- ClassificationCategoryOperational ResilienceDomainRisk ManagementFramework FamilyOther
- Regulatory ContextTypeFrameworkLegal InstrumentGuidelineSectorFinancial SectorIndustryFinancial Services
- Region / PublisherRegionAsia-PacificRegion DetailSingaporePublisherMonetary Authority of Singapore (MAS)
- VersioningVersionRevised edition, January 18, 2021Effective DateJanuary 18, 2021Issue DateJanuary 18, 2021 (Guidelines); Notice FSM-N05 issued May 9, 2024
- AdoptionAdoption ModelVoluntaryImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Guidelines and the MAS Notices on Technology Risk Management are published free as PDFs on the Monetary Authority of Singapore's website; the platform links to the official pages.
Framework text is licensed by its publisher and is included only where stated above.
- The MAS Technology Risk Management Guidelines, revised January 18, 2021, set MAS's technology and cyber risk expectations for all Singapore financial institutions.
- They are guidelines, not law, but the degree of observance is a supervisory consideration.
- The binding layer is the MAS Notices on Technology Risk Management, such as FSM-N05 for banks, effective May 10, 2024.
- The 15 chapters cover governance, the risk framework, project management, software development, IT service management, resilience, access control, and cyber operations.
- The 2021 revision expects the board and senior management to appoint a Chief Information Officer and a Chief Information Security Officer.
Overview
The MAS Technology Risk Management Guidelines are the Monetary Authority of Singapore's statement of technology risk management principles and practices for every financial institution it regulates, issued in revised form on January 18, 2021. They are guidelines, not law: paragraph 2.3 says they provide general guidance and do not replace or override legislation, and paragraph 2.2 says the degree of observance is an area MAS considers when supervising an institution, which is why MAS expects FIs to observe them. The legally binding layer is the set of MAS Notices on Technology Risk Management, such as Notice FSM-N05 for banks, which took effect on May 10, 2024 under the Financial Services and Markets Act 2022.
The Guidelines run to 15 chapters: a preface and application statement (1 and 2), technology risk governance and oversight (3), the technology risk management framework (4), IT project management and security-by-design (5), software application development and management including agile, DevSecOps and APIs (6), IT service management (7), IT resilience (8), access control (9), cryptography (10), data and infrastructure security including virtualization and Internet of Things (11), cyber security operations (12), cyber security assessment (13), online financial services (14) and IT audit (15), with annexes. The 2021 revision added the expectation in paragraph 3.1.3 that the board and senior management appoint a Chief Information Officer (or equivalent) and a Chief Information Security Officer with the requisite expertise, approved at least by the CEO.
An institution implements the Guidelines by mapping each paragraph to its own policies and controls, scaling the depth to the risk and complexity of its services as paragraph 2.2 allows, and evidencing the result for MAS supervision and IT audit. MAS opened a consultation on June 10, 2026, closed July 31, 2026, on amendments to the Notices covering IT asset management, IT risk assessment and monitoring, change management controls and data backup and recovery; the Guidelines themselves were not reissued.
Why does it matter?
MAS does not test a Singapore bank, insurer, broker or payment institution against ISO/IEC 27001; it tests it against these Guidelines and the Notices they accompany. Paragraph 2.2 makes observance a supervisory consideration, so a gap against a Guidelines paragraph is a supervisory finding even though the paragraph is not itself an offense, and the Notice FSM-N05 obligations behind it carry hard numbers: no more than four hours of unscheduled downtime for a critical system in any 12 months, a recovery time objective of four hours or less, notice to MAS within one hour of discovering a relevant incident and a root cause and impact report within 14 days. The Guidelines are also the yardstick for the CIO and CISO roles, third-party oversight, cyber exercises and the IT audit function that MAS expects to see.
Key benefits include:
- Supervisory expectations in writing
Fifteen chapters of expectations covering governance, the risk framework, development, operations, resilience, security, cyber operations and testing, online services and audit, read with MAS's legislation, notices and directions (paragraph 2.3).
- Named accountable officers
Paragraph 3.1.3: a Chief Information Officer, Chief Technology Officer or Head of IT and a Chief Information Security Officer or Head of Information Security with the requisite expertise, appointments approved at least by the CEO; paragraph 3.1.2: board and senior management members who understand technology and cyber risk.
- A binding layer with numbers
Notice FSM-N05 (banks) and its parallel notices for other FI classes: critical system identification, four-hour downtime cap per 12 months, four-hour RTO validated every 12 months, one-hour incident notification, 14-day root cause report, IT controls over customer information.
- Proportionate application
Paragraph 2.2: the extent of implementation should be commensurate with the risk and complexity of the services and the technologies that support them.
- Testing and intelligence
Chapter 13 expects vulnerability assessment, penetration testing (black-box and gray-box for online services), cyber exercises, adversarial attack simulation and intelligence-based scenario design; paragraph 12.1 expects a cyber threat intelligence process and procured intelligence monitoring.
How does it work?
Chapters 3 and 4 set governance. Paragraph 3.1 places technology risk with the board and senior management: members with the knowledge to manage technology and cyber risk (3.1.2), the CIO and CISO appointments (3.1.3), a technology risk management strategy (3.1.4), key IT decisions within risk appetite (3.1.5) and a tone from the top (3.1.6), with the board or a delegated committee responsible for the risk framework and a technology risk management function (3.1.7). Paragraphs 3.2 to 3.6 cover policies, information asset management, third-party services (assess exposure before contracting and monitor the provider's standard of care on an ongoing basis, 3.4.2 and 3.4.3), competency and background checks and security awareness. Chapter 4 requires a risk management framework with defined roles and reporting lines, a named risk owner for each technology risk (4.1.3), and the identification, assessment, treatment, monitoring and reporting cycle.
Chapters 5 to 11 cover the technology life cycle and controls. Chapter 5 expects a project management framework, a steering committee, system acquisition controls and security-by-design through the development life cycle. Chapter 6 covers secure coding, source code review and application security testing, agile development, DevSecOps, API development (open APIs offered to fintech partners included) and end-user computing. Chapter 7 is IT service management: configuration, technology refresh, patch, change, release, incident and problem management. Chapter 8 is IT resilience: system availability with dependency mapping for single points of failure (8.1.2), recoverability, disaster recovery testing, backup and data center resilience. Chapters 9 to 11 cover user, privileged and remote access; cryptographic algorithms and key management; and data, network, system, virtualization and Internet of Things security.
Chapters 12 to 15 cover cyber operations, testing, online services and audit. Paragraph 12.1 expects a process to collect and analyze cyber threat intelligence and the procurement of intelligence monitoring services, 12.2 cyber event monitoring and detection, and 12.3 cyber incident response. Chapter 13 expects vulnerability assessment (13.1), penetration testing with black-box and gray-box tests for online financial services and the option of a bug bounty program (13.2), cyber exercises (13.3), adversarial attack simulation under defined rules of engagement (13.4), intelligence-based scenario design (13.5) and remediation management (13.6). Chapter 14 sets expectations for online financial services: security, customer authentication and transaction signing, fraud monitoring and customer education. Chapter 15 expects an IT audit that gives the board an independent opinion on technology risk controls (15.1.1).
Key Elements
- Application (chapter 2)
General guidance, not a statement of the standard of care, applied in proportion to risk and complexity and read with MAS legislation, notices and directions.
- Governance and oversight (chapter 3)
Board and senior management duties, CIO and CISO appointments approved by the CEO, policies, information assets, third-party services, competency and awareness.
- Risk framework (chapter 4)
Framework, roles and reporting lines, a risk owner per technology risk, and the identify-assess-treat-monitor-report cycle.
- Build and run (chapters 5 to 11)
Project management and security-by-design, secure development including agile, DevSecOps and APIs, IT service management, IT resilience, access control, cryptography, data and infrastructure security.
- Cyber operations and assessment (chapters 12 and 13)
Threat intelligence, monitoring and detection, incident response; vulnerability assessment, penetration testing, cyber exercises, adversarial attack simulation and remediation.
- Online services and audit (chapters 14 and 15)
Security of online financial services, customer authentication and transaction signing, fraud monitoring; an independent IT audit opinion for the board.
What does it cover?
The Guidelines apply to all financial institutions regulated by MAS: MAS's own page lists banks, merchant and wholesale banks, finance companies, card issuers and financial holding companies; direct insurers, reinsurers, captive insurers, insurance agents and brokers; capital markets intermediaries, fund managers, exchanges, trustees and depositories; designated payment system operators, major and standard payment institutions and money-changers; licensed and exempt financial advisers; and licensed trust companies. They cover the institution's IT operating environment, its online financial services and its third-party and cloud arrangements, applied in proportion to the risk and complexity of its services. The binding notices (FSM-N05 for banks and parallel FSM-N notices for other classes) narrow the hard requirements to critical systems, incident notification and customer information.
What are its objectives?
Paragraph 1.4 states the aim: to guide FIs to establish sound technology risk governance and oversight and to maintain IT and cyber resilience.
Place technology and cyber risk with the board and senior management and named accountable officers.
Run a technology risk management framework with owners, assessment and reporting.
Build security into projects, software and APIs and operate IT services with disciplined change and incident management.
Keep critical systems available and recoverable and customer data confidential.
Detect, test and respond to cyber threats with intelligence, exercises and independent audit.
Framework in Context
The Guidelines are one layer of MAS's technology regime. Above them sit the Notices on Technology Risk Management issued under the Financial Services and Markets Act 2022 on May 9, 2024 and effective May 10, 2024, which replaced the earlier per-sector notices such as Notice 644 for banks, together with the Notices on Cyber Hygiene; MAS's consultation of June 10, 2026 proposed amendments to those Notices, not to the Guidelines. Below them sit MAS's incident reporting instructions and its guidance on individual accountability, which the Guidelines cite for the CIO and CISO roles. Internationally, the Guidelines cover the same ground as the FFIEC IT Handbook in the United States and the EU's DORA, and institutions usually evidence them with controls already certified against ISO/IEC 27001 or mapped to the NIST Cybersecurity Framework; Singapore's CII owners in the banking and finance sector also answer to CSA's Cybersecurity Code of Practice.
Common Framework Mappings
Organizations map the Guidelines' chapters to the frameworks below so that one control set serves MAS supervision, group audit and international certification.
Mapped frameworks include:
COBIT 2019
EU DORA
FFIEC IT Handbook
ISO 27001:2022
ISO 27002:2022
NIST CSF 2.0
NIST 800-53 Rev.5
SWIFT CSCF
How SmartSuite Supports the MAS TRM Guidelines
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management to hold the Guidelines' chapters and paragraphs as requirements with owners and evidence, Cyber & IT Risk for the chapter 4 risk register with a named risk owner per technology risk, and IT Service Management (ITSM) for the chapter 7 change, incident and problem records that also feed the FSM-N05 downtime and incident clocks.
Guidelines Requirement Library
Load chapters 2 to 15 as requirements by paragraph (for example 3.1.3, 4.1.3, 8.1.2, 12.1, 13.2) with the control, owner and evidence that answers each, and the proportionality rationale under paragraph 2.2.
Technology Risk Register
Keep chapter 4 risks in Cyber & IT Risk with a named risk owner, assessment, treatment and monitoring, and report to the board or its delegated committee as paragraph 3.1.7 expects.
Third-Party Technology Oversight
Record pre-contract assessments and ongoing monitoring of third-party and cloud providers under paragraph 3.4 in Third Party Risk Management.
Critical Systems and Incident Clocks
Maintain the FSM-N05 critical system list, log unscheduled downtime against the four-hour annual cap, track the one-hour MAS notification and the 14-day root cause report through IT Service Management (ITSM) incidents.
Testing and Exercise Program
Schedule and evidence vulnerability assessments, penetration tests, cyber exercises and adversarial attack simulations under chapter 13, with remediation tracked to closure (13.6).
IT Audit and Board Reporting
Plan chapter 15 IT audits over the auditable areas, track findings and remediation in Internal Audit Management, and assemble the board's view of technology risk from the same records.
Related frameworks
COBIT 2019 is ISACA's framework for governing and managing enterprise IT, with 40 objectives in five domains, six governance principles and 11 design factors.
DORA (Regulation (EU) 2022/2554) requires EU financial entities to manage ICT risk, report major incidents, test resilience and control ICT third-party risk, applying from January 17, 2025.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
Frequently Asked Questions For Singapore MAS TRM 2021 (Technology Risk Management Guidelines)
No. Paragraph 2.3 says the Guidelines provide general guidance and do not replace or override legislation, and paragraph 2.2 says they are not a statement of the standard of care owed to customers. They still matter in supervision: paragraph 2.2 makes the degree of observance an area MAS considers, and MAS said on issuing them that it expects financial institutions to observe them. The binding requirements sit in the MAS Notices on Technology Risk Management, such as Notice FSM-N05 for banks.
All financial institutions regulated by MAS. MAS's page lists banks, merchant and wholesale banks, finance companies, card issuers and financial holding companies, insurers, reinsurers, insurance agents and brokers, capital markets intermediaries, fund managers, exchanges and depositories, payment system operators and payment institutions, money-changers, financial advisers and licensed trust companies. Paragraph 2.2 lets each institution apply them in proportion to the risk and complexity of its services.
Chapter 3 expects board and senior management members with the knowledge to manage technology and cyber risk (3.1.2), the appointment of a Chief Information Officer, Chief Technology Officer or Head of IT and a Chief Information Security Officer or Head of Information Security with the requisite expertise, approved at least by the CEO (3.1.3), a technology risk management strategy (3.1.4), IT decisions within risk appetite (3.1.5) and a board-owned risk framework with a technology risk management function (3.1.7).
Notice FSM-N05, issued on May 9, 2024 under section 29(1) of the Financial Services and Markets Act 2022 and effective May 10, 2024, requires a bank to identify its critical systems; keep unscheduled downtime for each critical system to no more than four hours in any 12 months; set a recovery time objective of not more than four hours and validate it every 12 months; notify MAS within one hour of discovering a relevant incident; submit a root cause and impact analysis within 14 days; and implement IT controls protecting customer information. It replaced Notice 644, withdrawn the same day.
Chapter 13 expects vulnerability assessments (13.1), penetration testing with a combination of black-box and gray-box tests for online financial services and the option of a bug bounty program (13.2), cyber exercises (13.3), adversarial attack simulation exercises conducted under defined objectives, scope and rules of engagement (13.4), intelligence-based scenario design (13.5) and tracked remediation (13.6). Chapter 15 adds an IT audit that gives the board an independent opinion on the controls.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.