Privileged Remote Access in ASEAN: Requirements by Country

Privileged remote access in ASEAN is regulated country by country: Singapore, Malaysia, Thailand, the Philippines and Vietnam each set their own rules for who may connect to critical systems, how they authenticate and what must be logged. For a manufacturer, utility or bank that runs plants and data centres across the region, and relies on local maintenance vendors, the practical question is which of these rules apply and how one set of access controls can satisfy all of them.

What is privileged remote access in a compliance context?

Privileged remote access is any connection from outside a protected network that uses administrative, maintenance or engineering rights on a system. In ASEAN regulations it is rarely defined as a product category; instead, the rules address its parts separately: remote connections, privileged accounts, authentication, logging and third-party access.

This matters because a single session, such as a vendor engineer logging in to a SCADA server over the internet, can fall under several clauses at once. A compliant design treats the session as one controlled object: who approved it, how the user was verified, what they could reach, and what was recorded. For background on the access model itself, see the privileged remote access guide.

Privileged remote access requirements by country

The table summarises the main instrument in each country that affects privileged remote access, who it applies to and what it requires. Scope differs: most of these rules apply only to designated critical infrastructure or regulated financial institutions, so confirm whether your organisation is in scope before mapping controls.

Sources: CSA, CCoP for CII Second Edition Revision One; NACSA, Cyber Security Act 2024 (Act 854); ThaiCERT, Critical Information Infrastructure under the Cybersecurity Act; BSP MORB Appendix 75 and Section 148; Government of Vietnam, Law No. 116/2025/QH15 and Ministry of Public Security. Indonesia is not covered in this edition. Regulations change; the Cyber Security Agency of Singapore has announced an updated CCoP for CII, so check the current edition before an audit.

Singapore: the most prescriptive rules for remote connections

Singapore's CCoP is the most detailed instrument in the region for remote access. Clause 5.7.2 requires that remote connections to a CII are disabled except where necessary, that multi-factor authentication is used to establish them, and that they use strong encryption and run "only through secured intermediary mechanisms". Clause 5.3.1 adds an inventory of privileged accounts, MFA for privileged use and privilege escalation, and privileged access initiated from a hardened environment. Clause 6.1 requires logs of all access and activities, kept for at least 12 months. The Singapore compliance checklist maps these clauses in more detail.

Malaysia and Thailand: duties set by sector

Malaysia and Thailand set the obligation at the level of the law and leave technical detail to sector codes. In Malaysia, Act 854 defines the duties of NCII entities and NCII sector leads; in Thailand, each CII organisation must prepare a code of practice aligned with national policy and undergo an annual risk assessment. In both cases, privileged and remote access controls are what auditors test in practice. See the Malaysia NCSB checklist and the Thailand NCSC checklist.

Philippines and Vietnam: sector and framework changes

In the Philippines, the clearest privileged access rules apply to BSP-supervised financial institutions through Appendix 75 of the Manual of Regulations for Banks. Vietnam's new Law on Cybersecurity took effect on 1 July 2026 and consolidates two earlier laws; organisations should follow the implementing decrees as they are issued. The Philippines compliance checklist covers the BSP requirements.

Which controls are common across ASEAN?

Five controls recur across the instruments above: restrict remote access to what is necessary, verify users with MFA, apply least privilege to named accounts, log and monitor privileged activity, and govern third-party access through approval and contracts. Building on these five gives one baseline that can be extended per country.

1. Minimise exposure. Remote access is off by default and opened per system, per user and per task.
2. Strong authentication. MFA at connection time and again on privilege escalation.
3. Least privilege and inventory. Named privileged accounts, an up-to-date inventory and approval before use; no shared accounts.
4. Logging and recording. Access attempts and session activity captured centrally, with retention set to the strictest applicable rule (12 months in the Singapore CCoP).
5. Third-party governance. Vendor access documented, approved and supervised, with contract terms that define access rights and incident reporting.

How to build one access control set for multi-country operations

Organisations with sites in several ASEAN countries should design one access architecture and adjust policy per site, rather than run a different remote access tool in each country. The steps below keep the evidence consistent for auditors in every jurisdiction.

1. List systems in scope per country (CII, NCII, BSP-regulated systems) and the rule that applies to each.
2. Route all remote and privileged sessions through one secured intermediary instead of direct VPN access to the network.
3. Connect the access layer to your identity provider and enforce MFA and approval workflows per system.
4. Store credentials in a vault and inject them, so vendors never hold passwords for plant or production systems.
5. Record sessions and export logs to your SIEM with the longest required retention.
6. Review the remote access compliance mapping each year against updated codes.

How Safous supports privileged remote access requirements in ASEAN

Safous Privileged Remote Access brokers every session through Safous Global Access Points and Safous AppGateway, which connects outbound over TLS so no inbound ports are opened, and keeps credentials, logs and recordings in the customer environment. The table maps common requirement themes to Safous capabilities listed in the Safous fact sheet.

For vendor-heavy environments, see third-party access and regulatory compliance. Data protection obligations are covered separately in the ASEAN PDPA guide.

Frequently asked questions

Is privileged remote access regulated in ASEAN?

There is no single ASEAN-wide rule for privileged remote access. Requirements come from national laws and regulators, such as Singapore's Cybersecurity Code of Practice for Critical Information Infrastructure, Malaysia's Cyber Security Act 2024, Thailand's Cybersecurity Act B.E. 2562 and the Bangko Sentral ng Pilipinas IT risk management standards for Philippine financial institutions. Each applies to a defined group of organisations, so scope must be checked country by country.

Does Singapore's CCoP require multi-factor authentication for remote access?

Yes. Clause 5.7.2(b) of the CCoP for Critical Information Infrastructure (Second Edition, Revision One) requires multi-factor authentication to establish a remote connection to a CII, and clause 5.3.1(c) requires it where privileged accounts are used to access the CII or when privileges are escalated.

Can vendors access Singapore CII remotely?

The CCoP (Second Edition, Revision One) clause 5.1.3 states that vendor access to a CII must be documented, pre-approved, supervised by the CII owner and performed on-site. Any remote vendor connection therefore needs to be reviewed with the regulator and the CII owner's compliance team, and still has to meet the remote connection controls in clause 5.7.

What privileged access controls do Philippine banks need?

Appendix 75 of the BSP Manual of Regulations for Banks requires privileged and emergency IDs to be formally approved on a need-to-use or event-by-event basis, prohibits shared use of privileged accounts, and requires logging and monitoring of privileged activities. Remote access must be formally authorised, secured with encryption and strong authentication, and logged and monitored.

Map your remote access controls to ASEAN requirements

Safous is provided by IIJ (Internet Initiative Japan) and deploys in under 10 minutes for IT and OT environments across Asia. Talk to Safous to review how your privileged remote access controls align with the regulations in each country you operate in.