Singapore has proposed a new legislative framework to strengthen cybersecurity in the maritime sector through the Maritime and Port Authority of Singapore (Amendment) Bill 2026, introduced in Parliament on 6 October 2026.
The proposed amendments would empower the Maritime and Port Authority of Singapore (MPA) to oversee and promote maritime cybersecurity and regulate persons who own or operate relevant computer systems.
New Cybersecurity Framework for Maritime Systems
The Bill proposes introducing a new Part 13B into the Maritime and Port Authority of Singapore Act 1996, establishing cybersecurity obligations for designated Important Information Infrastructure (III).
The MPA would be authorised to designate computer systems as III where they are owned or operated by maritime entities, or connected to systems owned or operated by the Authority, provided that the systems meet the specified criteria. These criteria include their importance to the continuous delivery of essential transport services, port operations, or Singapore’s reputation as a provider of marine services.
The proposed definition of computer systems expressly includes both information technology (IT) and operational technology (OT), such as industrial control systems, programmable logic controllers, supervisory control and data acquisition (SCADA) systems, and distributed control systems.
Proposed Obligations for Designated Systems
Under the proposed framework, notified operators of designated III would be required to comply with several cybersecurity obligations, including:
- Cybersecurity risk assessments: Conduct assessments at least annually.
- Cybersecurity audits: Arrange compliance audits at least once every five years, or more frequently if directed by the MPA.
- Incident reporting: Report prescribed cybersecurity incidents within the applicable prescribed period.
- Threat detection: Establish mechanisms and processes to detect cybersecurity threats and incidents.
- Change notification: Notify the MPA of material changes to the design, configuration, security, or operation of designated systems within 30 days.
- Cybersecurity exercises: Participate in exercises when directed by the MPA.
- Regulatory compliance: Comply with applicable directions and cybersecurity standards of performance issued or adopted by the MPA.
Audit and risk assessment reports would have to be submitted to the MPA within 30 days of completion.
The Bill also proposes advance notification requirements for certain ownership or operational changes involving designated III, generally at least 90 days before the intended change.
Extraterritorial Application and Penalties
The proposed provisions would apply to relevant computer systems whether they are located in Singapore or overseas. They would also permit notices and directions to be issued to persons and entities operating or established outside Singapore.
Failure to comply with specified obligations could result in a fine of up to SGD 20,000, imprisonment for up to six months, or both, depending on the offence. Additional daily fines may apply to certain continuing offences.
Legislative Status
The Maritime and Port Authority of Singapore (Amendment) Bill 2026 was published in Singapore’s Government Gazette on 6 October 2026 and introduced in Parliament on the same date. The proposed amendments would come into operation on a date appointed by the Minister through notification in the Gazette.
The Bill therefore represents a proposed legislative framework, rather than confirmation that the new cybersecurity requirements are already in force.
Loading...
Reload document 
Open in new tab 
