A few sectors such as the Banking and Finance sector have regulatory levers to tackle cyber threats and incidents. For example, the Monetary Authority of Singapore (MAS) has Guidelines on Technology Risk Management (TRM), as well as the MAS Notice on TRM (pursuant to Section 55 of Banking Act which empowers MAS to impose requirements on banks). The TRM Notice imposes obligations on credit card or charge card licensees to make reasonable efforts to maintain a high availability of critical systems, to establish a recovery time objective for each critical system, to notify MAS of a relevant incident, to submit a root cause and impact analysis report to MAS of the relevant incident, and to implement IT controls to protect customer information from unauthorised access or disclosure. Therefore, in these aspects, MAS's existing powers are similar to the powers over Critical Information Infrastructure owners in the Cybersecurity Act.
However, most sectors have outcome-based legislation, in which penalties apply after performance or service standards fall. The Act thus provides a common set of powers to Assistant Commissioners appointed from such sector leads to empower them to enforce cybersecurity requirements within their sectors.