MAS Technology Risk Management, guidelines and notices explained

Make sure the board and senior management include people who understand technology risk, including cyber threats.

Appoint a CIO, CTO or Head of IT and a CISO or Head of Information Security with the right expertise, with appointments at least approved by the CEO.

Establish and implement a technology risk management strategy.

Make key IT decisions in line with the firm's risk appetite.

The board or a delegated committee ensures a sound risk framework, an independent technology risk function, a risk appetite and tolerance statement, regular strategy review, assessment of management competence and an independent audit function.

Senior management sets up the framework and strategy, keeps policies and standards sound and implemented, defines staff roles clearly and tells the board promptly about major adverse developments.

Set policies, standards and procedures for technology risk, using industry standards where suitable, and review them regularly against the changing threat landscape.

Review and assess the risk of any deviation from standards, have senior management approve it and review approved deviations periodically.

Keep an inventory of all information assets, including data, hardware and software held for customers or third parties or used by service providers, and review it when things change.

Before contracting with a third party, assess the technology risks to the confidentiality, integrity and availability of your systems and data at that party.

Keep making sure the third party takes a high standard of care in protecting data confidentiality and integrity and keeping systems resilient.

Run background checks on personnel with access to your data and systems to reduce insider threat.

Run the security awareness training programme at least annually for all staff, contractors and service providers who have access to your information assets.

Train the board on the risks of technology use and on technology risk management practices.

Set up a risk management framework for technology risks with clear governance, roles and reporting lines.

Identify a risk owner who is accountable for each technology risk being treated and has the authority to manage it.

Identify threats and vulnerabilities that apply to your IT environment, including assets maintained by third-party providers.

Set criteria to measure likelihood and impact so technology risks can be prioritised.

Check whether residual risk is acceptable after treatment, and define criteria and approving authorities for risk acceptance that fit your risk tolerance.

Keep a risk register to monitor and report technology risks, with significant risks reported to the board and senior management at a frequency that fits the risk.

Develop technology risk metrics that highlight the information assets with the highest exposure, considering risk events, audit findings and regulatory requirements.

Set standards and procedures for evaluating and selecting vendors, with due diligence that fits how critical the project deliverables are.

Assess the vendor's software development and quality assurance practices, require strong security for any sensitive data it can reach, and control and monitor vendor access to your systems.

Apply a security-by-design approach: build security into every phase of the system development life cycle, with security specifications in design and continuous security evaluation.

Set security requirements that at least cover access control, authentication, authorisation, data integrity and confidentiality, system activity logging, security event tracking and exception handling.

Establish a system testing methodology and an approved test plan whose scope covers business logic, system functions, security controls and performance under load and stress.

Keep separate physical or logical environments for unit, integration and user acceptance testing, with need-to-know access to each.

Track issues found in testing, report major ones to the project steering committee and resolve them before deployment to production.

Adopt secure coding and source code review standards covering secure programming, input validation, output encoding, access control, authentication, cryptography and error handling.

Have a policy for third-party and open-source code so it is reviewed and tested before it goes into your software.

Track updates and reported vulnerabilities for third-party and open-source code in your software so you can remediate quickly.

Have a comprehensive strategy to validate and test application security, which may mix static, dynamic and interactive testing, and keep the testing rules current.

Track all issues found in code review and application security testing and remediate major ones before production deployment.

In DevSecOps, apply adequate security measures and enforce segregation of duties across development, testing and release.

Vet third parties before they connect through APIs and run a risk assessment so each API is as strong as the sensitivity and criticality of the data it carries.

Set API security standards that protect API keys and access tokens, enforce token expiry and use strong encryption and key management for sensitive data in transit.

Test API security before go-live, log third-party sessions (who, when, what data), monitor in real time and be able to revoke keys or tokens quickly after a breach.

Control and monitor shadow IT and end-user developed or acquired applications: assess their risk, approve them before use and test them before deployment.

Keep accurate configuration information on hardware and software and verify it regularly.

Avoid outdated or unsupported hardware and software, watch end-of-support dates, and have a technology refresh plan and a risk assessment for items nearing end of support.

Obtain management dispensation, with a validity period matching the risk, for continued use of unsupported technology and review it periodically.

Have a patch management process that applies patches within a timeframe that fits their criticality and tests patches before production.

Assess, test, review and approve changes before implementation, with a risk and impact analysis, tests in a test environment and signed-off results.

Use a change advisory board to approve and prioritise changes, take a backup before the change and have a rollback plan.

Define procedures and approvers for urgent or emergency changes, such as a high priority security patch.

Segregate duties in software release so no one person can develop, compile and move code between environments, and keep traceability and integrity of code that moves.

Set up an incident management framework to restore service to a secure and stable state quickly, covering handling of IT and cyber incidents, protection of evidence and clear roles for recording, escalation, decisions and resolution.

Keep senior management informed during major incidents, keep a communications plan for customers and the media, and give customers timely updates and advice where appropriate.

Run problem management to find root causes, keep a record of past incidents with lessons learnt and analyse trends to decide on further corrective action.

Use redundancy or fault-tolerant design for systems needing high availability, review architecture and dependencies for single points of failure, and test resilience regularly.

Monitor system resource use against thresholds and have procedures for when thresholds are breached.

Set recovery time and recovery point objectives for systems aligned to business priorities.

Keep a disaster recovery plan covering various disaster scenarios and responsibilities, reviewed at least annually and when material changes occur.

Test the disaster recovery plan regularly with business and IT participants, using plausible scenarios including full and partial loss of the primary site and dependencies on third parties.

Assess the disaster recovery capability of service providers that manage your assets and test the recovery steps that need coordinated action.

Have a backup strategy and plan, a policy for the backup data life cycle (frequency, retention, storage, destruction) and periodically test restoration.

Protect confidential backup data, for example by encryption, and store backup media offline or offsite.

Run a threat and vulnerability risk assessment for your data centres, covering physical and environmental threats and the country's political and economic climate, and review it after significant change.

Provide redundancy for power, network and cooling to remove single points of failure, and fit fire detection and suppression.

Place the secondary or disaster recovery data centre in a different geographic location from the primary so one disruption cannot hit both.

Monitor physical and environmental controls round the clock and control physical access with need-based access, visitor approval and escort, secured access points and restricted equipment racks.

Apply never alone, segregation of duties and least privilege, and run an access management process to provision, change and revoke rights with approval from the information asset owner.

Log user access and user management activities with unique identification for audit and investigation.

Enforce a password policy with strong controls and use multi-factor authentication for users with access to sensitive system functions.

Review user access periodically to find dormant, redundant and inappropriate rights, and revoke access promptly when roles change or people leave.

Subject service providers with access to your assets to the same monitoring and restrictions as your own staff.

Grant privileged access on a need-to-use basis, log and review its activity, and manage and monitor system and service accounts.

Encrypt remote connections, use strong authentication such as MFA for remote access and allow it only from devices secured to your standards.

Use algorithms from well-established international standards with suitable key lengths, vetted and tested, and monitor developments in cryptanalysis to update algorithms when needed.

Have a key management policy covering the key life cycle, protect keys from disclosure and set a lifespan for each key based on risk.

Store sensitive keys in hardened tamper-resistant systems such as a hardware security module, distribute them by secure means and use each key for a single purpose.

Revoke and replace compromised keys and related keys, destroy expired or revoked keys securely and keep protected backups of keys.

Develop data loss prevention policies and measures that detect and prevent unauthorised access, change, copying or transfer of confidential data in motion, at rest and in use, with service providers held to the same standard.

Encrypt and strongly control confidential data on systems and endpoints, allow only authorised media and devices to store or send it, and prevent and detect use of unauthorised internet services.

Restrict sensitive production data in non-production environments, require senior management approval for exceptions and mask the data where possible.

Irrevocably delete confidential data from media, systems and endpoints before disposal or redeployment.

Install firewalls at internet and third-party connections, segment assets by criticality, deploy network intrusion prevention and use network access controls to block unauthorised devices.

Review network access rules regularly, remove obsolete rules and insecure protocols, consider isolating web browsing, deploy effective DoS protection and review the network architecture periodically.

Set security configuration standards for hardware and software, review them periodically and check systems conform, addressing deviations in time.

Use endpoint protection, keep anti-malware current, scan for indicators of compromise, monitor for anomalies and use controls such as application allow-listing.

Before allowing BYOD, run a comprehensive risk assessment and apply suitable measures to secure personal devices.

Set security standards for all virtualisation components, restrict administrative access to hypervisors and host systems and govern virtual images and snapshots.

Keep an inventory of IoT devices, assess and mitigate their risks, host them in a separate network segment, prevent unauthorised access and monitor for anomalies.

Collect and analyse cyber-related information on threats and vulnerabilities, procure cyber intelligence monitoring and take part in trusted threat information sharing.

Set up a security operations centre or buy managed security services, with defined processes, roles and responsibilities.

Collect, review and retain system logs and protect them from unauthorised access, and baseline routine activity so anomalies can be found.

Correlate events across logs to spot suspicious patterns and escalate suspicious activity to the right stakeholders in good time.

Maintain a cyber incident response and management plan to isolate and neutralise threats and resume services securely, investigate the control failures that allowed the breach and feed lessons into controls and the plan.

Run regular vulnerability assessments at a frequency that fits system criticality and exposure, covering vulnerability discovery, weak configurations, open ports and application vulnerabilities.

Carry out penetration testing, using blackbox and greybox testing for online financial services, and test the production environment with proper safeguards.

Set penetration test frequency by criticality and exposure, and test internet-facing systems at least once a year or after major changes.

Run regular scenario-based cyber exercises, such as table-top, social engineering or cyber range exercises, involving senior management, business, communications and service providers.

Run adversarial attack simulation exercises with defined objectives, scope and rules of engagement, supervised so they do not disrupt production.

Have a remediation process that classifies the severity of issues from assessments and exercises, sets timeframes by severity and handles deviations through risk assessment and mitigation.

Apply security measures that fit the risk of online services, secure communication channels with encryption and signatures, and reduce exposure to common attacks such as injection, scripting, man-in-the-middle, DNS hijacking, DDoS and spoofing.

Address mobile application risks, distribute apps only through official stores or secure channels, monitor and act on phishing against you and your customers, and block rooted or jailbroken devices from financial transactions unless the app is protected.

Use multi-factor authentication at customer login, protect passwords with end-to-end encryption, and use transaction signing for high-risk activities such as changes to sensitive data, new payees, high-value transfers and limit changes.

Make one-time passwords short-lived, encrypt biometric and credential data, calibrate biometric accuracy to risk, control soft token provisioning, keep sessions intact and end them after inactivity, assess corporate customer controls and store credentials in a form resistant to reverse engineering.

Run real-time fraud monitoring, investigate suspicious transactions and notify customers of suspicious activity or transfers above a threshold.

Educate customers on security best practices, alert them to new cyber threats and tell them how to detect and report unauthorised transactions.

Make sure IT audit gives the board and senior management an independent, objective opinion on the adequacy and effectiveness of technology risk management, governance and controls.

Identify a comprehensive set of auditable areas covering all IT operations, functions and processes, and set audit frequency by criticality and risk.

Make sure IT auditors have the skills to assess IT policies, procedures, processes and controls.

Secure every administrative account on operating systems, databases, applications, security appliances and network devices to prevent unauthorised access or use.

Apply security patches to every system within a timeframe that fits the risk of each vulnerability, and where no patch exists put controls in place to reduce the risk.

Have a written set of security standards for every system and make each system conform, with controls to reduce risk where a system cannot conform.

Put controls at the network perimeter to restrict all unauthorised network traffic.

Implement one or more malware protection measures on every system, where such measures are available and can be implemented.

Use multi-factor authentication for all administrative accounts on critical systems and for all accounts on any system used to access customer information through the internet.

Put in place a framework and process to identify critical systems.

Make all reasonable effort to keep critical systems highly available, with unscheduled downtime affecting operations or customers not exceeding 4 hours in total in any 12 months.

Set a recovery time objective of not more than 4 hours for each critical system, and validate and document at least every 12 months how recovery testing is done and when the objective is validated.

Notify MAS as soon as possible, and no later than 1 hour, after discovering a relevant incident (a severe and widespread system malfunction or IT security incident, or one materially affecting customer service).

Submit a root cause and impact analysis report to MAS within 14 days of discovering the relevant incident, unless MAS allows longer, covering an executive summary, root cause, impact and remedial measures.

Implement IT controls to protect customer information from unauthorised access or disclosure.