4. New Part 13B

In the MPA Act, before Part 14, insert —“PART 13BCYBERSECURITYDivision 1 — PreliminaryInterpretation of Part 13B89K. In this Part and the Seventh Schedule —“computer” means an electronic, magnetic, optical, electrochemical, or other data processing device performing logical, arithmetic or storage functions, and includes —

a virtual computer; and

any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include such device as the Minister may, by notification in the Gazette, prescribe;“computer program” means data representing instructions or statements that, when executed in a computer, cause the computer to perform a function;“computer system” means an arrangement of interconnected computers that is designed to perform one or more specific functions, and includes —

a virtual computer system;

an information technology system; and

an operational technology system such as an industrial control system, a programmable logic controller, a supervisory control and data acquisition system, or a distributed control system;“connected computer system” means a computer or computer system that is directly or indirectly connected to a computer or computer system owned or operated by the Authority;“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state —

the computer or computer system continues to be available and operational;

the integrity of the computer or computer system is maintained; and

the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;“cybersecurity incident” means an act or activity carried out without lawful authority on or through a computer or computer system that jeopardises or adversely affects the cybersecurity of that or another computer or computer system;“cybersecurity program” means any computer program designed for, or purported to be designed for, ensuring or enhancing the cybersecurity of a computer or computer system;“cybersecurity service” has the meaning given by section 2(1) of the Cybersecurity Act 2018;“cybersecurity service provider” means a person who provides a cybersecurity service;“cybersecurity threat” means an act or activity (whether known or suspected) carried out on or through a computer or computer system, that may imminently jeopardise or affect adversely, without lawful authority, the cybersecurity of that or another computer or computer system;“cybersecurity vulnerability” means any vulnerability in a computer or computer system that can be exploited by one or more cybersecurity threats;“designated III” means a computer or computer system in respect of which a designation under section 89N is in effect;“essential transport service” has the meaning given by section 86A(1);“excluded computer or computer system” means a computer or computer system that is —

designated under section 7 of the Cybersecurity Act 2018 as a provider‑owned critical information infrastructure;

designated under section 16A of the Cybersecurity Act 2018 as a third‑party‑owned critical information infrastructure;

designated under section 17 of the Cybersecurity Act 2018 as a system of temporary cybersecurity concern; or

prescribed as an excluded computer or computer system;“important information infrastructure” or “III” means a computer or computer system that meets the criteria in section 89N(1) and (2);“key appointment holder”, in relation to a notified owner or notified operator, means —

if the notified owner or notified operator is a corporation, limited liability partnership or other body corporate — a member of the board of directors, the committee or board of trustees or any other governing body of the notified owner or notified operator;

if the notified owner or notified operator is a partnership — a partner of the notified owner or notified operator; (c)if the notified owner or notified operator is a sole proprietorship — the sole proprietor of the notified owner or notified operator; or

in any other case — any individual who has general management or control of the business of the notified owner or notified operator;“maritime entity” has the meaning given by section 89L;“notified operator”, in relation to a designated III, means, subject to section 89N(10) and (11), an operator or owner‑operator of the designated III who has been notified of the designation under section 89N;“notified owner”, in relation to a designated III, means, subject to section 89N(10) and (11), an owner (not being an owner‑operator) of the designated III who has been notified of the designation under section 89N;“operate”, in relation to a computer or computer system, has the meaning given by section 89M;“owner”, in relation to a computer or computer system —

means the legal owner of the computer or computer system; and

where the computer or computer system is jointly owned by more than one person, includes every joint owner;“owner-operator”, in relation to a computer or computer system, means an owner of the computer or computer system who also operates that computer or computer system;“prescribed” means prescribed by regulations mentioned in section 89Z;“standard of performance” means any standard of performance issued or adopted under section 89X;“virtual computer” means a purely digital analogue of a computer, created by the simulation of software and hardware, performing logical, arithmetic or storage functions including communications functions, but does not include the physical computing resources used for the simulation;“virtual computer system” means a purely digital analogue of a computer system, created by the simulation of an arrangement of interconnected computers that is designed to perform one or more specific functions, but does not include the physical computing resources used for the simulation.What is a maritime entity89L.—

In this Part, a maritime entity is a person who satisfies one or more of the following conditions:

the person is in the business of providing any essential transport service in Singapore; (b)the person is the owner of —

a Singapore ship; or

any other vessel that is in, or intending to enter, the territorial waters of Singapore; (c)the person is the owner or operator of any maritime device that is in, or intending to enter, the territorial waters of Singapore.

In this section, “Singapore ship” has the meaning given by section 2(1) of the Merchant Shipping Act 1995.Meaning of “operate” in relation to computer or computer system89M.—

In this Part, a person is taken to operate a computer or computer system if the person has effective control over the operations of the computer or computer system. (2) Without limiting subsection (1), a person is taken to have effective control over the operations of a computer or computer system if the person has —

the right and ability to carry out changes to the computer or computer system; or

the right and ability to perform security configuration and management tasks in respect of the computer or computer system, including to make any modification for the cybersecurity of the computer or computer system.

To be clear, a person who merely uses a computer or computer system is not operating that computer or computer system.Extraterritorial application of this Part89MA.—

This Part applies to a computer or computer system whether the computer or computer system is located (or, in the case of a virtual computer or virtual computer system, is hosted) in or outside Singapore.

A notice or direction under this Part may be given to —

an individual, whether or not a resident or citizen of Singapore, whether physically in or outside Singapore, and whether carrying on a business or operating in or outside Singapore; or

any other person whether formed, constituted or registered in or outside Singapore, and whether carrying on business or operating in or outside Singapore.

The offences under this Part apply whether the person commits the offence in or outside Singapore.Powers under Cybersecurity Act 2018 not affected89MB. To be clear, this Part does not affect the exercise of any power under the Cybersecurity Act 2018.Division 2 — Designation of important information infrastructureDesignation of important information infrastructure and notification of owner and operator89N.—

Subject to subsection (2), the Authority may designate a computer or computer system as an important information infrastructure for the purposes of this Part if —

the computer or computer system is owned or operated by a maritime entity; or

the computer or computer system is a connected computer system.

Subsection (1) applies only if —

the Authority is satisfied that the computer or computer system is necessary for the continuous delivery of any essential transport service, and the loss or compromise of that computer or computer system will substantially affect or impair —

the availability of that essential transport service in Singapore;

the operation of the port or any part of the port; or

the reputation of Singapore as a provider of marine services; and

that computer or computer system is not an excluded computer or computer system.

The designation under subsection (1) must be made by the Authority by written notice to —

the owner‑operator (if any) of the computer or computer system to be designated; or (b)the owner, and the operator, of the computer or computer system to be designated.

If there is more than one person who is an owner, operator or owner‑operator of a computer or computer system to be designated, the Authority may determine the person to whom the written notice or notices mentioned in subsection (3)(a) or (b), respectively, is or are to be given. (5) The Authority may, from time to time, give written notice of the designation to any other person who is or becomes an owner, operator or owner-operator of a designated III.

A notice under subsection (3) or (5) must —

identify the computer or computer system that is being or has been (as the case may be) designated as an important information infrastructure;

specify the date the designation takes or took effect, as the case may be;

specify whether the person (A) to whom the notice is given is being notified as the owner, operator or owner‑operator of that computer or computer system;

identify every owner, operator and owner‑operator of that computer or computer system that is being or has been notified of the designation;

inform A regarding A’s duties and responsibilities under this Part as a notified owner or notified operator, as the case may be;

inform A that any representations against the designation or being a notified owner or notified operator (as the case may be) are to be made to the Authority by a specified date, being a date not earlier than 14 days after the date of the notice; and

provide the name and contact particulars of the officer assigned by the Authority to supervise the important information infrastructure in relation to its cybersecurity.

A notice under this section need not be published in the Gazette.

A designation under subsection (1) takes effect on the date specified in the notice until the designation is withdrawn by the Authority under section 89P.

The owner, operator or owner‑operator of a designated III who has been given written notice under subsection (3) or (5) becomes a notified owner or notified operator (as the case may be) on the date specified in the notice.

The owner, operator or owner‑operator of a designated III who has been notified of the designation ceases to be a notified owner or notified operator (as the case may be) in respect of the designated III —

when the designation is withdrawn by the Authority under section 89P;

if the notified owner or notified operator gives notice under section 89U(1) that it will cease to be the owner, operator or owner‑operator (as the case may be) of the designated III —

when that notified owner or notified operator ceases to be the owner, operator or owner‑operator (as the case may be) of the designated III; or

on an earlier date specified by the Authority in a written notice to the notified owner or notified operator; or

at the time provided by section 89V(2), if applicable.

Subject to subsections (8) and (10), where a computer or computer system becomes an excluded computer or computer system while it is a designated III, its designation as a designated III is suspended for so long as it remains an excluded computer or computer system.Power to obtain information to ascertain if criteria for designation as important information infrastructure met89O.—

This section applies if the Authority has reason to believe that a computer or computer system may meet the criteria to be designated as an important information infrastructure mentioned in section 89N(1) and (2).

The Authority may, by written notice, require any person who appears to be the owner, operator or owner‑operator of the computer or computer system mentioned in subsection (1) to provide to the Authority, within a reasonable period specified in the notice, any information that the Authority may require in order to ascertain whether the computer or computer system fulfils the criteria to be designated as an important information infrastructure, including information relating to any of the following:

the function that the computer or computer system is employed to serve;

the location of the computer or computer system and every component of the computer or computer system;

the person or persons, or other computer or computer systems, that are served by that computer or computer system;

the design of the computer or computer system;

whether the computer or computer system is an excluded computer or computer system.

A person who, without reasonable excuse, fails to comply with a notice under subsection (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $20,000 or to imprisonment for a term not exceeding 6 months or to both and, in the case of a continuing offence, to a further fine not exceeding $2,000 for every day or part of a day during which the offence continues after conviction.

A person to whom a notice is issued under subsection (2) is not obliged to disclose any information that is subject to any right, privilege or immunity conferred, or obligation or limitation imposed, by or under any written law or rules of professional conduct in relation to the disclosure of such information.Withdrawal of designation of important information infrastructure89P.—

The Authority may, on its own initiative or on the application of the owner, operator or owner‑operator of a designated III, withdraw the designation of any important information infrastructure at any time if the Authority is of the opinion that —

the computer or computer system no longer fulfils the criteria to be designated as an important information infrastructure; or

the person who owns or operates the computer or computer system —

if the computer or computer system is not a connected computer system — is no longer a maritime entity; or

ceases to own or operate that computer or computer system.

The Authority must give written notice of the withdrawal of designation of a designated III to every notified owner and notified operator of the designated III.

The withdrawal takes effect on the date specified in the notice under subsection (2).Division 3 — Duties and obligations of notified owner or notified operator Duty to provide information relating to designated III89Q.—

The Authority may, by written notice, require a notified operator to provide in respect of a designated III, within a reasonable period specified in the notice, the following:

information on the design, configuration and security of the designated III;

information on the design, configuration and security of any other computer or computer system that is operated by the notified operator and is interconnected with or that communicates with the designated III;

information relating to the operation of the designated III, and of any other computer or computer system that is operated by the notified operator and is interconnected with or that communicates with the designated III;

any other information that the Authority may require in order to ascertain the level of cybersecurity of the designated III, including any information relating to the readiness of the notified operator to deal with and respond to future cybersecurity threats and cybersecurity incidents relating to that designated III;

any other prescribed information.

A notified operator who, without reasonable excuse, fails to comply with a notice under subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $20,000 or to imprisonment for a term not exceeding 6 months or to both and, in the case of a continuing offence, to a further fine not exceeding $2,000 for every day or part of a day during which the offence continues after conviction.

If a material change is made by or on behalf of the notified operator to the design, configuration, security or operation of the designated III, the notified operator must notify the Authority of the change not later than 30 days after the change is made.

For the purposes of subsection (3), a change is a material change if —

the change affects or may affect the cybersecurity of the designated III or the ability of the notified operator to respond to a cybersecurity threat or cybersecurity incident affecting the designated III; or

the change is a prescribed change. (5) A notified operator who, without reasonable excuse, fails to comply with subsection (3) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 6 months or to both and, in the case of a continuing offence, to a further fine not exceeding $2,000 for every day or part of a day during which the offence continues after conviction. Duty to report cybersecurity incident in respect of designated III, etc.89R.—

A notified operator must notify the Authority of the occurrence of any of the following in the form and manner published on the Authority’s Internet website at https://www.mpa.gov.sg or any other prescribed website, within the prescribed period after becoming aware of such occurrence:

a prescribed cybersecurity incident in respect of any designated III operated by that notified operator;

a prescribed cybersecurity incident in respect of any computer or computer system that is operated by the notified operator and is interconnected with or that communicates with any designated III operated by that notified operator;

a prescribed cybersecurity incident in respect of any other computer or computer system that is operated by the notified operator.

Every notified operator must establish such mechanisms and processes for the purposes of detecting cybersecurity threats and cybersecurity incidents in respect of every designated III operated by that notified operator, as set out in any applicable standards of performance.

A notified operator who, without reasonable excuse, fails to comply with subsection (1) or (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $20,000 or to imprisonment for a term not exceeding 6 months or to both.Cybersecurity audits and risk assessments of designated III89S.—

A notified operator must, in respect of each designated III operated by the notified operator —

at least once every 5 years (or at such higher frequency as may be directed by the Authority in any particular case), starting from the date the designation of the III takes effect, cause to be carried out by an auditor approved or appointed by the Authority an audit of the compliance of the designated III with the requirements of this Part, including —

any regulations mentioned in section 89Z;

any direction given under section 89W; and (iii)any standard of performance issued or adopted under section 89X that is applicable to the notified operator; and

at least once a year, starting from the date the designation of the III takes effect, conduct a cybersecurity risk assessment of the designated III in the prescribed form and manner.

The notified operator must, not later than 30 days after the completion of the audit mentioned in subsection (1)(a) or the cybersecurity risk assessment mentioned in subsection (1)(b), provide a copy of the report of the audit or assessment to the Authority.

Where it appears to the Authority from the report of an audit provided under subsection (2) that any aspect of the audit was not carried out satisfactorily, the Authority may direct the notified operator to cause the auditor to carry out that aspect of the audit again.

Where it appears to the Authority, from the report of a cybersecurity risk assessment provided under subsection (2), that the assessment was not carried out satisfactorily, the Authority may either —

direct the notified operator to carry out further steps to evaluate the level of cybersecurity of the designated III; or

appoint a cybersecurity service provider to conduct another cybersecurity risk assessment of the designated III, and the cost of such assessment must be borne by the notified operator.

A notified operator who —

without reasonable excuse, fails to comply with subsection (1);

fails to comply with the Authority’s direction under subsection (3) or (4)(a); or

obstructs or prevents a cybersecurity risk assessment mentioned in subsection (4)(b) from being carried out,shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $20,000 or to imprisonment for a term not exceeding 6 months or to both and, in the case of a continuing offence, to a further fine not exceeding $2,000 for every day or part of a day during which the offence continues after conviction.

A notified operator who, without reasonable excuse, fails to comply with subsection (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 6 months or to both and, in the case of a continuing offence, to a further fine not exceeding $1,000 for every day or part of a day during which the offence continues after conviction.Cybersecurity exercises89T.—

The Authority may conduct cybersecurity exercises for the purpose of testing the state of readiness of any notified operator in respect of any designated III operated by the notified operator in responding to cybersecurity incidents.

A notified operator must participate in a cybersecurity exercise conducted in respect of any designated III if directed in writing to do so by the Authority.

A notified operator who, without reasonable excuse, fails to comply with a direction under subsection (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $20,000.Duty to notify Authority of certain changes89U.—

The person specified in the second column in the following table must notify the Authority in the form published on the Authority’s Internet website at https://www.mpa.gov.sg or any other prescribed website, of matters specified in the third column opposite the change within the time for notification specified in the fourth column:First columnSecond columnThird columnFourth columnChangePerson required to notifyMatters to be notifiedTime for notification(a)The change of ownership of a designated III owned by the notified owner or notified operatorThe notified owner or notified operator (who is an owner‑operator)That change, the intended effective date of the change, the identity of the new owner of the designated III and any other prescribed matters in relation to the changeAt least 90 days prior to the change(b)The notified operator ceases to be the operator of a designated IIIThe notified operatorThat change, the intended effective date of the change, the identity of the new operator of the designated III and any other prescribed matters in relation to the changeAt least 90 days prior to the change (c)Any other prescribed changeThe prescribed person The prescribed change and any other prescribed matters in relation to the changeWithin the prescribed period(2) A notified owner or notified operator who fails to comply with subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $20,000 or to imprisonment for a term not exceeding 6 months or to both.

In a prosecution of a person for an offence under subsection (2), it is a defence for the person charged to prove, on a balance of probabilities, that the person charged —

was not aware of the change before the expiry of the time for notification under subsection (1); and

provided the information to the Authority as soon as the person became aware of that change.Continuation as notified owner or notified operator if failure to provide information within time required by section 89U89V.—

This section applies if —

a notified owner or notified operator (X) ceases to be the owner or operator of a designated III; and

another person becomes the owner, operator or owner‑operator of the designated III in place of X.

Despite anything in this Part, if X fails to notify the Authority within the time for notification under section 89U(1) that X will cease to be the owner, operator or owner‑operator of a designated III, X continues to be the notified owner or notified operator of the designated III until —

the expiry of 90 days after X notifies the Authority; or

an earlier date specified by the Authority in a written notice to X.Division 4 — Directions to notified operators and standards of performanceDirections to notified operators in relation to designated III89W.—

The Authority may give a direction to a notified operator in respect of any designated III operated by the notified operator if the Authority is of the opinion that it is necessary or expedient —

to ensure the cybersecurity of any designated III; or

for the effective administration of this Part.

A direction to a notified operator under subsection (1) may require the notified operator —

to take any action in relation to a cybersecurity threat;

to comply with any prescribed technical or other standards relating to cybersecurity in respect of the designated III operated by the notified operator;

to comply with any standard of performance issued or adopted under section 89X applicable to the notified operator; (d)to appoint an auditor approved by the Authority to audit the notified operator on its compliance with this Part or any such standard of performance applicable to the notified operator; or

to comply with any other matters that the Authority considers necessary or expedient to ensure the cybersecurity of any designated III.

A direction under subsection (1) must specify a deadline for compliance, and may be revoked at any time by the Authority.

Before giving a direction under subsection (1) to any notified operator, the Authority must, unless the Authority considers that it is not practicable or desirable to do so, give a written notice to the notified operator stating —

that the Authority proposes to issue the direction and setting out its effect; and

the time within which representations or objections to the proposed direction may be made.

The Authority must consider any representations or objections which are duly made before giving any direction.

A notified operator who, without reasonable excuse, fails to comply with a direction under subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $20,000 or to imprisonment for a term not exceeding 6 months or to both and, in the case of a continuing offence, to a further fine not exceeding $2,000 for every day or part of a day during which the offence continues after conviction.Standards of performance for cybersecurity89X.—

To promote the cybersecurity of any designated III or class of designated III, the Authority may —

issue one or more standards of performance applicable to notified operators, or any class of notified operators, in respect of cybersecurity measures to be taken in respect of any designated III or a class of designated III;

adopt as a standard of performance applicable to notified operators, or any class of notified operators who operate the designated III or the class of designated III (as the case may be), any document (in whole or part) prepared by a person other than the Authority; or

amend or revoke any standard of performance issued under paragraph (a) or adopted under paragraph (b).

The standards of performance mentioned in subsection (1) may include (but are not limited to) the matters mentioned in the Seventh Schedule.

If any provision in a standard of performance mentioned in subsection (1) is inconsistent with this Part, the provision, to the extent of the inconsistency, does not have effect.

Where a standard of performance is issued, adopted, amended or revoked by the Authority under this section, the Authority must —

give written notice of the issue, adoption, amendment or revocation (as the case may be) of the standard of performance to every notified operator to whom the standard of performance applies;

specify in the notice under paragraph (a) the date of issue, adoption, amendment or revocation, as the case may be; and

ensure that, so long as the standard of performance remains in force, copies of that standard of performance, and of all amendments to that standard of performance, are available for inspection (without charge) by the notified operator to whom the standard of performance applies.

A standard of performance has no legislative effect.

Subject to subsection (7), a notified operator must comply with all the standards of performance that apply to the notified operator.

The Authority may, either generally or for such time as the Authority may specify, waive the application to a notified operator of any standard of performance, or any part of it.Division 5 — Appeals under Part 13BAppeal to Minister under this Part89Y.—

A person (called in this section an appellant) who is aggrieved by any of the following (called in this section an appealable decision) may appeal to the Minister against the decision:

the decision of the Authority to designate a computer or computer system as an important information infrastructure or to notify a person as a notified owner or notified operator of a designated III under section 89N;

the decision of the Authority under section 89P to refuse to withdraw the designation of any important information infrastructure on the application of the notified owner or notified operator of the designated III;

a direction of the Authority under section 89W.

An appeal under subsection (1) must —

be made in the prescribed manner;

specify the grounds on which it is made; and

be made within a prescribed period after the date of receipt of the appealable decision that is appealed against.

The Minister may reject an appeal of an appellant who fails to comply with subsection (2).

The Minister may determine an appeal made under subsection (1) by —

dismissing the appeal and confirming the decision appealed against;

allowing the appeal and referring the matter back to the maker of the appealable decision to reconsider the case; or

allowing the appeal and substituting or varying the decision appealed against.

The Minister’s decision under subsection (4) is final.

Every appellant must be notified of the Minister’s decision under subsection (4).

An appeal against an appealable decision does not affect the operation of the decision appealed against or prevent the taking of any action to implement the decision.

Unless otherwise directed by the Minister under this section, the decision appealed against must be complied with until the determination of the appeal. Division 6 — Regulations for Part 13BCybersecurity regulations89Z.—

The Authority may make regulations under section 119 for the purposes of this Part, including in relation to the following matters:

the procedure for the designation of an important information infrastructure;

the technical or other standards relating to cybersecurity to be maintained in respect of an important information infrastructure;

the responsibilities and duties of a notified owner or notified operator in relation to a designated III owned or operated by the notified owner or notified operator, including requirements to keep records and to notify the Authority of matters relating to the designated III;

the types of changes that are considered to be material changes to the design, configuration, security or operations of a designated III to be reported by the notified operator;

the types of cybersecurity incidents relating to a designated III that are required to be reported by the notified operator;

the requirements for, and the manner for the carrying out of, cybersecurity audits and cybersecurity risk assessments required to be conducted by a notified operator in relation to any designated III owned or operated by that person;

the form and nature of cybersecurity exercises that may be conducted;

the skills, competencies, functions and duties of key appointment holders of notified owners and notified operators in relation to cybersecurity; (i)the cybersecurity governance of notified owners and notified operators by key appointment holders and the duties and responsibilities of those key appointment holders.

Regulations made for the purposes of this Part may apply to —

all notified owners and notified operators or particular classes of notified owners and notified operators; and

all important information infrastructure or particular classes of important information infrastructure.

The regulations made for the purposes of this Part may provide —

that any contravention of any specified provision of the regulations is an offence;

for penalties not exceeding a fine of $20,000 or imprisonment for a term not exceeding 6 months or both for each offence; and

in the case of a continuing offence, for a further penalty not exceeding a fine of $2,000 for every day or part of a day during which the offence continues after conviction.”.