Privileged remote access in ASEAN is regulated country by country: Singapore, Malaysia, Thailand, the Philippines and Vietnam each set their own rules for who may connect to critical systems, how they authenticate and what must be logged. For a manufacturer, utility or bank that runs plants and data centres across the region, and relies on local maintenance vendors, the practical question is which of these rules apply and how one set of access controls can satisfy all of them.
Privileged remote access is any connection from outside a protected network that uses administrative, maintenance or engineering rights on a system. In ASEAN regulations it is rarely defined as a product category; instead, the rules address its parts separately: remote connections, privileged accounts, authentication, logging and third-party access.
This matters because a single session, such as a vendor engineer logging in to a SCADA server over the internet, can fall under several clauses at once. A compliant design treats the session as one controlled object: who approved it, how the user was verified, what they could reach, and what was recorded. For background on the access model itself, see the privileged remote access guide.
The table summarises the main instrument in each country that affects privileged remote access, who it applies to and what it requires. Scope differs: most of these rules apply only to designated critical infrastructure or regulated financial institutions, so confirm whether your organisation is in scope before mapping controls.
| Country | Instrument | Applies to | What it means for privileged remote access |
|---|---|---|---|
| Singapore | Cybersecurity Act 2018; CCoP for Critical Information Infrastructure, Second Edition, Revision One (effective 12 December 2022) | Owners of designated critical information infrastructure (CII) | Remote connections disabled unless necessary; MFA for remote and privileged access; strong encryption through secured intermediary mechanisms; malware scanning of uploaded files; inventory of privileged accounts; logs of access and activities kept at least 12 months; vendor access documented, pre-approved, supervised and on-site |
| Malaysia | Cyber Security Act 2024 (Act 854), in operation since 26 August 2024 | National critical information infrastructure (NCII) entities and NCII sector leads | Sets the duties of NCII entities and how cyber security threats and incidents affecting NCII are managed; access controls are assessed against the codes of practice for each NCII sector |
| Thailand | Cybersecurity Act B.E. 2562 (2019) | Critical information infrastructure organisations in designated service areas, such as banking, energy, telecom and public health | Each CII organisation prepares a code of practice and standard framework aligned to national policy; cybersecurity risk is assessed at least once a year by an auditor; significant threats are reported to the Office and the regulator |
| Philippines | BSP Manual of Regulations for Banks, Section 148 and Appendix 75 (IT risk management, incorporating Circular 982 of 2017) | BSP-supervised financial institutions (BSFIs) | Privileged IDs approved on a need-to-use basis; no shared privileged accounts; logging and monitoring of privileged activity; remote access formally authorised, encrypted, strongly authenticated, logged and monitored; MFA for high-risk activity including systems administration |
| Vietnam | Law on Cybersecurity No. 116/2025/QH15, effective 1 July 2026 | Organisations operating information systems in Vietnam | Merges the 2018 Law on Cybersecurity and the 2015 Law on Network Information Security into one framework; detailed protection measures are set by implementing decrees |
Sources: CSA, CCoP for CII Second Edition Revision One; NACSA, Cyber Security Act 2024 (Act 854); ThaiCERT, Critical Information Infrastructure under the Cybersecurity Act; BSP MORB Appendix 75 and Section 148; Government of Vietnam, Law No. 116/2025/QH15 and Ministry of Public Security. Indonesia is not covered in this edition. Regulations change; the Cyber Security Agency of Singapore has announced an updated CCoP for CII, so check the current edition before an audit.
Singapore's CCoP is the most detailed instrument in the region for remote access. Clause 5.7.2 requires that remote connections to a CII are disabled except where necessary, that multi-factor authentication is used to establish them, and that they use strong encryption and run "only through secured intermediary mechanisms". Clause 5.3.1 adds an inventory of privileged accounts, MFA for privileged use and privilege escalation, and privileged access initiated from a hardened environment. Clause 6.1 requires logs of all access and activities, kept for at least 12 months. The Singapore compliance checklist maps these clauses in more detail.
Malaysia and Thailand set the obligation at the level of the law and leave technical detail to sector codes. In Malaysia, Act 854 defines the duties of NCII entities and NCII sector leads; in Thailand, each CII organisation must prepare a code of practice aligned with national policy and undergo an annual risk assessment. In both cases, privileged and remote access controls are what auditors test in practice. See the Malaysia NCSB checklist and the Thailand NCSC checklist.
In the Philippines, the clearest privileged access rules apply to BSP-supervised financial institutions through Appendix 75 of the Manual of Regulations for Banks. Vietnam's new Law on Cybersecurity took effect on 1 July 2026 and consolidates two earlier laws; organisations should follow the implementing decrees as they are issued. The Philippines compliance checklist covers the BSP requirements.
Five controls recur across the instruments above: restrict remote access to what is necessary, verify users with MFA, apply least privilege to named accounts, log and monitor privileged activity, and govern third-party access through approval and contracts. Building on these five gives one baseline that can be extended per country.
Organisations with sites in several ASEAN countries should design one access architecture and adjust policy per site, rather than run a different remote access tool in each country. The steps below keep the evidence consistent for auditors in every jurisdiction.
Safous Privileged Remote Access brokers every session through Safous Global Access Points and Safous AppGateway, which connects outbound over TLS so no inbound ports are opened, and keeps credentials, logs and recordings in the customer environment. The table maps common requirement themes to Safous capabilities listed in the Safous fact sheet.
| Requirement theme | Example clause | Safous capability |
|---|---|---|
| Secured intermediary for remote connections | Singapore CCoP 5.7.2(c) | Sessions brokered through Global Access Points and AppGateway; agentless browser access to RDP, SSH, VNC, Telnet, SMB and web apps |
| MFA for remote and privileged access | Singapore CCoP 5.3.1(c), 5.7.2(b); BSP Appendix 75 | Built-in IdP or IdP proxy with MFA (TOTP, email, SMS, WhatsApp); SAML, OIDC, LDAP/AD and RADIUS integration |
| Least privilege and approval | BSP Appendix 75 privileged IDs | RBAC/ABAC, just-in-time access, zero standing privileges and up to 5-level access approvals |
| No shared or exposed credentials | BSP Appendix 75 (no shared privileged accounts) | Personal and shared vaults, credential injection and password rotation |
| Logging and monitoring | Singapore CCoP 6.1; BSP Appendix 75 | Session recording, command-level logging with search, live monitoring and termination, SIEM integration |
| File transfer controls | Singapore CCoP 5.7.2(e) | ICAP file scanning, clipboard and file transfer controls |
For vendor-heavy environments, see third-party access and regulatory compliance. Data protection obligations are covered separately in the ASEAN PDPA guide.
There is no single ASEAN-wide rule for privileged remote access. Requirements come from national laws and regulators, such as Singapore's Cybersecurity Code of Practice for Critical Information Infrastructure, Malaysia's Cyber Security Act 2024, Thailand's Cybersecurity Act B.E. 2562 and the Bangko Sentral ng Pilipinas IT risk management standards for Philippine financial institutions. Each applies to a defined group of organisations, so scope must be checked country by country.
Yes. Clause 5.7.2(b) of the CCoP for Critical Information Infrastructure (Second Edition, Revision One) requires multi-factor authentication to establish a remote connection to a CII, and clause 5.3.1(c) requires it where privileged accounts are used to access the CII or when privileges are escalated.
The CCoP (Second Edition, Revision One) clause 5.1.3 states that vendor access to a CII must be documented, pre-approved, supervised by the CII owner and performed on-site. Any remote vendor connection therefore needs to be reviewed with the regulator and the CII owner's compliance team, and still has to meet the remote connection controls in clause 5.7.
Appendix 75 of the BSP Manual of Regulations for Banks requires privileged and emergency IDs to be formally approved on a need-to-use or event-by-event basis, prohibits shared use of privileged accounts, and requires logging and monitoring of privileged activities. Remote access must be formally authorised, secured with encryption and strong authentication, and logged and monitored.
Safous is provided by IIJ (Internet Initiative Japan) and deploys in under 10 minutes for IT and OT environments across Asia. Talk to Safous to review how your privileged remote access controls align with the regulations in each country you operate in.