MAS Technology Risk Management Guidelines address governance, cybersecurity and resilience in Singapore's finance sector. Board oversight, architecture, testing and third-party controls support incident monitoring, with significant events reported under the applicable MAS notices.
TL;DR:
- Financial institutions should govern technology and cyber risk across the service lifecycle.
- Practices cover secure development, access, monitoring, testing, recovery and third parties.
- Binding incident and availability duties also depend on institution-specific notices.
Summary
Governance of technology risk
The Guidelines set principles and practices for financial institutions to establish sound technology-risk governance and maintain IT and cyber resilience. Board and senior-management oversight connects the institution’s risk appetite and resources with its technology decisions. The framework concerns the business’s dependence on technology as well as its security controls, rather than treating responsibility as confined to the IT department.
Systems throughout their lifecycle
The guidance addresses the way technology is acquired, developed, changed and operated, including architecture, testing and control of access. A payment service’s risk can change when a new channel, integration or release alters dependencies and data flows. Governance therefore needs to follow the system through its lifecycle; passing an initial test does not establish that every later change preserves reliability or protection of information.
Cyber resilience and dependencies
The framework includes security monitoring, vulnerability management, recovery and the risks of external technology arrangements. Those elements connect detection with response and continued delivery of services. Outsourcing a component does not remove the financial institution’s need to understand its exposure. Resilience depends on the chain supporting the operation, including the ability to recover and test arrangements when a key system or provider fails.
Guidance alongside binding instruments
MAS lists the Guidelines across a wide range of financial institutions, including payment institutions and designated-system entities. Their supervisory role should be distinguished from binding notices and institution-specific requirements concerning technology risk, cyber hygiene or incidents. A payment business needs to read the relevant instruments together and apply them to its own activity, rather than describe every recommended practice as an identical statutory rule for every technology supplier.
Keywords
- MAS TRM
- technology governance
- cyber risk
- secure development
- access management
- security testing
- recovery planning
- third-party arrangements
- financial institutions
- supervisory guidance