Preparing for a CSA Cybersecurity Code of Practice Audit: What Evidence Assessors Expect

A CSA Cybersecurity Code of Practice (CCoP) audit is only as strong as two things: the evidence a Critical Information Infrastructure owner produces, and the credentials of the people who tested it. CSA requires that the statutory cybersecurity audit be carried out at least once every two years by an auditor approved or appointed by the Commissioner of Cybersecurity, and increasingly, CII owners and their suppliers are being asked to prove not just that controls exist, but that the people who tested them were qualified to do so.

What CSA Actually Requires

The CCoP is issued by the Commissioner of Cybersecurity under the Cybersecurity Act 2018 and sets the minimum cybersecurity requirements for owners of designated Critical Information Infrastructure (CIIOs). CSA publishes the current Code on its legislation page, and the Cybersecurity Code of Practice for Critical Information Infrastructure 2026 was last updated 29 July 2026.

Scope: what the updated Code now covers

The updated Code represents a significant enhancement in Singapore's approach towards Critical Information Infrastructure protection, such as imposing board-level accountability on CII owners and mandating Cyber Trust Mark certification (Tier 5) for all CIIOs and their auditors. The boundary of what falls under audit scope has also widened: the updated Code extends the scope of application for specific cybersecurity obligations to interconnected information technology or operational technology systems or network infrastructure owned, operated, and/or controlled by the CIIO, but which are not themselves designated as CII. The Code also annexes recommendations for components of an IT or OT system that support the CIIO's business, operational or administrative functions and services, which fall outside the scope of mandatory CII requirements, to strengthen the overall cybersecurity posture.

Governance obligations are now specific and measurable rather than aspirational. The CIIO Board must participate in cybersecurity training at least once every 12 months and receive cyber threat briefings at least once every six months, and at least one member of senior management must possess the knowledge and awareness necessary to manage cyber risks across the CII. For a security lead, this means the evidence pack for the next audit needs a documented training and briefing log sitting alongside the technical control evidence.

The timeline gives owners room to prepare, but not indefinitely. The Code takes effect on 29 July 2026, with most new obligations taking effect on 29 July 2027, while existing CIIOs are required to attain Cyber Trust Mark Advocate (Tier 5) certification, or its equivalent, by 31 December 2027. That means the next statutory audit cycle is the one in which gaps against the new Code become visible to the assessor — and to CSA.

Evidence trail: what an assessor is actually testing

CSA's own guidance on CII audits is specific about method. The auditor should adopt both compliance and risk-based approaches: for the compliance-based approach, carrying out a compliance test to ascertain the adequacy and effectiveness of controls applied to comply with the Act, subsidiary legislation, written directions, the Code of Practice and Standards of Performance; and for the risk-based approach, identifying the risks and threats the CII faces and whether the controls in place are appropriate to mitigate them. In practice, this means an evidence pack needs to show not just that a control exists, but that it was tested against a defined risk, and that the test method is traceable back to a named, qualified assessor.

Frequency: the audit cycle itself

Under section 15(1)(a) of the Cybersecurity Act 2018, the owner of a Critical Information Infrastructure must carry out a cybersecurity audit of the CII's compliance with the Act and applicable codes of practice at least once every two years, or at a higher frequency directed by the Commissioner in a particular case, and the audit must be carried out by an auditor approved or appointed by the Commissioner. The two-year cycle is a floor, not a ceiling, and the new Code's annual board-level training requirement effectively creates an internal checkpoint between statutory audits.

Why Assessor and Provider Qualifications Are Part of the Evidence Itself

This is the part that is often underestimated. The Commissioner's approval or appointment of the statutory auditor is a defined precondition, not a formality — it is written directly into the legal basis for the audit, alongside frequency and method. Where the audit evidence depends on technical testing feeding into the compliance and risk-based assessment, such as penetration testing or managed security operations centre (SOC) monitoring, a second layer of credentialing applies.

That regime is administered separately by the Cybersecurity Services Regulation Office (CSRO). CSA launched a licensing framework for penetration testing and managed SOC monitoring providers, administered by the new Cybersecurity Services Regulation Office, and the regime protects consumers by ensuring high provider standards. For a start, CSA licenses two types of cybersecurity service providers: those providing penetration testing and those providing managed security operations centre monitoring services. Engaging an unlicensed provider for either service is not a paperwork gap — it is an offence under the Cybersecurity Act.

The certification requirement behind that licence has also been tightened, and the detail matters for CII owners checking a provider's credentials. ISO/IEC 27001 certification is currently the only recognised equivalent for CTM Promoter (Tier 3), as it is an international information security standard. This is a Tier 3 equivalence, not Tier 5 — a distinction worth checking carefully, since the separate Tier 5 requirement under the updated CCoP applies to CIIOs and their statutory auditors, not to CSRO-licensed penetration testing or SOC providers. Licensees are given a grace period until 31 December 2026 to obtain and maintain an active CTM Promoter (Tier 3) or equivalent certificate to remain in compliance with the conditions of the licence.

Holding an ISO/IEC 27001 certificate is not automatically sufficient on its own — scope matters. CTM Promoter (Tier 3) or equivalent certification requires that certification bodies be accredited by the Singapore Accreditation Council or equivalent national accreditation bodies, and that the certification cover the environment — people, processes, and technology — supporting the delivery of the licensed cybersecurity service, with acceptable scope examples including provision of licensed cybersecurity services for penetration testing or managed SOC monitoring. A provider holding a generic ISO/IEC 27001 certificate whose scope does not explicitly reference the delivery of the licensed service may not meet the bar. For a CII owner, this means the provider conducting penetration testing or SOC monitoring should be able to show its certificate's stated scope, not just a licence number or a logo.

The practical implication for a CCoP evidence pack: it is no longer enough to attach a penetration test report. The pack should also show the CSRO licence status of the firm that produced it, the scope of the certification behind that licence, and — for the statutory audit itself — confirmation that the auditor was approved or appointed by the Commissioner.

← Swipe to compare →

How to Prepare: Practical Steps for a Security Lead

1. Map your evidence trail against the updated Code before the assessor arrives. Confirm which clauses are backed by control evidence, and where Interconnected Systems or Enterprise Systems now fall inside scope.
2. Confirm your statutory auditor's approval status in writing. Keep a record of the Commissioner's approval or appointment alongside the audit report itself — this is now part of what a regulator may ask to see.
3. Verify every third-party technical testing provider's CSRO licence and certification scope before the engagement starts, not after the report is delivered. A licence number alone does not confirm the certification scope covers the service delivered.
4. Build the board-level training and briefing record the new Code requires. An annual training log and six-monthly threat briefing record turn a governance requirement into auditable evidence.
5. Treat Cyber Trust Mark certification as a structural requirement, not a badge. With Tier 5 required for CIIOs and their auditors on the timeline above, a structured GRC programme that builds toward CTM also strengthens the evidence base for the statutory audit itself.
6. Track the compliance date, not just the effective date. Most new obligations apply from 29 July 2027, with CTM Advocate (Tier 5) required by 31 December 2027 — build remediation plans backwards from those dates, not forwards from today.

A CCoP evidence pack that cannot show the assessor's own qualification is incomplete, regardless of how strong the underlying controls are.

How Infracom Helps

Infracom supports CII owners and their suppliers through CCoP readiness and CSA Cyber Trust Mark advisory, building the governance documentation, control evidence and assessor verification records that a CCoP audit now expects, backed by an all-Singaporean team working at rates accessible to SMEs feeding into CII supply chains. Where the evidence trail depends on technical testing, our SQEP service provides suitably qualified and experienced personnel so the competency behind every test result can withstand regulator scrutiny.