Featured Product

    MAS Revises Guidelines on Technology Risk Management

    January 18, 2021

    MAS revised the guidelines that address technology and cyber risks of financial institutions, in an environment of growing use of cloud technologies, application programming interfaces, and rapid software development. Post a consultation, the enhancements include new guidance on effective cyber surveillance, secure software development, adversarial attack simulation exercise, and management of cyber risks posed by the emerging technologies such as Internet of Things. MAS also published a response to the feedback received during the consultation process, in addition to a set of the frequently asked questions (FAQs) on the guidelines.

    The guidelines on technology risk management set out the risk management principles and best practices to guide financial institutions, including banks, to establish sound and robust technology risk governance and oversight and to maintain cyber resilience. In particular, for financial institutions, the guidelines set out:

    • Expectations to have in place effective technology risk management practices and controls to protect the information technology infrastructure: the institutions are required to test and validate the effectiveness of the recovery process once every 12 months.
    • Enhanced risk mitigation strategies to establish a robust process for the timely analysis and sharing of cyber threat intelligence within the financial ecosystem and to conduct cyber exercises to allow institutions to stress test their cyber defenses by simulating the attack tactics, techniques, and procedures used by real-world attackers.
    • Expectations to exercise strong oversight of arrangements with third-party service providers, to ensure system resilience as well as maintain data confidentiality and integrity.
    • Additional guidance on the roles and responsibilities of the board of directors and senior management: the board and senior management should ensure that a Chief Information Officer and a Chief Information Security Officer, with the requisite experience and expertise, are appointed and accountable for managing technology and cyber risks and the board should include members with the relevant knowledge to provide effective oversight of technology and cyber risks.
    • Expectations to establish and continuously improve IT processes and controls to preserve confidentiality, integrity and availability of data and information technology systems. Security measures should be implemented to prevent and detect the use of unauthorized internet services that allow users to communicate or store confidential data; examples of such services include social media, cloud storage, and file sharing, e-mails, and messaging applications.

    MAS expects financial institutions to observe the guidelines on technology risk management as this will be considered in the risk assessment of MAS with respect to the financial institutions. The guidelines provide general guidance and are not intended to be comprehensive nor replace or override any legislative provisions. They should be read in conjunction with the provisions of the relevant legislation, the subsidiary legislation made under the relevant legislation, as well as written directions, notices, codes, and other guidelines that MAS may issue from time to time pursuant to the relevant legislation and subsidiary legislation. In particular, the guidelines should be read with the Notice on Technology Risk Management and Notice on Cyber Hygiene.


    Keywords: Asia Pacific, Singapore, Banking, Insurance, Securities, Technology Risk, Cyber Risk, FAQ, Internet of Things, Governance, Cyber Resilience, MAS

    Related Articles

    ESAs Issue Multiple Regulatory Updates for Financial Sector Entities

    The three European Supervisory Authorities (ESAs) issued a letter to inform about delay in the Sustainable Finance Disclosure Regulation (SFDR) mandate, along with a Call for Evidence on greenwashing practices.

    November 15, 2022 WebPage Regulatory News

    ISSB Makes Announcements at COP27; IASB to Propose IFRS 9 Amendments

    The International Sustainability Standards Board (ISSB) of the IFRS Foundations made several announcements at COP27 and with respect to its work on the sustainability standards.

    November 10, 2022 WebPage Regulatory News

    IOSCO Prioritizes Green Disclosures, Greenwashing, and Carbon Markets

    The International Organization for Securities Commissions (IOSCO), at COP27, outlined the regulatory priorities for sustainability disclosures, mitigation of greenwashing, and promotion of integrity in carbon markets.

    November 09, 2022 WebPage Regulatory News

    EBA Finalizes Methodology for Stress Tests, Issues Other Updates

    The European Banking Authority (EBA) issued a statement in the context of COP27, clarified the operationalization of intermediate EU parent undertakings (IPUs) of third-country groups

    November 09, 2022 WebPage Regulatory News

    OSFI Sets Out Work Priorities and Reporting Updates for Banks

    The Office of the Superintendent of Financial Institutions (OSFI) published an annual report on its activities, a report on forward-looking work.

    November 07, 2022 WebPage Regulatory News

    APRA Finalizes Changes to Capital Framework, Issues Other Updates

    The Australian Prudential Regulation Authority (APRA) finalized amendments to the capital framework, announced a review of the prudential framework for groups.

    November 03, 2022 WebPage Regulatory News

    BIS Hub and Central Banks Conduct CBDC and DeFI Pilots

    The Bank for International Settlements (BIS) Innovation Hubs and several central banks are working together on various central bank digital currency (CBDC) pilots.

    November 03, 2022 WebPage Regulatory News

    ECB Sets Deadline for Banks to Meet Its Climate Risk Expectations

    The European Central Bank (ECB) published the results of its thematic review, which shows that banks are still far from adequately managing climate and environmental risks.

    November 02, 2022 WebPage Regulatory News

    ESAs, ECB, & EC Issue Multiple Regulatory Updates for Financial Sector

    Among its recent publications, the European Banking Authority (EBA) published the final standards and guidelines on interest rate risk arising from non-trading book activities (IRRBB)

    October 31, 2022 WebPage Regulatory News

    EC Adopts Final Rules Under CRR, BRRD, and Crowdfunding Regulation

    The European Commission (EC) recently adopted regulations with respect to the calculation of own funds requirements for market risk, the prudential treatment of global systemically important institutions (G-SIIs)

    October 26, 2022 WebPage Regulatory News
    RESULTS 1 - 10 OF 8582