Cybersecurity Act 2018 · 2020 Revised Edition · Part 6 · General
35A. Codes of practice and standards of performance
Feedback & supportLast amended by an amending law of 2024.
The Commissioner may, from time to time —
Commissioner
“Commissioner” means the Commissioner of Cybersecurity appointed under section 4(1)(a);
issue or approve one or more codes of practice or standards of performance for the regulation of the following persons with respect to measures to be taken by them to ensure the cybersecurity of the computers or computer systems indicated:
owners of provider-owned critical information infrastructure — the provider-owned critical information infrastructure;
designated providers responsible for third‑party‑owned critical information infrastructure — the third-party-owned critical information infrastructure for which they are responsible;
owners of systems of temporary cybersecurity concern — the systems of temporary cybersecurity concern;
entities of special cybersecurity interest — the systems of special cybersecurity interest in relation to which they are designated;
major foundational digital infrastructure service providers — the major foundational digital infrastructure in relation to which they are designated; and
amend or revoke any code of practice or standard of performance issued or approved under paragraph (a).
If any provision in any code of practice or standard of performance is inconsistent with this Act, the provision, to the extent of the inconsistency, does not have effect.
code of practice
“code of practice” means any code of practice issued or approved under section 35A(1), and includes such a code of practice as may be amended from time to time;
Where a code of practice or standard of performance is issued, approved, amended or revoked by the Commissioner under subsection (1), the Commissioner must —
standard of performance
“standard of performance” means any standard of performance issued or approved under section 35A(1), and includes such a standard of performance as may be amended from time to time;
publish a notice of the issue, approval, amendment or revocation (as the case may be) in such manner as will secure adequate publicity for such issue, approval, amendment or revocation;
specify in the notice the date of the issue, approval, amendment or revocation (as the case may be); and
ensure that, so long as the code of practice or standard of performance remains in force, copies of that code or standard, and of all amendments to that code or standard, are available free of charge to a person to whom that code or standard applies.
None of the following has any effect until the notice relating to it is published in accordance with subsection (3):
a code of practice or standard of performance;
an amendment to a code of practice or standard of performance;
a revocation of a code of practice or standard of performance.
Any code of practice or standard of performance has no legislative effect.
Subject to subsections (4) and (7), every person mentioned in subsection (1) must comply with the codes of practice and standards of performance that apply to the person.
The Commissioner may, either generally or for such time as the Commissioner may specify, waive the application to a person of any code of practice or standard of performance, or any part of it.