Cybersecurity Act 2018: Primary legislation governing cybersecurity matters in Singapore, especially for Critical Information Infrastructure (CII). Sets framework for cybersecurity service providers and incident reporting.
Personal Data Protection Act (PDPA) 2012: Establishes rules governing collection, use, disclosure and care of personal data. Critical for vulnerability assessment scope and data handling procedures.
Computer Misuse Act: Defines cybercrime offenses and unauthorized access. Important for setting boundaries of penetration testing and vulnerability assessment activities.
MAS Technology Risk Management Guidelines: Specific requirements for financial institutions in Singapore regarding technology risk management and security testing.
Critical Information Infrastructure (CII) Regulations: Special requirements for vulnerability assessments of systems designated as Critical Information Infrastructure.
ISO/IEC 27001: International standard for information security management systems, providing framework for security testing requirements.
NIST Cybersecurity Framework: Voluntary framework of computer security guidance that can inform vulnerability assessment methodology.
Common Criteria (CC): International standard for computer security certification, relevant for security testing methodology.
Cross-border Data Transfer Regulations: Rules governing international transfer of data during vulnerability assessment activities.
Professional Engineers Act: Relevant for qualifications of security professionals conducting vulnerability assessments.
Singapore Contract Law: General contract law principles affecting the RFP structure and eventual service agreement.
Electronic Transactions Act: Framework for electronic transactions and digital signatures in contractual arrangements.
Evidence Act: Governs admissibility of digital evidence, relevant for vulnerability assessment findings and documentation.
Singapore Standards (SS) 584: Singapore's standard for guidelines on management of end-user computing.
CSA Security-by-Design Framework: Guidelines by Cyber Security Agency of Singapore for incorporating security in system design and testing.
CSA Internet Surfing Separation Guidelines: Specific guidelines for network separation that may affect vulnerability assessment scope and methodology.
