Infrastructure Protection Act Singapore: A Practical Guide for Building Owners, Developers and Security Managers

Singapore’s Infrastructure Protection Act 2017 (IPA) provides the legal framework for protecting certain buildings, infrastructure and sensitive premises against security risks.

The current Act remains in force in 2026. Singapore Statutes Online shows the current version incorporating amendments effective up to 1 July 2025. Its statutory purpose is to protect certain areas, places and other premises in Singapore against security risks. (AGC SSO)

The Singapore Police Force describes the IPA as part of Singapore’s national counter-terrorism framework. Under it, premises may come within several different regimes, including:

Protected Areas, Protected Places, Special Developments and Special Infrastructures. (Singapore Police Force)

For building owners and developers, one of the most important concepts is Security-by-Design (SBD).

Where a development or infrastructure is designated under the relevant part of the IPA, security is not intended to be added as an afterthought. The building goes through an SBD process in which security measures are incorporated into its design based on an assessment of its security risks, with the process overseen by the Commissioner (Infrastructure Protection). (Singapore Police Force)

This article explains that framework from the perspective of a building owner, developer or security manager.

It does not attempt to teach the specialist work of a Competent Person. Where the IPA requires an approved Competent Person, the appropriate qualified and Commissioner-approved CP should be engaged.

What is the Infrastructure Protection Act?

The IPA is legislation dealing with the protection of certain premises against security risks.

SPF describes its two broad protective-security functions as strengthening building security and enhancing the protection of sensitive locations. (Singapore Police Force)

A useful way to understand the Act is that it contains different mechanisms for different security situations.

Some premises may be declared:

Protected Areas or Protected Places, where special controls over access, movement, conduct and other protective powers apply.

Other buildings may be designated:

Special Developments or Special Infrastructures, bringing them into the Security-by-Design and approved Security Plan regime.

A premise may potentially fall within more than one IPA category; these are not simply four interchangeable names for the same thing. (Singapore Police Force)

Does the IPA apply to every building in Singapore?

No.

The IPA is not a general building-security code applying identically to every office, warehouse, condominium or commercial property.

SPF says Special Developments and Special Infrastructures include categories such as:

critical infrastructures delivering essential services and large or iconic developments. (Singapore Police Force)

Protected Areas and Protected Places are also separately declared where special controls are considered necessary for public safety, security or the national interest. (Singapore Police Force)

So a building does not become an IPA Special Development simply because an owner decides that its security risk is high.

The designation comes through the statutory process.

What is a Protected Area?

A Protected Area, or PA, is a premise declared under the IPA where special measures are needed to control the movement and conduct of persons for security or public-safety reasons.

SPF’s guidance explains that a Protected Area may still be accessible to the public. A border checkpoint is given as an example. (Singapore Police Force)

The important idea is therefore not necessarily that the public is entirely prohibited from entering.

Rather, special security controls and lawful directions can apply within the protected premises.

What is a Protected Place?

A Protected Place, or PP, is more restrictive.

SPF’s guidance explains that public entry into a Protected Place is restricted and controlled, and that measures must be put in place to prevent unauthorised entry. A military camp is given as an example. (Singapore Police Force)

So in very simple terms:

The precise legal obligations still depend on the relevant declaration, designation and statutory provisions.

Who declares a Protected Area or Protected Place?

SPF says PA/PP premises are declared by the Minister for Home Affairs, following the relevant process. (Singapore Police Force)

Authorities of these premises must also display the required notices prominently.

For Protected Places specifically, SPF states that authorities must put in place adequate security measures against unauthorised entry. (Singapore Police Force)

Can ordinary security guards exercise IPA powers?

Not automatically.

SPF states that only authorised officers can exercise the relevant PA/PP powers under the IPA. (Singapore Police Force)

Depending on the authorised powers applicable to the premises, these can include matters such as requesting identification, directing persons to leave and inspecting belongings or vehicles in specified circumstances. (Singapore Police Force)

This distinction matters.

A security officer being physically deployed at a sensitive building does not automatically mean every statutory IPA power is available to that officer.

Can you photograph a Protected Area or Protected Place?

SPF’s current guidance says photography or videography of PA/PP premises is not allowed without the owner’s permission and directs persons to seek permission from the relevant owner. (Singapore Police Force)

The IPA also contains specific provisions dealing with prohibited photography, including photography using unmanned aircraft. (AGC SSO)

For a building owner, this means photography controls are not merely a question of putting up a “No Photography” house rule where an IPA prohibition applies.

The statutory regime should be properly understood and administered.

What is a Special Development?

SPF’s current page says Special Developments and Special Infrastructures are buildings designated by the Minister for Home Affairs under the IPA. (Singapore Police Force)

The Responsible Person guide explains the practical distinction particularly clearly for Critical Infrastructure:

a facility that has not yet been built or is in the process of being built may be designated as a Special Development. (Singapore Police Force)

The same guide describes new large developments falling within the relevant designation framework as Special Developments before construction. (Singapore Police Force)

The major significance is that security can then be integrated into the development before construction proceeds too far.

What is a Special Infrastructure?

SPF’s Responsible Person guide explains that an infrastructure which has already been built may be designated as a Special Infrastructure. (Singapore Police Force)

For existing designated infrastructure, the IPA process becomes particularly relevant when specified works or major renovations are planned.

SPF’s guidance says existing Special Infrastructure may need approval of its Security Plan before commencing major renovation works. (Singapore Police Force)

This distinction between a Special Development and Special Infrastructure is therefore closely tied to the stage of the asset’s lifecycle.

What kinds of premises may be designated?

SPF identifies two broad examples on its current SDSI page:

Critical infrastructure that delivers essential services, and large and iconic developments. (Singapore Police Force)

The Responsible Person guide expands on this.

For Critical Infrastructure, early identification matters because security requirements may need to be incorporated into the building design.

For large or iconic buildings, SPF’s guidance discusses criteria such as high public footfall and buildings of symbolic significance, with designation handled through the applicable statutory process. (Singapore Police Force)

The article should not be read as a self-assessment formula that allows an owner to decide conclusively whether its property will be designated.

Where designation may be relevant, the authoritative position comes from MHA/SPF and the applicable legislation.

What is Security-by-Design under the IPA?

Security-by-Design (SBD) is the process by which security is integrated into the development rather than added only after architectural and engineering decisions have already been fixed.

SPF currently describes it as a process ensuring that security measures are incorporated when a building is designed, based on an assessment of the building’s security risks. The process is overseen by the Commissioner (Infrastructure Protection) and runs in tandem with building development. (Singapore Police Force)

That phrase “in tandem with the building development” is important.

Security considerations can affect matters such as:

site layout, architecture, structural design, access arrangements, servicing routes, Critical Assets and security technology.

The SBD philosophy is therefore very different from waiting until construction is complete and then asking an integrator where cameras and card readers should go.

Why should Security-by-Design start early?

SPF’s Responsible Person guide specifically encourages Responsible Persons to inform CPS of upcoming specified works early, including during concept-design development.

The guidance says earlier involvement allows security considerations, site selection and the scope of security review to be addressed while the preliminary building design can still respond to them. (Singapore Police Force)

Consultant’s perspective

This is also the practical point at which a normal physical-security consultant can add value without pretending to perform CP work.

The broader project team can start identifying:

security operational requirements, site constraints, Critical Assets, technology requirements and coordination issues

so the specialist SBD/CP work is not occurring in isolation from the actual building design.

Who is the Responsible Person?

SPF describes the Responsible Person (RP) as the legal owner or occupier of the Special Development or Special Infrastructure. (Singapore Police Force)

The precise statutory position can depend on the designation and circumstances, and the Act also deals with situations where more than one Responsible Person exists.

Where multiple RPs exist, the Act provides for joint and several responsibility for duties imposed on the RP. (AGC SSO)

The important practical point is:

The responsibility does not simply sit with the architect, contractor or security consultant.

The RP remains central to the statutory process.

What does the Responsible Person need to do?

At a high level, the RP needs to ensure that the IPA process is properly carried through for the designated premises.

This can include:

engaging the appropriate consultants, obtaining the required approvals, ensuring the approved security measures are implemented and maintaining applicable measures afterwards.

SPF also says the RP should assess the suitability of the security and blast consultants according to the nature of the project. (Singapore Police Force)

The RP therefore needs to be an active participant rather than simply forwarding consultant reports to the authorities.

What is a Competent Person under the IPA?

A Competent Person (CP) is a person approved by the Commissioner of Infrastructure Protection in connection with the specified works.

The Act requires the Security Plan, including amendments submitted under this part of the Act, to be prepared by a person approved by the Commissioner for those specified works. (AGC SSO)

SPF describes Competent Persons as typically security or blast consultants who may be either commercial consultants or in-house consultants. (Singapore Police Force)

This is specialist statutory work.

A general security consultant is not automatically a Competent Person merely because that consultant has physical-security experience.

Is every security consultant on the SPF list automatically a Competent Person?

No.

This is worth stating very clearly.

SPF says its list contains consultants who have met the minimum competency requirements, but the list is only for reference.

Every CP appointment remains subject to the Commissioner’s approval on a case-by-case basis in connection with the specified works. (Singapore Police Force)

SPF goes further and expressly says that consultants appearing on the list are not automatically approved as CPs for a project. (Singapore Police Force)

Passing the minimum competency assessment also does not itself guarantee appointment as CP. (Singapore Police Force)

Can a consultant who is not on the published competency list be proposed?

SPF’s current guidance says the RP may engage a security or blast consultant who is not on the list.

That person’s competency will then be assessed on a case-by-case basis as part of the application for CP appointment. (Singapore Police Force)

Again, the decision rests with the Commissioner.

What is the difference between CP (Security) and CP (Blast)?

SPF distinguishes between Competent Person (Security) and Competent Person (Blast).

Its Responsible Person guide describes the CP (Security) as the main security consultant responsible for the SBD review.

Where blast-related assessments are required, the RP is to appoint a CP (Blast) to undertake those assessments. The same individual may potentially perform both roles if appropriately approved. (Singapore Police Force)

For a building owner, the important takeaway is:

“Competent Person” is not necessarily one generic appointment covering every specialist discipline.

The appropriate CP arrangements depend on the project’s requirements and the Commissioner’s approval.

Does every IPA project require blast work?

The official guide does not suggest that every project automatically requires the same structural blast studies.

It expressly notes that Blast Effect Analysis and Structural Resiliency Study reports are not required for selected developments or infrastructure where structural hardening is not needed. (Singapore Police Force)

So it would be incorrect to say:

“Every Special Development requires blast hardening.”

The project-specific SBD requirements determine the appropriate scope.

What work does the CP perform?

For the purposes of this article, we should keep this at orientation level.

The SPF Responsible Person guide explains that a CP may need to develop the security solution, carry out the relevant risk assessments and integrate security requirements with the wider building design.

The guide refers to up to four reports forming the Security Plan:

Threats, Vulnerability and Risk Assessment (TVRA), Blast Effect Analysis (BEA), Structural Resiliency Study (SRS) and Security Protection Plan (SPP). (Singapore Police Force)

Not every project necessarily requires all four.

This is where the detailed work should be left to the appropriately approved CP(s).

Is this article a guide to preparing the TVRA, BEA, SRS or SPP?

No.

Those documents sit within the specialist SBD/CP process.

A building owner or security manager should understand what they are for and why they exist, but preparation methodology should be handled by the appropriately qualified and approved CP.

The purpose of this article is to explain the client-side framework, not to provide pseudo-CP instructions.

What is an IPA Security Plan?

Section 33 of the Act establishes the core requirement.

A Security Plan must:

be prepared by a CP approved in connection with the specified works, be prepared in the form and manner required by the Commissioner, and contain the CP’s security risk assessment and the security measures required for the Special Development or Special Infrastructure. (AGC SSO)

This means an IPA Security Plan is not simply:

a CCTV drawing plus a list of access-controlled doors.

It is the approved security framework resulting from the statutory SBD process.

Can the Security Plan cover matters outside the immediate construction works?

Yes.

Section 33 expressly states that the requirements concerning the contents of the Security Plan are not limited to the specified works that triggered the plan requirement. (AGC SSO)

That is an important point.

Security needs to address the designated premises holistically rather than only the exact wall, extension or construction package being altered.

When must the Security Plan be approved?

SPF’s Responsible Person guide explains the practical sequence.

For Special Developments that are yet to be built or are in construction, the Security Plan must be approved before commencing the relevant construction works.

For existing Special Infrastructure, Security Plan approval is required before the relevant major renovation works. (Singapore Police Force)

The guide emphasises that carrying out specified works without the required approval is an offence and that the Commissioner can direct works to stop. (Singapore Police Force)

For current projects, the exact statutory and planning approval requirements should always be checked against the current Act, subsidiary legislation and CPS direction.

Does the Security Plan approval happen after the design is finished?

That would run against the SBD philosophy.

SPF recommends bringing CPS into the process during concept design because security considerations may influence the design itself. (Singapore Police Force)

The SBD process is intended to proceed alongside detailed building design rather than after all material architectural and engineering choices have already been locked in. (Singapore Police Force)

Can the approved Security Plan be changed later?

Yes, but it cannot simply be changed informally.

SPF’s Responsible Person guide says the RP or Commissioner may request amendments to an approved Security Plan.

Depending on the change, revisions to the underlying security documents may be needed. Once the Commissioner approves an amended Security Plan, it supersedes the previous approval. (Singapore Police Force)

The guide also says CPS should be informed of changes arising during construction, such as unforeseen site issues or operational constraints, and CPS determines whether reassessment or formal amendment approval is needed. (Singapore Police Force)

Can a contractor substitute a different security product during construction?

Ordinary project variation procedures are not necessarily enough where the product or design forms part of an approved Security Plan.

If a proposed substitution changes an approved security measure, the project team needs to assess whether that deviation affects the approved protection and whether the IPA amendment process is triggered.

SPF’s guidance specifically says changes to the approved Security Plan need to be brought to CPS and may require re-assessment or formal approval. (Singapore Police Force)

Consultant’s perspective

This is why procurement specifications for IPA projects should not casually contain phrases such as:

“or equivalent approved by contractor.”

Equivalence needs to preserve the approved security outcome and any applicable certification, testing or design basis.

What happens after the Security Plan is approved?

The approved plan includes an implementation schedule for the required security measures.

SPF’s guidance explains that some measures must be implemented before or upon completion of the specified works, while other measures may be implemented after approval of the Certificate of Works Completion according to the approved schedule. (Singapore Police Force)

So approval of the Security Plan does not complete the IPA process.

The measures then need to be implemented.

What is a Certificate of Works Completion?

The Certificate of Works Completion (CWC) is part of the process confirming that required security measures have been implemented in accordance with the approved Security Plan.

Under the Act, the CWC must be prepared by a person approved by the Commissioner to prepare it, and it must contain the CP’s certification that the relevant security measures have been implemented according to the approved plan. (AGC SSO)

SPF’s Responsible Person guide also says that after specified works are completed, the RP submits the CWC to the Commissioner for approval. (Singapore Police Force)

Does approval of the CWC mean all security obligations end?

No.

This is particularly important.

SPF’s guidance states that after a Special Development’s CWC is approved, it becomes a Special Infrastructure, and its approved Security Plan becomes the approved Security Plan for that Special Infrastructure. The RP must then maintain the security measures so they remain operationally effective. (Singapore Police Force)

Section 47 of the Act likewise requires the RP of a Special Infrastructure to implement the remaining measures required after CWC approval and maintain every security measure implemented under the approved Security Plan until the premises cease to be a Special Infrastructure. (AGC SSO)

So IPA compliance is not:

design → build → certify → forget.

It continues into operations.

Can CPS audit the completed security measures?

SPF’s Responsible Person guide says Special Developments and Special Infrastructures may be selected for audits to verify that security measures in the approved Security Plan and approved CWC are implemented and maintained in good working condition.

Where deviations are found, the Commissioner may direct the RP to rectify them. (Singapore Police Force)

This reinforces the importance of maintaining the approved security outcome, not merely keeping equipment physically present.

What if ownership or occupation changes?

SPF provides a specific application process for changes in the Responsible Person or ownership of a Special Development/Special Infrastructure on its current IPA resources page. (Singapore Police Force)

Its Responsible Person guidance also addresses notifying CPS when legal ownership or occupation changes. (Singapore Police Force)

A sale, lease change or corporate restructuring therefore should not be treated as purely a commercial property matter where IPA responsibilities are involved.

Does a Special Development remain a Special Development forever?

No.

After the relevant completion process, a Special Development can transition into a Special Infrastructure.

SPF’s guide specifically says that after approval of the CWC, the Special Development becomes a Special Infrastructure and the approved Security Plan continues with it. (Singapore Police Force)

The Act also provides a mechanism for the Minister to cancel a Special Infrastructure designation. (AGC SSO)

What is a Security Directive?

Part 5 of the IPA provides powers for Security Directives.

The Act contains provisions for directives relating to Protected Areas, Protected Places, Security Plans, implementation and maintenance of measures for Special Developments/Special Infrastructures, and security risks affecting other premises. (AGC SSO)

For a practical building-owner article, the important point is simply:

The approved Security Plan is not necessarily the end of the Commissioner’s statutory powers.

Where the legal conditions are met, further security directions can be issued.

We do not need to turn this article into a detailed enforcement-law commentary.

Is the IPA the same thing as GEBSS?

No.

They are related to protective security but serve different purposes.

SPF describes GEBSS as a comprehensive reference guide providing a menu of good security practices and considerations for building owners.

By contrast, the IPA is legislation creating statutory designation, SBD, Security Plan and other regulatory mechanisms. (Singapore Police Force)

A useful distinction is:

IPA = legal and regulatory framework

GEBSS = physical-security design guidance

A project may draw technical design thinking from GEBSS while separately satisfying its IPA obligations.

Is the IPA the same as the SPF VSS Standard?

No.

The VSS Standard for Buildings provides recommendations for the specification, installation and operation of video surveillance systems in Singapore. (Singapore Police Force)

The IPA does not itself become a substitute CCTV design manual.

Therefore, statements such as:

“The IPA requires 31 days CCTV storage.”

would be misleading.

The 31-day recommendation comes from the SPF VSS Standard, not simply from the IPA.

An individual approved Security Plan may of course contain project-specific CCTV measures.

Is the IPA the same as the Guidelines on Forced Entry Protection?

Again, no.

SPF describes the Forced Entry guide as technical guidance for building owners and practitioners dealing with physical attack using manual or powered tools, recognised FE standards and practical applications. (Singapore Police Force)

The IPA establishes the statutory framework.

The FE guide provides technical information on one particular area of physical protection.

We should therefore not write:

“IPA requires LPS 1175 rating X.”

unless that requirement actually arises through the relevant approved plan or other applicable legal/technical requirement.

Does the IPA specify CCTV resolution, FPS or retention?

Not as a general CCTV technical standard.

Those technical recommendations sit in documents such as the SPF VSS Standard.

Similarly, GEBSS contains separate building-security guidance and the Forced Entry guide contains separate FE-resistance guidance. (Singapore Police Force)

This distinction is critical because otherwise very different sources get incorrectly merged into one supposed “IPA requirement”.

Does the IPA specify one bollard rating for all Special Developments?

No universal rule of that kind should be inferred from the Act.

The Security-by-Design process is risk-based and project-specific.

The eventual approved Security Plan determines the security measures required for that particular Special Development or Special Infrastructure. Section 33 requires the plan to contain the CP’s security risk assessment and the required security measures. (AGC SSO)

So the better question is:

What protection is required by the approved Security Plan for this project?

Does being an IPA project mean every security measure must be maximum-security grade?

No.

The SBD process is based on assessing the security risks of the building and developing the appropriate security measures.

SPF’s guidance describes the security solution as being calibrated to the risks and criticality involved rather than simply specifying maximum protection everywhere. (Singapore Police Force)

This is consistent with sensible risk-based protective-security design.

What is the role of a general security consultant if the project also needs an IPA Competent Person?

The roles should not be confused.

Where IPA CP work is required, the CP must perform the responsibilities for which the Commissioner has approved that person.

A separate physical-security consultant may still support the broader project in areas such as:

operational requirements, security-system design, coordination with architects and M&E consultants, implementation review and integration of security technologies.

But that consultant should not represent ordinary consultancy work as statutory CP work unless separately approved to act as CP for the project.

Consultant’s perspective

Clear scope boundaries are important.

The project team should know:

Who advises on general physical security?

Who is the approved CP responsible for the IPA Security Plan?

Who designs the individual systems?

Who installs them?

Who verifies that the completed works correspond to the approved security requirements?

That separation avoids both gaps and duplicated responsibility.

What should a building owner do after being told a project is designated?

A useful high-level sequence is:

Designation → identify the Responsible Person → establish the required CP arrangements → begin Security-by-Design early → develop and obtain approval for the Security Plan → implement the approved measures → manage approved changes properly → complete the CWC process → maintain the approved security measures during operation.

That sequence summarises the framework described by SPF and Part 4 of the IPA. (Singapore Police Force)

The detailed steps should be confirmed with CPS and the appointed approved CP for the actual project.

Common misunderstandings about the Infrastructure Protection Act

“IPA applies to every commercial building.”
No. Specific statutory declaration or designation mechanisms apply.

“Protected Area and Protected Place mean the same thing.”
No. A Protected Area may remain publicly accessible, while a Protected Place restricts public entry. (Singapore Police Force)

“A Special Development is just another term for a high-security building.”
No. It is a statutory designation under the IPA.

“Any security consultant can prepare the IPA Security Plan.”
No. Section 33 requires the Security Plan to be prepared by a Competent Person approved by the Commissioner in connection with the specified works. (AGC SSO)

“If a consultant’s name appears on the SPF competency list, that person is automatically the CP.”
No. Appointment remains case-by-case and project-specific. (Singapore Police Force)

“A CP (Security) and CP (Blast) are always the same role.”
No. SPF distinguishes the two. Blast-related assessment may require a CP (Blast), who may or may not be the same approved person as the CP (Security). (Singapore Police Force)

“Every IPA project automatically requires structural blast hardening.”
The official guidance expressly recognises projects for which blast-related structural reports are not required. (Singapore Police Force)

“Once the Security Plan is approved, the design can be changed through the normal contractor variation process.”
Not necessarily. Changes affecting the approved plan may need review and further approval. (Singapore Police Force)

“The CWC ends the owner’s security obligations.”
No. Special Infrastructure security measures must continue to be maintained under the approved Security Plan. (AGC SSO)

“IPA tells me what CCTV frame rate or storage I need.”
Those detailed technical recommendations come from other sources such as the SPF VSS Standard, unless project-specific IPA requirements separately establish them.

Practical IPA Review for Building Owners and Developers

Before proceeding with a potentially affected project, the most useful questions are:

This is a project-management review framework, not a substitute for advice from CPS or the project’s approved Competent Person.

Conclusion

The Infrastructure Protection Act should not be thought of as another CCTV, access-control or physical-security specification.

It sits above those technical decisions.

The IPA creates the statutory framework through which certain premises can be protected as:

Protected Areas, Protected Places, Special Developments and Special Infrastructures. (Singapore Police Force)

For designated Special Developments and Special Infrastructures, the core process is Security-by-Design.

Security risks are considered alongside the building design, an approved Competent Person prepares the required Security Plan, the Commissioner approves the plan, the security measures are implemented, completion is certified through the CWC process and the measures continue to be maintained during operation. (Singapore Police Force)

For building owners and developers, the practical lesson is:

Do not treat IPA security as a package of equipment to be added at the end of construction. Where the Act applies, security becomes part of the building-development, approval, implementation and ongoing management process.

And just as importantly:

Know where specialist responsibility begins. If the project requires a Competent Person under the IPA, engage the appropriately approved CP. General physical-security consultancy, system design and technical implementation should support that statutory process rather than pretend to replace it.