The Ministry of Communications and Information (MCI) and the Cyber Security Agency of Singapore (CSA) commenced work on the Act in late 2015. Since then, MCI and CSA had conducted five rounds of closed-door consultations with key stakeholders, ranging from government agencies, potential Critical Information Infrastructure (CII) owners, industry associations, and cybersecurity professionals. MCI and CSA held a public consultation on the draft Bill from 10 July to 24 August 2017, where the deadline was extended by 3 weeks, in response to public requests for more time to provide feedback. A total of 92 submissions were received during the public consultation process.
Respondents were generally supportive of the Bill and understood the importance of such a Bill to enhance the cybersecurity landscape in Singapore for the benefit of the people and businesses. They shared the Government's concerns on cyber threats and the impact of cyber-attacks on Singapore. They acknowledged the importance of the Bill in providing the necessary legislative framework to better protect CII, and to give CSA the legislative powers required to act on cybersecurity incidents that impact the nation. Several respondents also agreed with the importance of sharing cybersecurity information between CSA and other organisations, and the need to safeguard the sources and information disclosed.
However, several respondents expressed reservations with the proposed licensing framework. They felt that the requirements to be imposed on businesses should not be too onerous. Several suggested simplifying the licensing framework, or making it voluntary, e.g. through an accreditation regime.
The feedback provided has been taken into consideration in the drafting of the Bill.