Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore (CSA) is Singapore's national agency for cybersecurity. CSA was formed in 2015, is part of the Prime Minister's Office and is managed by the Ministry of Digital Development and Information. Its mission is to keep Singapore's cyberspace safe and secure in order to underpin national security, power a digital economy and protect Singapore's digital way of life (CSA, Who We Are, accessed 12 September 2026; CSA, Mission, Vision and Values, accessed 12 September 2026).

National cybersecurity and essential services

CSA continuously monitors cyberspace for cyber threats and protects and defends Singapore's Critical Information Infrastructure (CII) so essential services can continue. It analyses threat risks, takes mitigation measures, maintains incident-response teams for serious attacks on CII, and conducts cybersecurity exercises for critical sectors. The essential-service examples listed by CSA include energy, water, telecommunications, healthcare, banking and finance, and government services (CSA, What We Do, accessed 12 September 2026). This national-security and CII role should not be read as making CSA the operator of every protected system or as requiring every private organisation to follow the same controls.

Enterprise, workforce and international roles

Beyond CII, CSA works to make cyberspace safer for enterprises and individual end-users through security-by-design advocacy, consultancy for government agencies, product certification and system-security validation. It also builds Singapore's cybersecurity ecosystem by working with industry and universities on innovation, research and workforce development. CSA issues advisories, runs outreach to promote cyber hygiene, pursues bilateral and multilateral partnerships, and drives regional cybersecurity-capacity-building programmes (CSA, What We Do, accessed 12 September 2026). These functions explain why the vault's CSA materials span law, CII codes, AI-security guidance, public education and talent programmes: those are distinct instruments and initiatives within the agency's wider remit, not interchangeable names for CSA itself.

SingCERT and incident reporting

SingCERT is CSA's Singapore Cyber Emergency Response Team. CSA says SingCERT responds to cybersecurity incidents for its Singapore constituents and was set up to facilitate the detection, resolution and prevention of internet-related cybersecurity incidents (CSA, SingCERT, accessed 12 September 2026). It is therefore a named incident-response function within the CSA ecosystem, not a second national cybersecurity agency. Organisations seeking to report an incident to SingCERT should use the contact route published on that page; a general CSA policy statement and an incident report are different kinds of interaction. The page also links incident-response checklists, playbooks and cyber-aid resources, showing the practical reporting layer alongside CSA's broader mission.

Boundaries with GovTech and PDPC

CSA should be distinguished from other digital-government and data-protection bodies. GovTech builds and operates many government digital platforms; CSA sets national cybersecurity direction, protects CII and issues sector guidance, but does not own every government IT system (government technology agency). The Personal Data Protection Commission administers the Personal Data Protection Act for organisational data-handling obligations; a CSA advisory on cyber threats is not the same instrument as a PDPC enforcement decision. These distinctions matter when deciding which agency's guidance, reporting channel or legal framework applies to a question. A private company's routine IT vendor contract likewise does not automatically place it under the same CII obligations as an essential-service operator unless the applicable sector framework says so.