Infrastructure Protection Act Singapore: A Practical Guide for Building Owners, Developers and Security Managers

Financial institutions in Singapore operate in a security environment that is different from a typical commercial organisation. Apart from protecting employees, customers, information and business operations, financial institutions may need to consider threats ranging from unauthorised access and theft to armed attacks, explosive threats and disruption to critical facilities.

The Association of Banks in Singapore’s Physical Security Guidelines for Financial Institutions 2.0 (Revised 2025) provides a framework for financial institutions to develop and review their physical security programmes.

Importantly, the guideline does not take the position that every financial institution should simply deploy the maximum possible level of security. Instead, it promotes a risk-based approach, where security measures are proportionate to the organisation’s assets, operations, premises, threat environment and risk appetite.

For security managers, facilities teams, project managers and consultants, the practical question is therefore not:

“What security equipment does ABS require?”

The better question is:

“What risks exist at this particular financial institution, and what combination of physical, technological, procedural and operational controls is appropriate?”

That distinction runs throughout the ABS guideline.

What are the ABS Physical Security Guidelines?

The ABS guidelines provide financial institutions with functional guidance on establishing an effective physical security programme.

ABS explains that the document complements the Ministry of Home Affairs’ Guidelines on Enhanced Building Security in Singapore (GEBSS). The distinction is useful: ABS provides guidance from a functional financial-sector perspective, while GEBSS contains more specific technical information on physical security measures.

The guideline also refers financial institutions to other supporting material, including the SPF Video Surveillance Standard for Buildings and information relating to the Infrastructure Protection Act.

This means the ABS guideline should generally be read as part of a wider Singapore physical-security framework rather than as a standalone technical specification.

Are the ABS Physical Security Guidelines mandatory?

The ABS document presents itself as a set of guidelines and recommendations for financial institutions.

It does not state that every recommendation within the document is automatically a statutory requirement applicable to every financial institution.

However, that does not mean physical security requirements are entirely optional.

The guideline itself notes that a physical security risk assessment may be required under other regulatory requirements, giving the MAS Technology Risk Management Guideline and the Infrastructure Protection Act as examples.

Therefore, a useful distinction is:

ABS guidance provides the overall security approach and recommended considerations.

Other regulations, codes or authority requirements may impose specific obligations depending on the building, facility, activity or security system concerned.

For a project, those requirements should be identified separately rather than assuming that everything contained within the ABS guideline carries the same regulatory status.

The four components of an ABS physical security programme

ABS organises an effective physical security programme around four main components:

1. Physical Security Risk Assessment
2. Protection
3. Detection
4. Response

The risk assessment identifies threats, vulnerabilities and potential consequences. Protection provides controls to reduce those risks. Detection identifies incidents or developing threats, while response determines what happens once an incident occurs.

This framework is important because it prevents security from becoming simply an equipment-purchasing exercise.

Installing additional CCTV cameras does not necessarily resolve a security risk if nobody monitors the cameras, the field of view is inadequate, no escalation procedure exists, or the underlying vulnerability remains.

When should a financial institution conduct a Physical Security Risk Assessment?

A Physical Security Risk Assessment, or RA, is one of the most important parts of the ABS framework.

ABS describes the assessment process as identifying and prioritising assets, identifying applicable threat scenarios, assessing vulnerabilities, analysing impact and then determining appropriate security measures.

Financial institutions should consider conducting a risk assessment when developing or redeveloping premises, after major modifications, renovations or alterations, and periodically thereafter.

From a project perspective, this makes the risk assessment particularly relevant when a financial institution is:

moving into a new office, relocating a branch, undertaking a major fit-out, changing the use of an area, expanding into adjoining premises, redesigning access routes or materially changing its physical security systems.

Consultant’s perspective

A common mistake is to design CCTV, access control and alarm systems first and conduct the risk assessment afterwards.

Ideally, the process should work in the opposite direction:

Assets → Threats → Vulnerabilities → Consequences → Risk → Security Controls

The technology should be part of the risk treatment, not the starting assumption.

Who can conduct the Physical Security Risk Assessment?

ABS states that risk assessments may be carried out by either internal or external security professionals, depending on the financial institution’s requirements and resources.

However, there is an important distinction for certain higher-risk facilities.

For risk assessments involving Critical Infrastructure or High Profile Developments that may require structural or blast analysis, ABS states that the financial institution should engage a qualified Security Consultant/Competent Person approved by MHA.

This should not be interpreted as meaning every ordinary banking-office risk assessment must be conducted by an MHA-approved Competent Person.

The required competency depends on the nature and regulatory status of the premises and the scope of the assessment.

What is a Critical Asset?

ABS defines Critical Assets as facilities, systems or equipment that could have a debilitating effect on the infrastructure or the financial institution’s operations if damaged or destroyed.

Examples provided include air-handling systems, electrical systems and telecommunications rooms.

This concept is useful when deciding which parts of an office require greater levels of protection.

A normal meeting room and a telecommunications room, for example, do not necessarily require the same security controls.

The classification should be based on consequence, rather than simply on the name of the room.

What threats should a financial institution consider?

ABS gives examples including armed attacks, improvised explosive devices, chemical or biological threats and unauthorised access.

Its incident-response section later addresses scenarios including active assailants, bomb threats, mail-delivered threats, chemical, biological and radiological threats, Person-Borne Improvised Explosive Devices, Vehicle-Borne Improvised Explosive Devices and hostage situations.

This does not mean every threat should automatically receive the same level of treatment.

The purpose of the threat assessment is to determine which scenarios are reasonably applicable to the particular premises and operations.

What is the ABS layered-security approach?

ABS states that no single protective measure can effectively eliminate physical security risk on its own.

Instead, financial institutions should adopt complementary layers of protection based broadly on:

Deter → Detect → Delay → Deny → Respond.

Consider an unauthorised person attempting to enter a restricted office.

Visible security and visitor procedures may deter the attempt.

CCTV or an alarm may detect it.

A secured door may delay the individual.

Access control may deny access.

Security personnel or another response resource then responds.

The important point is that these measures work together.

A locked door with no alarm or monitoring may delay an intrusion without generating a response. Likewise, an alarm with nobody responsible for investigating it provides detection without effective response.

What does ABS say about CCTV?

ABS describes CCTV as an integral component of security monitoring and recognises both its investigative and deterrent value.

Camera locations should be based on identified risks.

Typical locations identified by ABS include building or branch entrances, lobbies, access-control and screening points, ATMs, sensitive or restricted office entrances, vaults, critical equipment rooms, technology rooms, data halls and security control rooms.

Does ABS specify CCTV resolution or frame rate?

The ABS guideline itself does not provide one universal CCTV resolution or frame-rate specification in its CCTV section.

Instead, it directs financial institutions to GEBSS and the SPF Video Surveillance System Standard for Buildings for more technical information and design considerations.

This distinction matters.

A consultant should therefore avoid presenting a particular megapixel count or frame rate as an “ABS requirement” unless it is supported by the relevant technical standard or another applicable requirement.

Does ABS specify CCTV retention?

The guideline does not state one universal CCTV retention period in its main CCTV section.

Interestingly, the Building Management Engagement Checklist asks whether an organisation has stipulated a minimum CCTV retention period and whether periodic checks are carried out to validate it.

So the practical requirement is to establish the applicable retention requirement and verify that the system is actually achieving it.

Does PDPA apply to CCTV?

Yes.

ABS expressly states that the collection, use and disclosure of CCTV recordings must comply with the Personal Data Protection Act.

The recording equipment should also be housed in a secured location accessible only to authorised personnel to prevent tampering with settings or recordings.

What does ABS say about electronic access control?

ABS describes effective access control as regulating movement so that authorised persons can enter appropriate areas.

Access control should be established at relevant and appropriate entry and exit points, including office entrances and perimeter doors. Stronger access-control measures should be considered for sensitive or critical locations such as safe rooms, cash-processing areas, sensitive document stores and data halls.

Does ABS require two-factor authentication?

Not on every door.

ABS identifies two-factor authentication as a possible stronger control for sensitive or critical areas and gives examples including:

card + PIN and card + biometric.

It also mentions anti-passback and interlocking access-control arrangements as possible enhanced measures.

For restricted or critical internal areas, ABS also discusses complementary controls such as 2FA, intrusion detection and audible alarms.

The appropriate measure therefore depends on the risk associated with the area.

What security zoning does ABS suggest?

ABS provides an example of role-based security zoning.

It illustrates progressively controlled areas ranging from public areas, through visitor areas and normal employee areas, to restricted areas accessible only to authorised employees.

For a real financial institution, this concept might translate into separate zones such as:

public/reception space, general employee area, controlled departmental area and restricted critical area.

The exact classification should depend on the organisation’s operations and risk assessment.

What about fire alarm integration and emergency egress?

Access control must not compromise fire protection and life safety.

ABS specifically states that electronically controlled doors should be integrated with fire-protection arrangements to permit emergency egress in accordance with the applicable local fire code.

For project teams, this is an important distinction between security requirements and life-safety requirements.

The detailed release arrangement for a particular secured door should therefore be established with reference to the relevant fire requirements and project professionals rather than inferred solely from the ABS guideline.

What security should be provided for critical equipment rooms?

ABS recognises that the failure of supporting systems such as electrical supply, communications, water, air systems or fire protection can sometimes cause consequences greater than the initial security incident itself.

Critical equipment should, where practicable, be placed away from higher-risk areas, concealed and protected.

ABS recommends controls such as CCTV, door access control and intrusion detection for rooms containing critical equipment, with access restricted to authorised personnel.

This is particularly relevant when assessing server rooms, telecommunications rooms, electrical rooms and other essential infrastructure.

What does ABS say about visitor management?

Visitor management should include the identification, management and tracking of visitors.

ABS recommends directing visitors to a registration point, using appropriate photo identification for screening and recording visitor details before issuing a visitor pass.

Visitors should also be accompanied by authorised personnel where necessary.

Visitor information itself is personal data, and ABS states that its collection, use, disclosure and disposal must comply with the PDPA.

A practical visitor-management process therefore needs to consider not only who is permitted access, but also how the collected information is managed.

How often should access rights be reviewed?

ABS recommends conducting regular reviews of door-access privileges to ensure employees continue to have valid access rights.

For sensitive or critical areas, access logs should also be reviewed for possible access violations or suspicious activity.

The guideline does not prescribe one universal review interval in this section.

The organisation should therefore establish an appropriate review cycle within its own security governance framework.

Event-driven reviews are also important when employees leave, change departments or change responsibilities.

Does ABS require security systems to be maintained?

Yes.

ABS states that preventive checks and maintenance should be carried out regularly to maintain the optimum performance of security systems and equipment.

For retail branches, the guideline becomes even more explicit and recommends operational checks including CCTV playback to confirm image quality, retention and approved field of view, verification of door-access systems and testing of duress buttons and alarm systems.

This is important because physical security effectiveness can deteriorate gradually.

A camera may still appear “online” even though furniture, signage or a modified wall has compromised its original field of view.

Does CCTV need to be actively monitored?

ABS states that system detection should be supported by active monitoring so appropriate action can be taken when threats are detected.

Monitoring can be performed through an on-site Security Control Room or Security Command Centre, or by an off-site Central Monitoring Station.

ABS also recognises that different monitoring models may be appropriate depending on the premises.

For example, a fully controlled building or standalone data centre may justify an on-site control room, while a financial institution occupying space in a multi-tenant building may rely partly on building management or on off-site monitoring by an internal team or third-party security provider.

This is an important point for organisations considering remote security operations.

ABS does not assume that all security monitoring must physically take place inside the financial institution’s premises.

The effectiveness of the escalation and response process remains the critical consideration.

What should a Security Control Room do?

A control room should not simply be a room containing CCTV monitors.

ABS describes it as a nerve centre where security-system information is received and used to support response.

Control-room personnel should have sufficient situational awareness to assess and prioritise CCTV and alarm information and differentiate genuine incidents from false alarms.

The control room should also have an escalation plan identifying the actions to be taken and the personnel to be notified when a threat is detected.

The effectiveness of a control room therefore depends as much on operators, procedures and escalation protocols as it does on technology.

What changes during heightened security conditions?

ABS recommends that financial institutions prepare different detection approaches for normal and heightened or enhanced security conditions.

Possible heightened measures include reducing the number of entry and exit points, deploying additional security personnel, conducting bag or vehicle screening and increasing employee awareness.

For financial institutions occupying multi-tenant premises, these measures should be coordinated with building management.

This is another reason why tenant security plans cannot be developed entirely independently from the building in which the financial institution operates.

What security SOPs should a financial institution maintain?

ABS states that financial institutions should maintain a current and updated set of Security Standard Operating Procedures.

The SOPs should address routine security operations as well as escalated incidents and should complement relevant building-management procedures. They should also consider the threat scenarios identified through the risk assessment and different security threat levels.

In practice, a physical-security programme may therefore require procedures covering areas such as access control, visitors, alarm escalation, CCTV incidents, unauthorised access, suspicious packages, lockdown, evacuation and coordination with building management.

The precise SOP set should follow the organisation’s assessed risks.

What role does the landlord or building management play?

This is particularly important for financial institutions located in leased commercial premises.

ABS states that tenants should understand the building’s security and safety design when planning their own security requirements.

The guideline then dedicates a substantial appendix to a Building Management Engagement Guide/Checklist.

Its purpose is to help financial institutions understand the level of security preparedness provided by the building owner or management.

The checklist contains questions covering matters such as perimeter security, CCTV monitoring, building access, security personnel, power resilience, communications, heightened security, evacuation, suspicious vehicles, bomb threats, armed attack and CBR incidents.

For a financial institution considering a new office, this can also be used as the foundation for a pre-lease physical security due-diligence review.

Does ABS provide guidance for retail bank branches?

Yes.

Appendix 2 provides a General Guide for Retail Branches.

However, ABS specifically states that the guide is not intended to be a baseline requirement or to replace additional security requirements established by individual financial institutions.

The appendix provides examples of controls for:

branch perimeters, customer-service counters, teller areas, back-of-house areas, vaults and built-in safes, and safe-deposit-box facilities.

The measures include combinations of CCTV, electronic access control, mechanical security, intrusion or motion detection and duress buttons.

It also recommends security guarding, 24/7 alarm monitoring or response services, staff training and operational procedures appropriate to branch activities.

What should a financial institution do after a security incident?

Security management does not end when the immediate incident has been resolved.

ABS recommends a post-incident review to determine root causes, identify vulnerabilities and response gaps, gather feedback from relevant stakeholders and implement corrective measures.

A physical security risk assessment may also form part of the post-incident review.

Lessons learned should subsequently be incorporated into the organisation’s policies and procedures.

This creates a continuous security cycle:

Assess → Protect → Detect → Respond → Review → Improve

A practical way to apply the ABS guideline

For most financial institutions, implementation should not begin by asking how many cameras, card readers or security officers are required.

It should begin by understanding the premises and operations.

A practical consulting process would generally be to identify the critical assets and operations, assess credible threats and existing vulnerabilities, understand the potential consequences of loss or disruption, review landlord and building-management controls, determine the residual risks and then develop proportionate physical, technological and procedural controls.

The resulting programme may include CCTV, access control, intrusion detection, visitor management, monitoring, security personnel, SOPs, training and incident-response arrangements.

The exact combination will differ from one financial institution to another.

That is consistent with the central principle running through the ABS guideline:

physical security should be risk-based rather than based on a one-size-fits-all specification.

Conclusion

The ABS Physical Security Guidelines for Financial Institutions 2.0 provides much more than recommendations on security equipment.

It establishes a framework for managing physical security through risk assessment, layered protection, detection, monitoring, procedures and response.

For financial institutions planning a new office, branch, renovation or security-system upgrade, the most useful approach is therefore to start with the risk and operational requirements before deciding on the technology.

The ABS guideline can then be used alongside relevant technical standards, regulatory requirements and building-management arrangements to develop a security programme appropriate to the particular financial institution.