Frequently Asked Questions

To access Console, you will need:

• A valid TechPass account
• Appropriate permissions assigned to your account

For detailed onboarding instructions, refer to the Access Console guide.

If you encounter access issues, please raise a support ticket here.

A System Security Plan (SSP) is a formal document that describes the security controls implemented or planned for your system to meet IM8 Reform requirements.

SSPs are created and managed through the WOG IM8 Portal.

Note that a TechPass account is required to access the WOG IM8 Portal. If you don’t have TechPass, visit the TechPass Portal for more information

Your System Security Plan (SSP) can be accessed through the WOG IM8 Portal.

To tag your SSP to a system in the Developer Portal (DGP), please refer to our Guide to System Tagging in DGP.

If you cannot see your IM8 Reform Assessment Results, this could be due to one of the following reasons:

1. You do not have access to the SSP

Access to the SSP must be granted through the WOG IM8 Portal. Please request access from your SSP administrator or through the portal directly.

2. Your SSP has not been tagged to a system in DGP

If you have access to the SSP but still cannot see your IM8 Reform Assessment Results, this is likely because your SSP has not been tagged to a system in DGP.

Follow the steps in our Guide to System Tagging in DGP to complete the tagging process.

3. The SSP has not been endorsed by your CISO and CIO in the IM8 reform portal.

Your SSP must receive endorsement from your CIO or delegate before assessment results can be viewed.

To resolve this:

• Verify the approval status in the WOG IM8 Portal.
• Follow up with your CIO or delegate if endorsement is pending
• Ensure you have updated the Approval Status after receiving IDSC approval

Access to CloudSCAPE and CodeSCAPE is controlled differently for each platform.

Access Requirements

Troubleshooting Steps

For CloudSCAPE:

1. Verify you have a TechPass account
2. Check that appropriate roles have been assigned to your account in CMP
3. Contact your agency’s CMP administrator to request role assignment

For CodeSCAPE:

1. Verify you are a member of the relevant project in SHIP-HATS GitLab
2. If you need access to projects you are not a member of, request explicit access grants from your project administrator
3. If you don’t have a SHIP-HATS GitLab account, contact your agency to set one up

If you do not have an SSP tied to your system, a default SSP will be applied. The default SSP includes all controls within IM8 Reform, which may result in a higher number of findings than necessary for your system’s actual requirements.

To ensure accurate assessment results that reflect your system’s specific control requirements,please create and tag a proper SSP to your system.

For technical support or questions not covered in this FAQ:

• TechPass issues: Visit the TechPass Portal
• SSP and IM8 Portal issues: Submit a ticket via Ask IM8 @ ITSM. For user who do not have access to ITSM, please reach out to GovTech IM8 Secretariat
• CloudSCAPE: Refer to the CloudSCAPE User Guide. Alternatively, submit a ticket via Service Desk
• CodeSCAPE: Refer to the CodeSCAPE User Guide. Alternatively, submit a ticket via Service Desk

For all other matters, please create a ticket via Service Desk.

IM8 Reform is Singapore Government’s updated Information Management (IM) and Information Communication Technology (ICT) security framework. It replaces the previous IM8 policy with a more streamlined, risk-based approach to cybersecurity.

Refer to IM8 Reform’s documentation for more information.

The IM8 Reform Controls that apply to your system depend on:

1. System Risk Classification: Low, medium, or high risk
2. Deployment Environment: On-premises, cloud, or hybrid
3. Data Sensitivity: The classification of data your system handles

Finding Your Applicable Controls

1. Determine your system’s risk classification through the risk assessment process
2. Access the WOG IM8 Portal to view controls specific to your system
3. Review your System Security Plan (SSP) which lists all applicable controls

IM8 Reform controls cannot be suppressed in Console because security controls are managed upfront in your System Security Plan (SSP). Console assesses your system based on the controls defined in your SSP.

If certain IM8 Reform controls are not applicable to your system, you will need to remove them from your SSP with proper justification and approval:

1. Log in to the WOG IM8 Portal and select your SSP to edit
2. Scroll down and navigate to the control that is not applicable
3. Update the Course of Action and provide clear reasoning for why the control is being updated. If applicable, suggest compensating controls.
4. Save and Send Email Verification to submit your SSP changes for review and approval by your Agency CIO or delegate
5. Once approved in the WOG IM8 Portal, the changes will automatically be reflected in Console

Non-compliance with IM8 Reform Controls requires immediate attention and remediation. Refer to the non-compliant controls for detailed remediation guides.

CloudSCAPE and CodeSCAPE perform evaluations once daily. Results are refreshed daily, not in real time.

Updates to your SSP (for example, modifying linked resources or configurations) are reflected in the next day’s evaluation.

Only controls that can be automated and are within the scope of CloudSCAPE or CodeSCAPE appear.
Excluded controls may be:

• Manual in nature
• Process-oriented
• Not currently covered by available checks