Critical Information Infrastructure refers to regulated systems whose disruption would seriously affect essential services such as power, water, transport, communications, banking, or government operations. In Singapore’s cybersecurity regime, CII owners are subject to specific legal and technical obligations because failures in these systems can quickly become public safety, economic, or national security problems.
CII matters because attackers often target it for maximum impact, using ransomware, phishing, supply-chain compromise, or exploitation of exposed remote services to reach operational technology and support networks. Defenders respond with stricter access control, segmentation, logging, patch management, incident response testing, and compliance with the Cybersecurity Code of Practice. In practice, CII is where cybersecurity becomes operational: organizations must not only prevent intrusions, but also prove they can detect, contain, and recover from attacks without interrupting essential services.