About
Under the Cybersecurity Act and Cybersecurity (Cybersecurity Service Providers) Regulations, the following groups of people are required to obtain a cybersecurity service provider’s (“CSP”) licence:
- • those who engages in the business of providing any of the following licensable cybersecurity service (“LCS”) to other person is required to obtain a cybersecurity service provider’s (“CSP”) licence.
- • those who is in the business of providing a LCS, is also required to obtain a licence before he/she may advertise or provide the LCS.
At A Glance
| List of LCS as specified in the Second Schedule of the Cybersecurity Act | 1. Managed security operations centre (SOC) monitoring service; and 2. Penetration testing service |
| Licence Fees for each Licence | Business entity - S$1000 Individual - S$500 A 50% fee waiver will be granted on all applications lodged from 4 April 2022 to 4 April 2023. |
| Refund | The licensing officer may, where the licensing officer considers appropriate, refund or remit the whole or part of any fee paid. |
| Licence Validity Period | Two years from the date of approval. | Application Processing Time | The processing of new licence applications will take up to six weeks, starting from the receipt of the complete application including all supporting documents. Applicant will be notified of the outcome of the application via email. |
Note:
- All providers of LCS, regardless of whether they are companies or individuals who are engaged for such services, are required to obtain a licence, except for companies that provide LCS solely to their related companies or in-house consumers of LCS.
- Providers who offer or intend to offer both LCS are required to submit separate licence applications and obtain a licence for each LCS.
- With effect from the commencement of the licensing framework on 4 April 2022, all providers who are engaged in the business of providing LCS, have until 4 October 2022 to apply for a licence. Providers who have submitted their licence application to CSRO between 4 April 2022 and 4 October 2022, may continue to engage in the business until a decision is made on their licence application. Any providers providing the LCS after 4 October 2022, without having lodged an application for a licence, will be deemed to be operating illegally. In the event that the application for a licence is refused, the provider would not be allowed to engage or continue to engage in the business of providing the LCS.