Cybersecurity Act 2018 · 2020 Revised Edition · Schedules
Schedule 2 · Licensable cybersecurity services
Feedback & supportSECOND SCHEDULESections 2(1) and 47(1)Licensable cybersecurity services
cybersecurity
“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state —(a)the computer or computer system continues to be available and operational;(b)the integrity of the computer or computer system is maintained; and(c)the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
1. The following cybersecurity services are licensable cybersecurity services for the purposes of this Act:
managed security operations centre (SOC) monitoring service;
penetration testing service.
2. In this Schedule —“computer” includes a virtual computer;[Act 19 of 2024 wef 31/10/2025]“computer system” includes a virtual computer system;[Act 19 of 2024 wef 31/10/2025]“managed security operations centre (SOC) monitoring service” means a service for the monitoring of the level of cybersecurity of a computer or computer system of another person by acquiring, identifying and scanning information that is stored in, processed by, or transmitted through the computer or computer system for the purpose of identifying cybersecurity threats to the computer or computer system;“penetration testing service” means a service for assessing, testing or evaluating the level of cybersecurity of a computer or computer system, by searching for vulnerabilities in, and compromising, the cybersecurity defences of the computer or computer system, and includes any of the following activities:
computer
“computer” means an electronic, magnetic, optical, electrochemical, or other data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include such device as the Minister may, by notification in the Gazette, prescribe;
determining the cybersecurity vulnerabilities of a computer or computer system, and demonstrating how such vulnerabilities may be exploited and taken advantage of;
computer system
“computer system” means an arrangement of interconnected computers that is designed to perform one or more specific functions, and includes —(a)an information technology system; and(b)an operational technology system such as an industrial control system, a programmable logic controller, a supervisory control and data acquisition system, or a distributed control system;
determining or testing the organisation’s ability to identify and respond to cybersecurity incidents through simulation of attempts to penetrate the cybersecurity defences of the computer or computer system;
identifying and quantifying the cybersecurity vulnerabilities of a computer or computer system, indicating vulnerabilities and providing appropriate mitigation procedures required to eliminate vulnerabilities or to reduce vulnerabilities to an acceptable level of risk;
utilising social engineering to assess the level of vulnerability of an organisation to cybersecurity threats.