Singapore to start licensing cyber security service providers

Singapore’s Cyber Security Agency (CSA) is to start licensing cyber security service providers in the city-state to safeguard consumer interests and improve service standards over time.

Announcing the new licensing framework today, the CSA said the move will address the “information asymmetry” between consumers and cyber security service providers, starting with those that offer penetration testing and managed security operations centre (SOC) services.

The CSA said these two services were prioritised because service providers delivering such services can have significant access into their clients’ computer systems and sensitive information. In the event that the access is abused, the client’s operations could be disrupted.

Also, it noted that the two types of services are already widely available and adopted in the market, so have the potential to cause significant impact on the overall cyber security landscape.

The licensing framework was developed following a month-long consultation process, during which 29 responses were received from industry players, industry associations, and members of the public.

For example, some respondents suggested penetration testing should be defined, given the potential confusion with vulnerability assessment.

The CSA noted that penetration testing has already been defined in the Second Schedule to the Cybersecurity Act and that vulnerability assessments usually involve scanning IT systems or networks to identify flaws that may be exploited and do not compromise cyber defences.

This serves as a “common distinction” between vulnerability assessment and penetration testing, for which the former is not a licensable cyber security service, said the CSA. However, those that provide red teaming services that include penetration testing should be licensed.

Existing cyber security service providers that already offer licensable cyber security services will be given six months to apply for a licence. Those that do not apply for a licence – which will be valid for two years – in time will have to stop providing licensable services until they get a licence.

Anyone in the business of providing licensable cyber security services without a licence after 11 October 2022 could be liable to a fine not exceeding S$50,000 or to imprisonment for a term not exceeding two years, or both.

To administer the new licensing framework, the CSA has set up a new Cybersecurity Services Regulation Office, which will manage licensing processes and share resources on licensable cyber security services with consumers, among other activities.

The CSA said it will continue to monitor international and industry trends and engage the industry where necessary, as so to assess whether any new types of cyber security service should be included in the licensing framework.