FAQ
Frequent asked questions.
Can’t find your answer? Message us on WhatsApp and we’ll reply quickly.
Everything you need to know
Q. Why does cybersecurity matter for construction companies in Singapore?
A. Contractors hold valuable data (tender documents, financial records, staff and subcontractor information) and connect to client systems. The incident above shows that clients can act quickly, including suspending access, when a contractor is affected.
Q. Do construction companies need ISO 27001?
A. Not every company needs certification on day one. A risk and gap assessment can help determine the controls your business needs. ISO 27001 for Infrastructure Companies provides a structured framework for managing information security and can help demonstrate a systematic approach to clients and stakeholders.
Q. Why does cybersecurity matter for construction companies in Singapore?
A. Contractors hold valuable data (tender documents, financial records, staff and subcontractor information) and connect to client systems. The incident above shows that clients can act quickly, including suspending access, when a contractor is affected.
Q. How can a construction company protect employee NRIC data from ransomware?
A. Combine controls: know where the data is held, restrict who can access it, patch systems promptly, back up and test recovery, and train staff. ISO 27001 helps you organise these into one system.
Q. Why are end-of-life servers a security risk?
A. Once a system reaches end of life it stops receiving security fixes, so known weaknesses stay open. Attackers actively look for these.
Q. Does ISO 27001 help F&B companies with PDPA?
A. It gives you structured security controls that support the PDPA’s Protection Obligation. It isn’t a substitute for wider PDPA compliance work, and TreeLabs can show where the two connect.
Q. How do you secure guest data during a software migration?anies need ISO 27001?
A. Treat security as part of the project: assess risks up front, document every configuration, have a second person verify critical settings, apply access controls before go-live, and test afterwards.
Q. Does ISO 27001 cover change management?
A. Yes. ISO 27001 requires risk assessment, change management, access control and security testing, which are the controls that address this kind of failure.
Q. We’re much smaller than a major resort. Are we still at risk?
A. Yes. The gap here was a process failure (no second-level check during a migration), and any business that changes systems can make the same mistake.
Q. Do we need penetration testing for a member portal?
A. Yes. The gap here was a process failure (no second-level check during a migration), and any business that changes systems can make the same mistake.
Q. We’re much smaller than a major resort. Are we still at risk?
A. In plain English, SQL injection is when an attacker types malicious commands into a form or web address to trick your database. Validating all input and using parameterised queries stops it, and regular vulnerability testing catches what slips through.
Q. Our portal was built by an outside developer. Are we still responsible?
A. Generally, yes. Under the PDPA, your organisation stays accountable for personal data in its possession or control, including data handled through vendors.