence for CSA review.
Key Elements
- Asset Management Controls
Requires inventory and management of hardware and software assets in CII environments.
- Access Control Requirements
Mandates access management controls protecting CII systems from unauthorized access.
- Patch and Configuration Management
Establishes requirements for timely patching and secure configuration of CII systems.
- Incident Response Obligations
Defines incident response requirements including CSA notification obligations.
Framework Scope
Singapore TM-CC01 applies to owners of designated Critical Information Infrastructure in Singapore across ten essential service sectors. Mandatory for all designated CII operators.
Framework Objectives
Singapore’s Cyber Hygiene Practice establishes baseline security controls protecting Critical Information Infrastructure supporting Singapore’s essential services.
- Implement mandatory baseline cybersecurity controls for CII operators
- Protect critical infrastructure supporting Singapore’s essential services
- Enable CSA oversight and regulatory compliance for CII owners
- Build security foundations supporting critical infrastructure resilience
- Align CII security practices with national cybersecurity standards
Common Framework Mappings
Mapped frameworks include:
ISO/IEC 27001
NIST Cybersecurity Framework
Singapore Cybersecurity Act
SOC 2
- ClassicifationCategoryCybersecurityDomainCybersecurityFramework FamilyOther
- Regulatory ContextTypeFrameworkLegal InstrumentCodeSectorCross-SectorIndustryCritical Infrastructure
- Region / PublisherRegionAsia-PacificRegion DetailSingaporePublisherCyber Security Agency of Singapore (CSA)
- VersioningVersionCyber Hygiene Practice (current CSA guidance)Effective Date2021Issue Date2018
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Cyber Hygiene Practice guidance is publicly available through the Cyber Security Agency of Singapore.
How SmartSuite Supports Singapore Cyber Hygiene Practice
Manage Singapore Cyber Hygiene Practice requirements by organizing baseline cybersecurity controls, tracking system hardening activities, and maintaining evidence supporting compliance with essential security measures.
Baseline Security Control Framework
Structure Cyber Hygiene controls with ownership, scope, and implementation tracking across systems.
Asset Management and System Visibility
Track hardware, software, and network assets to ensure coverage of required security controls.
Secure Configuration and Patch Management
Manage configuration baselines, patching activities, and vulnerability remediation workflows.
Access Policy and Least-Privilege Enforcement
Enforce user access policies, authentication controls, and least-privilege practices.
Security Monitoring and Incident Response
Track logging, monitoring, and incident response activities aligned to regulatory expectations.
Cyber Hygiene Compliance Reporting
Provide dashboards showing control coverage, system posture, and Cyber Hygiene compliance readiness.
Related frameworks
CIS Controls v8.1 provides prioritized, practical security actions to help organizations mitigate common cyber threats and strengthen defenses.
ISO/IEC 27001:2022 is an international ISMS standard that helps organizations manage information security risks and protect data.
ISO/IEC 27002:2022 provides best-practice information security controls to help organizations select, implement, and manage protections for information assets.
ISO/IEC 27017 provides cloud-specific security controls to help organizations protect data and manage cloud-related risks.
ISO/IEC 27701 extends ISO/IEC 27001 to help organizations manage privacy and protect personally identifiable information.
MITRE ATT&CK is a knowledge framework documenting adversary tactics and techniques to help organizations detect, analyze, and respond to attacks.
Frequently Asked Questions For Singapore Cyber Hygiene Practice (Cybersecurity Code of Practice)
The Singapore Cyber Hygiene Practice — Cybersecurity Code of Practice establishes mandatory baseline cybersecurity requirements for Critical Information Infrastructure (CII) operators. It is used to secure information systems and essential services against cyber threats, ensuring protection of Singapore’s vital infrastructure.
Yes, compliance with the Cyber Hygiene Practice — Cybersecurity Code of Practice is mandatory for organizations designated as CII operators under the Singapore Cybersecurity Act. Non-compliance may result in regulatory enforcement actions and penalties as specified by the Cyber Security Agency of Singapore (CSA).
The Code of Practice applies specifically to CII operators in Singapore, covering sectors such as energy, healthcare, transport, water, and telecommunications. These are organizations whose systems are critical to national security, the economy, or public safety.
Key controls include asset management, access control, patch and vulnerability management, logging and monitoring, and formal incident response procedures. The framework requires the implementation of technical and organizational safeguards to address security risks identified through risk assessment.
Organizations begin by conducting risk assessments, inventorying assets, and mapping controls to business processes. Implementation includes deploying security controls, maintaining up-to-date system configurations, continuous monitoring, and conducting regular audits to verify compliance.
The Cyber Hygiene Practice can complement global standards such as ISO 27001 or NIST by providing sector-specific, mandatory requirements in addition to general best practices. Organizations can leverage existing security management systems to help address overlapping controls and streamline compliance efforts.
Ongoing compliance involves periodic security assessments, maintaining documentation, continuous monitoring, vulnerability remediation, incident response readiness, and prompt reporting to the authorities as required by the Cybersecurity Act and CSA guidance.
SmartSuite helps organizations manage the Cyber Hygiene Practice by enabling centralized risk tracking, control management, and compliance documentation. It facilitates evidence collection, automates audit readiness, and provides real-time reporting and dashboards to support governance and demonstrate adherence to regulatory requirements.
Put CRI Profile into action with SmartSuite
Map controls, collect evidence, run assessments, manage remediation, and report readiness - all from a single connected system.