OT-ISAC report maps 2026 Asia-Pacific critical infrastructure and OT cybersecurity policy changes across nine jurisdictions

Linha do tempo

1. industrialcyber.co ↗ · pub. 26/10/2026 07:03 · coletado 26/10 09:01 primeiro registro

   OT-ISAC report maps 2026 Asia-Pacific critical infrastructure and OT cybersecurity policy changes across nine jurisdictions

   ler a análise desta fonte ocultar

   OT-ISAC published its APAC OT/CI Cyber Policy Intelligence Report (current as of Oct. 20, 2026). It tracks binding, approved-but-not-yet-effective, draft and non-binding cybersecurity policy for critical infrastructure and OT across Japan, India, Singapore, Australia, China, Taiwan, South Korea, Malaysia (Sarawak) and Vietnam. The report covers policy only, not incidents, threat activity or vulnerabilities. It urges operators to verify applicability against primary legislation before treating any development as a compliance obligation. Most measures are sector- or designation-specific rather than new PLC/SCADA technical standards.

   Technical Details

   • Japan: Unified Standards for Cybersecurity Measures for Critical Infrastructure took effect Oct. 1, 2026. Two drafts are in consultation until Oct. 31: an amendment to the CI cyber-event reporting order and Economic Security Promotion Act rules for CI equipment and suppliers.
   • India: CEA Cyber Security in Power Sector Regulations, 2026 were notified July 31 and take general effect Apr. 1, 2027. They cover OT tied to the interconnected power system and connected IT.
   • Australia: PSPF Direction 002-2026 (Sept. 29) is binding on non-corporate Commonwealth entities and SoGS. It requires a legacy-technology stocktake and risk plan by Mar. 31, 2027, and SoGS stocktake reports by Dec. 31, 2026. ASD Essentials (Oct. 15), including an OT chapter and the "vital OT" concept, is non-binding.
   • China: Revised Ministry of Public Security Measures on supervision and inspection of cyberspace security took effect Oct. 1, 2026. They change inspection and enforcement process, not technical standards.
   • Singapore: CSA CII Cybersecurity Code of Practice 2026 was issued July 29. The Digital Infrastructure Bill passed Oct. 7, with staged commencement expected in 2027. The Cybersecurity Strategy 2026 (Oct. 13) is non-binding. Quantum-safe migration advisory and grant (Oct. 14) build on CII milestones of Mar. 31, 2027 for plans and Dec. 31, 2031 for migration.
   • Taiwan: Ministry of Digital Affairs control-system security baseline for communications and broadcasting providers (Sept. 16) takes effect Jan. 1, 2027, with an alternative-control approval path.
   • South Korea: Ministry of Science and ICT proposed an amendment (Sept. 11) to the vulnerability analysis and evaluation criteria for major ICT infrastructure. It is not final.
   • Malaysia (Sarawak): Cybersecurity Strategy and Roadmap 2030 launched Oct. 5. It is a strategy, not a regulation.
   • Vietnam: Decision 1875/QD-TTg (National Cybersecurity Architecture Framework, Sept. 30), Decision 1964/QD-TTg (National Cybersecurity Assurance Index, Oct. 12, pilot 2027-2028) and a draft IoT device cybersecurity standard (consultation closed Oct. 24).

   Remediation

   • Map regulatory requirements to existing OT security controls and confirm applicability by designation, sector and asset role.
   • Assess supplier dependencies and document risk and governance decisions.
   • Prepare for audits, incident response and operational recovery.
   • Run gap assessments, for example against the Indian power-sector regulations and the Singapore CCoP.
   • Inventory legacy systems and cryptographic dependencies.
   • Track the Japan consultations (deadline Oct. 31) and the implementing instruments for non-final measures.