70. Related amendments to Cybersecurity Act 2018

In the Cybersecurity Act 2018 —

in section 2(1), after the definition of “business entity”, insert —“ “certificate for authentication” means an electronic attestation that makes it possible to authenticate a website, computer system, application software or connected device, and links the website, computer system, application software or connected device (as the case may be) to the person to whom it is issued;”;

in section 2(1), after the definition of “designated provider responsible for third‑party‑owned critical information infrastructure”, insert —“ “digital identity management service” means a service consisting of —

managing identity proofing (being the process of collecting, verifying and validating sufficient attributes to define and confirm the identity of a person within a particular context); and (b)electronic authentication (being a process used to achieve sufficient assurance in the binding between a person and an identity); “digital infrastructure service” —

means a service delivered through physical hardware, or physical hardware and associated software (including virtualisation software), that enables the storage, processing or transport of data across computer networks so as to enable information and communications systems to operate with one another, and which is used directly or indirectly for the provision of a digital service; and

includes —

a service consisting of the issuance and validation of certificates for authentication; and (ii)a digital identity management service;”; (c)in section 2(1), replace the definition of “foundational digital infrastructure service” with —“ “foundational digital infrastructure service” means any digital infrastructure service specified as a foundational digital infrastructure service in the Third Schedule;”;

in section 18G(1)(b)(i) and (ii) (as inserted by section 17 of the Cybersecurity (Amendment) Act 2024), replace “operation” with “operations”; and

in the Third Schedule (as inserted by section 30 of the Cybersecurity (Amendment) Act 2024), in paragraph 2, replace the definition of “data centre facility service” with —“ “data centre facility service” means any service provided in a data centre in Singapore which relies on a computer or computer system to facilitate data storage, processing and transport by another party through the centralised accommodation, interconnection and operation of information technology and network telecommunications equipment (including one or more computers or computer systems), and —

includes a service to host, within the data centre, the computers or computer systems of a party other than the party operating the data centre;

includes a service provided in a data centre where the service is used solely by the party operating the data centre to provide a cloud computing service to one or more other parties unrelated to itself; and

except as provided in paragraph (b), excludes a service provided in a data centre where the service is used solely by the party operating the data centre.”.