The Authority directs institutions, and in particular designated critical information infrastructure owners, to engage only cybersecurity service providers it has licensed, in the tier it specifies, and accredited professionals and establishments; public procurement entities follow the Guidelines developed with the Public Procurement Authority. In August 2026 the Office of the Registrar of Companies was fined 10,000 penalty units for each of two directives it breached by engaging an unlicensed provider after being told to engage a Tier 1 licensee. Verify the licence status and tier before award, not after.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.