Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Singapore Government ICT&SS Policy Reform

Control Catalog

Consists of a central pool of recommended controls meant for different type of systems.

Last updated on 12 May 2026

Purpose

This catalog lists out the same control requirements to government agencies and industry partners so that both parties can work together to apply the right level of controls for their systems.

The catalog consists of a central pool of recommended controls meant for the following systems:

  • Low-Risk Cloud

  • Low-Risk On-Premises

  • Medium-Risk Cloud

  • High-Risk Cloud CII

  • Generative AI

  • Digital Services (Others)

  • Digital Services (High Impact)

  • Sandbox

The controls are expressed using Open Security Controls Assessment Language (OSCAL) which are codified in machine-readable policy format. It enables future automation to monitor and assess the effectiveness of technical control implementation. Industry partners can get more info about OSCAL here (opens in new tab).

The controls are categorised into domain areas as listed on the left. Each control can either be a basic hygiene requirement which should be implemented or a guideline which is best practice for consideration.  A control can be tagged as requirement for low-risk systems but tagged as guideline for systems in sandbox stage. The list of controls for these profiles are listed here (opens in new tab). You may refer to sample JSON files here (opens in new tab).

Each system is to define a system security plan that comprises the implementable controls.  Agencies and their industry partners are to apply the controls identified for each system.

The recommended controls for Low to High-Risk Cloud, Low-Risk On-Premises, Digital Services, Generative AI and Sandbox systems are published here and will progressively be updated in this website.

We invite the industry players to join us in the ICT&SS Reform journey. For any feedback, please provide here. (opens in new tab)

Control Catalogs

The catalogs are listed below:

Cybersecurity

Contains established international standards and guidelines relevant to the Singapore Government’s context.

Digital Service Standards

Sets the baseline for usability and accessibility across all Singapore Government digital services.

Generative AI

Contains establishes baseline security controls for the integration and use of Generative AI(GenAI) and Large Language Models (LLMs) within applications.