Regulation 4

by submitting the following details in the manner specified in paragraph (2), within 2 hours after becoming aware of the occurrence:

the system of temporary cybersecurity concern which the cybersecurity incident relates to;

the name and contact number of the owner of the system of temporary cybersecurity concern;

the nature of the cybersecurity incident, whether it was in respect of the system of temporary cybersecurity concern or an interconnected computer or computer system, and when and how it occurred;

the resulting effect that has been observed, including how the system of temporary cybersecurity concern or any interconnected computer or computer system has been affected;

the name, designation, organisation and contact number of the individual submitting the notification;

by providing to the fullest extent practicable the following supplementary details in writing in the form set out on the Internet website at https://www.csa.gov.sg within 72 hours after becoming aware of the occurrence:

any updates and supplementary details in respect of the details submitted under sub‑paragraph (a);

the cause of the cybersecurity incident;

the impact of the cybersecurity incident on the system of temporary cybersecurity concern or any interconnected computer or computer system, or on the business operations of the owner of the system of temporary cybersecurity concern;

what remedial measures have been taken;

by providing a final incident report containing the following details in writing in the form set out on the Internet website at https://www.csa.gov.sg within 30 days (including any Sunday and public holiday) after the submission mentioned in sub‑paragraph (b) is made:

the details submitted under sub‑paragraphs (a) and (b);

to the fullest extent practicable, any updates and supplementary details in respect of the information submitted under sub‑paragraphs (a) and (b).

by calling the telephone number specified by the Commissioner; or

if the owner is unable to submit the details in the manner set out in sub‑paragraph (a) within a reasonable time —

by text message to the telephone number specified by the Commissioner; or

in writing, in the form set out on the Internet website at https://www.csa.gov.sg, to the electronic address specified by the Commissioner.

any unauthorised hacking of the system of temporary cybersecurity concern or the interconnected computer or computer system to gain unauthorised access to or control of the system of temporary cybersecurity concern or interconnected computer or computer system;

any installation or execution of unauthorised software, or computer code, of a malicious nature on the system of temporary cybersecurity concern or the interconnected computer or computer system;

any man‑in‑the‑middle attack, session hijack or other unauthorised interception by means of a computer or computer system of communication between the system of temporary cybersecurity concern or the interconnected computer or computer system, and an authorised user of the system of temporary cybersecurity concern or the interconnected computer or computer system, as the case may be;

any denial of service attack or other unauthorised act or acts carried out through a computer or computer system that adversely affects the availability or operability of the system of temporary cybersecurity concern or the interconnected computer or computer system.