Glossary

Agency Users

Agency Users refer to all Agency and non-Agency personnel (e.g. Third Party personnel) who are granted access to ICT&SS to perform official work for that Agency.

Control Tier Definitions

Level 0 - Refers to a cardinal and non-discretionary requirement that must be satisfied without compromise or deviation. Compliance with a Level 0 control cannot be waived. Only under very exceptional circumstance where an Agency faces constraints that affect its ability to comply should an Agency consult Central (refers to the IM8 Secretariat ↗ (opens in new tab)) before any further action is taken. Such consultation does not diminish the cardinal nature of Level 0 controls.

Characteristics:

1. Carries Whole-of-Government impact - a failure to meet this control has the potential to escalate beyond one Agency to affect the integrity, trust, or operations of the broader public service and the Government as a whole; or

2. Whole-of-Government visibility and consistency - uniform implementation across all agencies is essential to maintain a coherent and reliable baseline of compliance, and any deviation or inconsistency must be visible at the central level to safeguard the integrity of the broader governance framework.

Level 1 - Refers to a set of baseline technical or process controls that establish the basic requirements for the secure and effective operation of a system or process. Agencies have the discretion to adopt alternate means of implementation provided that the approach taken meets the policy intent of the control. This recognises that different operational contexts call for different technical or process solutions while still upholding the underlying requirement.

Where an agency determines that it is unable to meet the policy intent of a Level 1 control (i.e., not implementing the control), it must be formally approved through a tiered governance process commensurate with the risk profile of the system. For the tiered governance process, please refer to the IM8 Compliance Model as set out in SNG (PMO) Circular No. 3/2024 ↗ (opens in new tab).

Characteristics:

1. Baseline but Risk-Contextual - Level 1 controls are required across all systems as a baseline expectation, but acknowledge that the appropriate response to deviation is shaped by the risk profile of the system involved, rather than being an absolute prohibition; or

2. Operationally and Technically Driven - Level 1 controls are grounded in technical standards and process requirements, addressing the operational and functional integrity of systems and processes within an Agency’s purview.

Level 2 - Refers to optional, non-mandatory controls that represent recommended best practices for Agencies to consider based on system needs, risk profile and operational context. Agencies retain full discretion on whether to implement these controls. Non-implementation of Level 2 controls does not require risk acceptance or deviation and should not be treated as a compliance gap.

Characteristics:

1. Advisory and Best Practice-Oriented - Level 2 controls represent recommended best practices that reflect a higher standard of operational excellence. They are not binding requirements but serve as guidance for agencies seeking to strengthen their security or process posture beyond the mandatory baseline.

Digital Service

A Digital Service refers to any service provided by the Singapore Public Service that is delivered through digital systems, tools or platforms, that allows Public Users to access information, perform tasks, or complete transactions related to the government and public service.

A Digital Service can be:

1. Web-based

2. Mobile application

3. Others (such as desktop applications)

A Digital Service can contain one or more pages/screens, tools or Transactional Services.

Host

A host is typically a server (e.g. a physical device or virtual machine). A container is not considered a host as it is a workload that runs on a host and depends on its underlying resources (e.g. operating system, etc.).

Non-Transactional Service

A Non-Transactional Service is a Digital Service that enables Public Users to access general or personalised information, or engage with the government without requiring the exchange of information, goods, services or money, or changes to government data.

These services help Public Users understand, navigate, and engage with government information and policy, often preceding and providing context for transactions.

The categories and examples of non-transactional services are shown in below table.

Public Users

Public Users refer to all General Public users who access and use Digital Services from within or outside Singapore.

Transactional Service

A Transactional Service is a Digital Service that involves Public User action resulting in:

1. The exchange of information, goods, services or money between a citizen or business and the government, and/or

2. A change to Government Data

The exchange does not need to be successful (e.g. approved or accepted) for the Digital Service to be considered a Transactional Service. The outcome need not be immediately available and may be delivered through digital or non-digital channels (e.g. email, post, phone).

The following are not considered transactional exchanges:

1. Login/authentication to access a digital service (e.g. Singpass login or username/password authentication)

2. User consent or acknowledgement required by the underlying system or platform (e.g. accepting browser or operating system level terms or cookie tracking notices)

Example: A Public User logs in to a Digital Service containing both Transactional Services and static informational content. The act of logging in grants access but is not itself a transaction. While in the Digital Service, the user proceeds to submit an application to get a license. The application flow to get the license is a Transactional Service even if the outcome is later communicated by email or post.

The categories and examples of transactional services are shown in below table.