Authors: Carolyn Bigg, Yue Lin Lee, Gwyneth To and Jing Qin Cho
Companies providing cybersecurity services (“CSPs“) in Singapore will now have to obtain a licence for the provision of such services by 11 October 2022.
The licensing framework took effect from 11 April 2022.
The licensing framework is part of the Cybersecurity Act and aims to better safeguard customer interests as well as improve service provider standards. This framework is a continuation of the Singapore Government’s focus on cyber resilience and hardening of IT infrastructure, particularly in light of the recent rise in cyberattacks.
Overview of the licensing requirements
| Who requires a licence? |
All providers of penetration testing and computer system monitoring services regardless of whether they are companies or individuals or third-party CSPs providing services in support of other CSPs. The licence framework applies to resellers, third-party vendors and overseas CSPs who provide licensable cybersecurity services to the Singapore market. |
| What are the licence fees? |
SGD 1,000 for business entities. SGD 500 for individuals. 50% fee waiver for all applications lodged by 11 April 2023. |
| Duration of licence | Two years from the date of licence issuance. |
| How long is the application process? | Approximately six weeks upon submission of all necessary documents. |
|
What are the key licence conditions?
|
These include for e.g.: · providing information to the authorities upon request for the purpose of investigations; · notifying licensing officers of any change in key officers’ information within 14 days; · ensuring professional conduct in the provision of services; and · ensuring compliance with record keeping requirements. |
Any person engaging in the provision of licensable cybersecurity services without a licence after 11 October 2022 shall be liable on conviction to a fine not exceeding SGD 50,000 and/or to imprisonment for a term not exceeding 2 years.
Failure of a licensed CSP to comply with the licensing conditions may result in revocation or suspension of their licence, and/or a financial penalty of SGD 10,000 per contravention (not exceeding in the aggregate SGD 50,000).
DLA Piper Singapore Pte. Ltd. is licensed to operate as a foreign law practice in Singapore. Where advice on Singapore law is required, we will refer the matter to and work with licensed Singapore law practices where necessary.