South East Asia
External attack surface management for Singapore organisations
Singapore’s new Cybersecurity Code of Practice says it plainly: enterprise systems outside a CII boundary still present an attack surface, and attackers use them as the way in. CCoP 2026 asks CII owners for a complete inventory, including internet links, cloud services and interconnected systems, and for DNSSEC on their domains. EASMLens shows those things from the outside, continuously.
Serving organisations in Singapore.
What the rules in Singapore expect
CCoP 2026: inventory, interconnections and DNSSEC
The Cybersecurity Code of Practice for Critical Information Infrastructure 2026 was issued on 29 July 2026 and replaces CCoP 2.0. Clause 4.1.1 requires CII owners to identify all CII assets and maintain an inventory that includes outsourced providers, cloud services, internet links and their DDoS protection, and every external system the CII interfaces with. Clauses 4.1.2 to 4.1.4 extend this to systems that interconnect with the CII, from 29 July 2027 for existing owners.
Other clauses can be checked from the outside. Clause 5.12.6 puts internet-facing web applications behind a web application firewall. Clause 11.2 requires DNSSEC signing of all domains used for the CII. Clause 3.3.1 requires CII owners to hold the Cyber Trust mark at Advocate level by 31 December 2027, and clauses 3.2.3 and 3.2.4 require board threat briefings and posture reports at least every six months.
The amended Cybersecurity Act
Key provisions of the Cybersecurity (Amendment) Act 2024 came into force on 31 October 2025. They extend regulation to provider-owned and virtual CII and widen the incidents CII owners must report within 2 hours. In July 2025 the Government disclosed that the state-linked actor UNC3886 had targeted all four major telecoms operators, in one case using a zero-day to get past a perimeter firewall. Perimeter and edge devices are exactly what an external attack surface view is built to find.
MAS Technology Risk Management
The MAS TRM Guidelines expect financial institutions to keep an inventory of all information assets (3.3.2), collect vulnerability and threat intelligence (12.1), run regular vulnerability assessments covering weak configurations, open network ports and application flaws (13.1), and penetration test internet-facing systems at least annually (13.2.4). MAS consulted in mid 2026 on adding IT asset management and continuous monitoring to its binding technology risk notices. That change is proposed, not yet in force.
What each rule asks for, and what EASMLens shows you
| Rule | What it asks for | What EASMLens shows you |
|---|---|---|
| CCoP 2026 cl 4.1.1 | Inventory including cloud services, internet links and external systems | Internet-facing assets, cloud endpoints and third-party services tied to your domains |
| CCoP 2026 cl 11.2 | DNSSEC signing of all CII domains | DNSSEC status for every domain, including newly registered ones |
| CCoP 2026 cl 5.12.6 | WAF in front of internet-facing web applications | Public web applications and whether a WAF or CDN appears in front of them |
| MAS TRM 13.1 | Vulnerability assessment covering open ports and weak configurations | The full list of exposed services and ports to scope each assessment |
| CSA Internet Hygiene Portal checks | HTTPS, DNSSEC and DMARC good practice | The same checks, run across every domain and subdomain you own |
Reporting clocks
CII owners (Cybersecurity Act)
2 hours to CSA for prescribed incidents
MAS-regulated financial institutions
1 hour to MAS for a relevant incident; root cause report within 14 days
PDPA
3 calendar days to the PDPC after assessing a breach as notifiable
Questions for the board
- 1Does our CCoP 4.1.1 inventory include every internet link, cloud service and external system our CII touches, and will we meet 4.1.2 to 4.1.4 by July 2027?
- 2Are all domains used for CII services DNSSEC-signed today, and how would we know if a new one appeared?
- 3Given how UNC3886 used perimeter devices, how many internet-exposed management interfaces and end-of-support edge devices do we have, and who reports that to the board every six months?
How EASMLens supports these obligations
- Continuous discovery of internet-facing assets, cloud endpoints and third-party services
- DNSSEC, DMARC, SPF, DKIM and TLS grading across every domain
- Exposure intelligence on edge devices and management interfaces with known vulnerabilities
- Evidence for six-monthly board posture reporting
EASMLens discovers your attack surface from DNS, certificate transparency, internet-wide scan datasets and public records, then runs non-destructive checks against the assets in your scope. It never attempts exploitation. It provides discovery, monitoring and evidence. It does not certify an organisation against any framework, and no product can.
Frequently asked questions
- When does CCoP 2026 apply?
- It was issued on 29 July 2026. For existing CII owners, most new duties, including the interconnected systems inventory, apply from 29 July 2027, and the Cyber Trust mark requirement from 31 December 2027.
- Do we need a licensed provider to use EASMLens?
- EASMLens is software that discovers your external estate and runs automated vulnerability checks. It does not attempt to compromise systems, which is what the penetration testing definition turns on, and it is not a managed SOC service. Take advice on your own circumstances.
- Can EASMLens monitor our vendors?
- Yes. You can monitor the external exposure of key vendors alongside your own estate, which supports CCoP interconnection and MAS third-party expectations.
Related guides
Primary sources
- CSA Codes of Practice (CCoP 2026)
- Cybersecurity (Amendment) Act commencement (CSA)
- MAS Technology Risk Management Guidelines
- Cybersecurity Services Regulation Office FAQ
Regulatory content reviewed on . General information only, not legal advice.