What are the MAS TRM Guidelines?
The MAS Technology Risk Management (TRM) Guidelines set out the Monetary Authority of Singapore’s expectations for how financial institutions manage technology and cyber risk. The guidelines themselves are not legally binding, but MAS takes the degree of observance into account when assessing institutions. They sit alongside binding MAS Notices, notably on technology risk management and on cyber hygiene, which set legal minimums.
Who does it apply to?
Financial institutions regulated by MAS, including banks, insurers, capital markets intermediaries and payment service providers, applied in proportion to the size and complexity of each institution.
Key expectations
- Board and senior management: oversight of technology risk, a technology risk management framework, and appropriately skilled leadership, such as a CIO and CISO.
- Technology risk management: identification, assessment, mitigation and monitoring of technology risks, including in the software development lifecycle and change management.
- Resilience: high availability and recoverability of critical systems, tested disaster recovery, and defined recovery objectives.
- Third-party and cloud risk: due diligence and ongoing management of technology service providers.
- Cyber security operations: threat intelligence, monitoring, incident response, and regular vulnerability assessments, penetration testing and red teaming for critical systems.
- Access, cryptography and data: strong access control, privileged access management, cryptographic key management and data security.
Binding notices
The Notice on Cyber Hygiene requires baseline measures, such as administrative account security, security patching, security standards, perimeter defences, malware protection and multi-factor authentication. The Notice on Technology Risk Management requires institutions to keep critical systems highly available and to notify MAS of relevant incidents within one hour of discovery.
How does it relate to other frameworks?
The TRM Guidelines map well to ISO/IEC 27001, ISO 22301 and NIST CSF. Personal data in Singapore is covered separately by the PDPA.
Sources and official references
- Technology Risk Management Guidelines — Monetary Authority of Singapore (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with Monetary Authority of Singapore (MAS).
