digital-service-standards

Plugin digital-service-standards from marketplace sg-gov-skills in kyleoliveiro/sg-gov-skills. Commands read from the repo's manifest — 11 days ago.

Skills (18)

• sg-gov-access-control

  Set up or audit identity and access management against the Singapore Government's ICT&SS Policy Reform (IM8 successor) Access Control controls (AC-1..AC-16): account inventory and deny-by-default least privilege, MFA for privileged accounts, Singpass/Corppass for public users vs government SSO (WOG

• sg-gov-container-security

  Build, scan, distribute, and run containers that satisfy the Singapore Government's ICT&SS Policy Reform (IM8 successor) Container Security (CS-1..CS-11) controls. Use whenever writing or reviewing a Dockerfile, a Kubernetes manifest or Helm chart, a container build pipeline, or registry/runtime con

• sg-gov-corppass-legacy

  Maintain, debug, or migrate a LEGACY Corppass integration — the pre-FAPI 2.0 Corppass Authorization API (entityInfo/userInfo ID-token claims, the comma-separated sub format, /authorization-info, Bearer access tokens, esrvcID) or Myinfo Business v1/v2 (/entity-person, PKI_SIGN, client_secret). Use th

• sg-gov-corppass

  Integrate Corppass (business-user login and Myinfo Business corporate data) into a Singapore government digital service using the Corppass Authorization API (FAPI 2.0). Use this whenever a service lets companies or other entities transact with an agency: "log in with Corppass", business user login,

• sg-gov-data-protection

  Build or audit a system's data handling against the Singapore Government's ICT&SS Policy Reform (IM8 successor) Data Protection controls (DP-1..DP-8): Singapore data residency, encryption at rest and in transit, central cloud tenant management, storage sanitisation and witnessed destruction, data lo

• sg-gov-dss-accessibility

  Build and review frontend code that satisfies the 53 accessibility controls of the Singapore Digital Service Standards (WCAG 2.2 A/AA recast as DSS WP/WO/WU/WR controls, with SG-specific levels). Use whenever writing or reviewing UI for a Singapore government digital service — components, pages, for

• sg-gov-gen-ai-security

  Build or audit a Generative AI feature so it satisfies the Singapore Government's ICT&SS Policy Reform (IM8 successor) Gen-AI SSP overlay: the 8 GA controls (GA-1..GA-8) plus DP-8. Use whenever writing, reviewing, or hardening code that calls a GenAI/LLM API, builds a RAG or agent or chatbot feature

• sg-gov-logging-monitoring

  Set up or audit logging and monitoring against the Singapore Government's ICT&SS Policy Reform (IM8 successor) Logging and Monitoring controls (LM-1..LM-21): capturing the five security log sources, off-box tamper-resistant storage, retention, structured formats and log sanitisation, central securit

• sg-gov-network-security

  Design or audit a system's network boundaries against the Singapore Government's ICT&SS Policy Reform (IM8 successor) Network Security controls (NS-1..NS-11): VPC/VNet segmentation and tiered subnets, access restrictions on CSP resources outside the virtual network, deny-by-default security groups a

• sg-gov-resiliency-recovery

  Build or audit availability and recoverability for a Singapore government system against the ICT&SS Policy Reform (IM8 successor) Resiliency (RS-1..RS-3) and Backup & Recovery (BR-1..BR-6) controls: multi-AZ deployment with health checks and failover, load balancing and auto-scaling, periodic load t

• sg-gov-secure-coding-as

  Write and review application code that satisfies the Singapore Government ICT&SS Policy Reform Application Security (AS) controls and allied Cryptography/Key Management (CK) controls. Use whenever writing new code, reviewing a diff, or auditing an existing codebase for a Singapore government agency

• sg-gov-secure-pipeline

  Set up or audit a repository and CI/CD pipeline that satisfies the Singapore Government's ICT&SS Policy Reform (IM8 successor) Secure Development (SD-1..SD-10) and Software Supply Chain (SC-1..SC-9) controls. Use whenever creating a repo, configuring CI/CD, reviewing pipeline or infra config, or pre

• sg-gov-security-testing

  Set up or audit a security testing and vulnerability management programme against the Singapore Government's ICT&SS Policy Reform (IM8 successor) Security Testing controls (ST-1..ST-5): vulnerability assessment scans, cloud security posture management, a public vulnerability disclosure channel (secu

• sg-gov-service-shell

  Build the mandatory "shell" every Singapore government public-facing digital service needs before feature work: the Official Government Banner (masthead), WOGAA registration and tracking, the official footer, .gov.sg domain, SGDS setup, and the rest of the DSS Trust & Legitimacy, Baseline Design, an

• sg-gov-singpass-legacy

  Maintain, debug, or migrate a LEGACY Singpass integration — Myinfo v3 (client_secret + PKI_SIGN X.509 signing, /com/v3/authorise), Myinfo v4 (OAuth 2.1 client assertions + DPoP, /com/v4), or the pre-FAPI 2.0 Singpass authentication API (direct /auth redirect, comma-separated sub like "s=S1234567A,u=

• sg-gov-singpass

  Integrate Singpass (citizen/resident login and Myinfo (v5) government-verified person data) into a Singapore government digital service using the current FAPI 2.0 Singpass authentication API. Use this whenever a service authenticates individual members of the public or pre-fills their personal data:

• sg-gov-ssp-navigator

  Determine which Singapore Government System Security Plan(s) apply to a system under the ICT&SS Policy Reform (IM8's successor) and emit the resulting control baseline — including stacking the Generative AI overlay and Digital Service Standards profiles on top of a cybersecurity SSP. Use whenever a

• sg-gov-transactions-payments

  Build or audit the transaction and payment flows of a Singapore government digital service against the DSS Transactions & Payments controls (TX-1..TX-15): fully digital end-to-end transactions, upfront prerequisites and fees, multi-step forms with progress indicators, save-draft and resume, pre-fill