Cybersecurity Act 2018: Primary legislation governing cybersecurity matters in Singapore, particularly for Critical Information Infrastructure (CII). Sets framework for cybersecurity incident reporting and vulnerability assessments.
Personal Data Protection Act (PDPA) 2012: Establishes framework for data protection, including requirements for securing personal data and mandatory data breach notifications.
Cybersecurity and Cybercrime Act 2022: Incorporates the former Computer Misuse Act, addressing unauthorized access, modification of computer material, and cyber crimes.
Telecommunications Act: Regulates telecommunications systems and services, including security requirements for network infrastructure.
Electronic Transactions Act: Provides legal framework for electronic transactions and digital signatures, including security requirements.
MAS Technology Risk Management Guidelines: Regulatory guidelines from Monetary Authority of Singapore for financial institutions, covering security testing and vulnerability assessment requirements.
MAS Notice 644: Specific notice on Technology Risk Management for banks, including requirements for security testing and vulnerability management.
Singapore Common Criteria Scheme (SCCS): National scheme for IT security evaluation and certification, providing framework for security testing.
Singapore's Cybersecurity Strategy 2021: National strategic framework outlining Singapore's approach to cybersecurity, including vulnerability management principles.
ISO/IEC 27001: International standard for Information Security Management Systems, providing framework for security controls and vulnerability management.
ISO/IEC 27002: International standard providing guidelines for security controls implementation, including vulnerability assessment practices.
ISO/IEC 27005: International standard for information security risk management, including vulnerability assessment methodologies.
NIST Cybersecurity Framework: US-based framework widely adopted globally, providing guidelines for vulnerability identification, protection, detection, response, and recovery.
