CCoP 2026: Strengthening Cyber Resilience Across Singapore’s Critical Infrastructure

Singapore’s Cybersecurity Code of Practice for Critical Information Infrastructure 2026 marks an important shift in how CII owners must think about security.

The focus is no longer limited to protecting the designated CII environment itself. CCoP 2026 places greater emphasis on Board and senior-management accountability, visibility into systems connected to CII, continuous monitoring, behavioural baselining, threat hunting and evidence that security controls are working as intended.  

For security leaders, the challenge is clear: attackers do not respect organisational or network boundaries.

The attack path extends beyond the CII environment

An attacker may first compromise a user account, remote-access system, engineering workstation or management server before moving toward the systems that deliver essential services.

CCoP 2026 reflects this reality by extending security requirements beyond the designated CII itself. The Code distinguishes between enterprise systems, CII interconnected systems, and the CII systems that deliver essential services, with new Section 12 requirements focused specifically on systems that connect to or communicate with CII.

This means CII organisations need more than a static view of what should exist. They need to understand what is communicating, how identities and systems are behaving, and whether suspicious activity is progressing toward critical infrastructure.

Where Vectra AI can support CCoP readiness

Vectra AI supports CII organisations in the areas where visibility, detection, investigation, and response are most important.

“CCoP 2026 reflects today’s evolving threats to critical infrastructure. Vectra AI supports 31 of the 38 clauses relevant to its capabilities within the Code’s 53 clauses, helping organisations detect threats earlier and respond before critical operations are disrupted.”

— Hock Leng, Vice President of Sales, APJ, Vectra AI

See what is communicating with CII

Based on our clause-by-clause assessment of CCoP 2026, Vectra AI directly or supportively aligns with 31 of the Code’s 53 clauses. That alignment is strongest across visibility, monitoring and detection, threat hunting, incident response, OT monitoring and interconnected-system security. Alignment does not mean Vectra AI alone satisfies each clause, but that its capabilities can directly support or strengthen the required control.

Detect abnormal behaviour earlier

Section 6.2 requires CIIOs to establish normal operational and network activity, monitor deviations, correlate cybersecurity events, and trigger alerts for investigation. The Code also recognises that attackers may use less-monitored areas as stepping stones toward CII.

This aligns closely with Vectra AI’s core capabilities. The platform analyses activity across network, identity and cloud environments to identify abnormal behaviour, correlate related events, and prioritise the entities that present the greatest risk.

Instead of presenting analysts with disconnected alerts, Vectra AI helps show how an attack is progressing and what requires immediate attention.

Support threat hunting, investigation and response

CCoP also places greater emphasis on proactive threat hunting and incident readiness.

Vectra AI provides enriched metadata, behavioural context, and investigation workflows that help analysts search for hidden activity, reconstruct attack paths, and determine whether a cybersecurity incident is underway.

When response is required, integrations can support native actions such as isolating a host, restricting a compromised account, or blocking malicious traffic. These capabilities strengthen the technical execution of incident response, while the CIIO retains ownership of its response plan, regulatory reporting, forensics, and recovery processes.  

Supporting OT and interconnected environments

Many CII environments include OT, legacy systems, and devices that cannot support endpoint agents.

Vectra AI can passively monitor visible traffic in these environments without requiring agents on sensitive systems. This is particularly relevant to the requirement in Section 10.2 to monitor OT-to-enterprise data flows for anomalies, as well as Section 12.7 requirements to investigate suspicious activity across interconnected systems.  

Additional controls are still required for areas such as endpoint logs, virtualisation infrastructure, patching and formal reporting to CSA, but Vectra AI can provide an important layer of behavioural visibility across the communication paths attackers may use.

Start with the visibility gap

For CII organisations preparing for CCoP 2026, a practical starting point is to ask:

• Do we know every system that communicates with the CII?
• Can we detect when a valid identity or trusted system begins behaving abnormally?
• Can we show what the security team saw, investigated, and did in response?

Vectra AI does not replace the governance, certification, IAM, patching, backup or regulatory-reporting controls required by CCoP. Its role is to help CII organisations see attacker behaviour earlier, investigate faster and produce stronger operational evidence that their detection and response controls are working.

Learn more about how Vectra AI can support CCoP requirements in this infographic.