Licensing Framework for Cybersecurity Service Providers Comes into Operation

The Cybersecurity Agency of Singapore ("CSA") has announced the launch of the licensing framework for cybersecurity providers ("Framework"), which has taken effect from 11 April 2022. The Framework imposes a licensing requirement for the provision of prescribed cybersecurity services. 

The Framework aims to better safeguard consumers' interests and address the information asymmetry between consumers and cybersecurity service providers. It also seeks to improve service providers' standards and standing over time.

The Framework has been enacted via Part 5 and the Second Schedule of the Cybersecurity Act 2018, which came into operation on 11 April 2022. Subsidiary legislation such as the Cybersecurity (Cybersecurity Service Providers) Regulations 2022 has also been enacted as part of the Framework.

CSA has set out the timeline for the relevant cybersecurity service providers to comply with the licensing requirements of the Framework:

1. 11 April 2022: No person may provide a licensable cybersecurity service without a cybersecurity service provider's licence from 11 April 2022.


2. 11 October 2022: Existing cybersecurity service providers who are already engaged in the business of providing licensable cybersecurity services must apply for a licence by 11 October 2022. If the licence application is made by 11 October 2022, the service provider may continue to provide its service until a decision on its application has been made.


3. The licence is valid for a period of two years, and an application for renewal should be made no later than two months before the expiry of the licence.

For a start, CSA will license two types of cybersecurity service providers: (i) managed security operations centre monitoring services; and (ii) penetration testing services.

The Framework contains certain key conditions, such as those relating to: 

1. Procedural and information requirements for licence applications;
2. Keeping of records;
3. Notification on changes to information about the licencee;
4. Professional conduct of licensees;
5. Provision to the licensing officer of information relating to the cybersecurity service.

For more information, click here to read our Legal Update.