MDDI's Response to PQ on Assessment of Vulnerability Remediation Compliance Under CII Code of Practice and Prescribing Maximum Timeframes for Critical Vulnerabilities

Parliament Sitting on 4 November 2026

Question for Written Answer

37. Mr Alex Yeo asked the Minister for Digital Development and Information (a) how the Cyber Security Agency of Singapore (CSA) assesses compliance with the requirement under the Cybersecurity Code of Practice for Critical Information Infrastructure 2026 to remediate cybersecurity vulnerabilities “as soon as possible”; (b) whether different remediation expectations apply to critical vulnerabilities affecting internet-facing systems or that are being actively exploited; and (c) whether CSA will consider prescribing risk-based maximum remediation timeframes for such vulnerabilities.

Answer

When the Cyber Security Agency of Singapore (CSA) issues alerts and advisories on critical vulnerabilities to Critical Information Infrastructure (CII) owners, it sets timelines for CII owners to report back on their remediation progress. These timelines are risk-based, with greater urgency for vulnerabilities affecting internet facing systems or being actively exploited.

CSA also considers operational constraints. For example, patches may no longer be available for legacy systems, while patching operational technology systems may require careful planning and testing to avoid service disruptions.

Where CII owners cannot meet the stipulated timeframes, they are required to provide justifications and implement appropriate interim risk mitigation measures while working towards permanent remediation.