CSA Starts to License Cybersecurity Service Providers

The CSA (Singapore Cybersecurity Agency) recently launched a new licensing framework for cybersecurity service providers as part of efforts to improve the standards of such providers and protect the interests of consumers.

In a notice, the CSA said it will first license two types of cybersecurity service providers during the initial phase of the launch: those that provide penetration testing, and those that provide managed security operations centre monitoring services.

These two services are being prioritised due to the extensive access to computer systems and sensitive information such providers have, the CSA said.

"In the event that the access is abused, the client's operations could be disrupted. In addition, these services are already widely available and adopted in the market, and hence have the potential to cause significant impact on the overall cybersecurity landscape."

Under the new framework, cybersecurity service providers providing the two cybersecurity services in scope will have six months to apply for a licence, which will be valid for two years.

The licence costs SGD 500 for individuals and SGD 1,000 for businesses, however a one-time 50 percent waiver of the licence fees will be granted for all applications lodged before 11 Apr 2023.

Service providers that failed to obtain the required licence by 11 October 2022 will be considered guilty of an offence and subject to a fine up to SGD 50,000 or imprisonment for up to two years, or both.

The CSA has set up a Cybersecurity Services Regulation Office (CSRO) to administer the licensing framework and facilitate communications with the industry and the public on all licensing-related concerns.

Source: Regulation Asia