Overview
The Monetary Authority of Singapore (MAS) Technology Risk Management (TRM) Guidelines provide a comprehensive framework for technology and cybersecurity risk management at financial institutions operating in Singapore. Last significantly updated in January 2021, the guidelines cover governance, software development, IT service management, cybersecurity operations, and emerging technology risks. While technically non-binding, MAS treats them as supervisory expectations, and non-compliance can result in regulatory action during inspections.
Key Domains
| Domain | Focus Areas |
|---|---|
| Technology Risk Governance | Board oversight, CTO/CISO roles, risk appetite, and IT strategy alignment |
| Technology Project Management | Secure SDLC, project risk assessment, and change management |
| Software Application Development | Source code review, secure coding, testing, and deployment controls |
| IT Service Management | Incident management, problem management, capacity planning, and IT asset management |
| Cybersecurity Management | Threat monitoring, vulnerability management, penetration testing, and cyber exercises |
| IT Resilience | Business continuity, disaster recovery, system availability, and recovery testing |
| Access Control | Identity management, privileged access, multi-factor authentication, and access reviews |
| Data & Infrastructure Security | Encryption, network security, endpoint protection, and cloud security |
| Online Financial Services | Internet banking security, mobile app security, and customer authentication |
| IT Audit | Independent audit coverage, risk-based approach, and remediation tracking |
Governance Expectations
The Board must approve the technology risk management framework and ensure adequate resources are allocated. A senior management committee must oversee technology risk and cybersecurity. The CISO role must be independent of IT operations with direct reporting to senior management. Financial institutions must maintain a technology risk register that is reviewed quarterly. Risk appetite for technology and cyber risk must be explicitly defined and monitored with measurable thresholds.
Implementation Checklist
- Establish Board-level technology risk governance with documented risk appetite
- Appoint a CISO independent of IT operations with direct senior management reporting
- Implement a comprehensive vulnerability management program with defined patching SLAs
- Conduct penetration testing at least annually by independent qualified assessors
- Deploy real-time security monitoring through a SOC capability
- Implement multi-factor authentication for all critical and internet-facing systems
- Establish a secure software development lifecycle with mandatory code reviews
- Conduct cyber attack simulation exercises at least annually
- Implement robust access control with privileged access management and quarterly access reviews
- Maintain a tested business continuity and disaster recovery plan with RPO and RTO targets
- Report material cyber incidents to MAS as soon as possible but within one hour of initial assessment
- Conduct annual cyber awareness training for all employees and Board members
Cloud and Third-Party Requirements
Financial institutions using cloud services must conduct thorough risk assessments before adoption. MAS expects due diligence on the cloud provider's security controls, data residency, incident response capabilities, and exit planning. All outsourcing arrangements must comply with MAS Outsourcing Guidelines, which require Board approval for material outsourcing, documented SLAs, and the right for MAS to inspect the service provider. Third-party risk assessments must be ongoing rather than just conducted at onboarding.
Incident Notification Requirements
Material cyber incidents must be reported to MAS within one hour. This includes incidents that impact critical systems, result in significant data loss, affect a large number of customers, or attract public attention. MAS also requires notification of IT incidents that cause system outages affecting customer services. A root cause analysis must be submitted within 14 days, and the financial institution must demonstrate corrective actions through verifiable evidence.
Frequently Asked Questions
Are the TRM Guidelines legally binding?
How often does MAS inspect technology risk?
What is the relationship between TRM Guidelines and the Cyber Hygiene Notice?
Do the guidelines apply to fintech companies?
What cyber exercises does MAS expect?
Ready to use this resource?
Download it now or schedule a demo to see how Hunto AI can automate your security workflows.