Guidelines · Financial sector · Singapore

MAS TRM compliance: the guidelines, notices and 1-hour reporting

MAS TRM compliance means meeting the Monetary Authority of Singapore's Technology Risk Management Guidelines, revised in January 2021, together with the binding notices on technology risk and cyber hygiene. Financial institutions must govern technology risk at board level, report relevant incidents within one hour and keep critical systems highly available.

Written by QULDEX EditorialReviewed by Swati Chaturvedi, Framework reviewerUpdated
Check your MAS TRM readinessBook a 30-min walkthrough
Key takeaways

What you need to know about MAS TRM

Guidelines plus noticesThe guidelines set expectations; the notices are binding.
Board-levelThe board and senior management own technology risk.
One-hour reportingRelevant incidents go to MAS within one hour.
Availability limitsCritical systems have strict downtime limits.
Cyber hygieneSix baseline measures apply to all covered institutions.

Who must comply with MAS TRM?

Financial institutions regulated by the Monetary Authority of Singapore.

BanksIncluding digital banks.
InsurersLife and general insurers.
Capital markets services licenseesFund managers and brokers.
Payment service providersLicensed under the Payment Services Act.
Their technology providersThrough outsourcing and contract requirements.

QULDEX helps here first: the readiness check shows where you stand before you commit budget.

What MAS requires

What do the MAS TRM Guidelines require?

The MAS TRM Guidelines expect board-led technology risk governance, secure development and operations, resilient systems, strong access and cyber security controls, and independent audit. The notices make incident reporting, availability and cyber hygiene legally binding.

3–4 Govern

Governance and risk

Board oversight and a risk framework.

In QULDEX: Governance evidence
5–7 Build

Projects, development, ITSM

Security-by-design and change control.

In QULDEX: SDLC and change records
8 Resilience

IT resilience

Availability and DR testing.

In QULDEX: DR tests and metrics
9–13 Protect

Access and cyber security

Access, crypto, data, SOC, testing.

In QULDEX: Controls mapped to ISO 27001
Notices Bind

Notices

1-hour reporting, availability, cyber hygiene.

In QULDEX: Timers and availability tracking
Area explorer

Which MAS TRM areas matter most?

These 17 guideline chapters and notice requirements carry most of the work. Select any one to see what it asks for, typical evidence and the matching ISO 27001 reference.

Jan 2021guidelines revised
1 hincident notice
4 hmax yearly downtime
6cyber hygiene measures

Showing up to 6 per group. Search, filter, or open a group to see all 17.

Governance and development 4

  1. 3Technology risk governance and oversight

    The board and senior management oversee technology risk, with clear roles and a technology risk framework.

    In QULDEXBoard reviews and approvals are recorded.

    Typical evidence
    Board minutes, framework
    Maps to
    ISO 27001 5.1

  2. 4Technology risk management framework

    Identify, assess, treat and monitor technology risks.

    In QULDEXThe risk register holds technology risks with owners.

    Typical evidence
    Risk register
    Maps to
    ISO 27001 6.1

  3. 5IT project management and security-by-design

    Manage IT projects with security built in from the start.

    In QULDEXQULDEX gives this area an owner, evidence requests and a review date, and maps it to ISO 27001 and NIST CSF.

    Typical evidence
    Project reviews
    Maps to
    ISO 27001 A.5.8

  4. 6Software application development and management

    Secure development, testing and code review.

    In QULDEXQULDEX gives this area an owner, evidence requests and a review date, and maps it to ISO 27001 and NIST CSF.

    Typical evidence
    SDLC evidence
    Maps to
    ISO 27001 A.8.25–A.8.29

Operations and security 9

  1. 7IT service management

    Configuration, change, patch, incident and problem management.

    In QULDEXQULDEX gives this area an owner, evidence requests and a review date, and maps it to ISO 27001 and NIST CSF.

    Typical evidence
    ITSM records
    Maps to
    ISO 20000-1

  2. 8IT resilience

    System availability, recoverability and testing of disaster recovery.

    In QULDEXDR tests and availability metrics are stored.

    Typical evidence
    DR tests
    Maps to
    ISO 22301

  3. 9Access control

    Least privilege, privileged access management and access reviews.

    In QULDEXAccess reviews run as recurring tasks.

    Typical evidence
    Access reviews
    Maps to
    ISO 27001 A.5.15–A.5.18

  4. 10Cryptography

    Approved algorithms and key management.

    In QULDEXQULDEX gives this area an owner, evidence requests and a review date, and maps it to ISO 27001 and NIST CSF.

    Typical evidence
    Crypto standard
    Maps to
    ISO 27001 A.8.24

  5. 11Data and infrastructure security

    Protect data, networks and endpoints.

    In QULDEXQULDEX gives this area an owner, evidence requests and a review date, and maps it to ISO 27001 and NIST CSF.

    Typical evidence
    Security baselines
    Maps to
    ISO 27001 A.8.20–A.8.22

  6. 12Cyber security operations

    Threat intelligence, monitoring and a security operations capability.

    In QULDEXQULDEX gives this area an owner, evidence requests and a review date, and maps it to ISO 27001 and NIST CSF.

    Typical evidence
    SOC reports
    Maps to
    ISO 27001 A.8.16

  7. 13Cyber security assessment

    Vulnerability assessments, penetration tests and red teaming.

    In QULDEXFindings become CAPA items.

    Typical evidence
    Test reports
    Maps to
    ISO 27001 A.8.8

  8. 14Online financial services

    Security for internet and mobile banking, including customer authentication.

    In QULDEXQULDEX gives this area an owner, evidence requests and a review date, and maps it to ISO 27001 and NIST CSF.

    Typical evidence
    Authentication evidence

  9. 15IT audit

    Independent audits of technology risk and controls.

    In QULDEXAudits run in the audit workspace.

    Typical evidence
    Audit reports
    Maps to
    ISO 27001 9.2

Third parties 1

  1. 2Third-party and outsourcing risk

    Due diligence and oversight of technology service providers, alongside MAS outsourcing requirements.

    In QULDEXEach provider is assessed and linked to its services.

    Typical evidence
    Vendor assessments
    Maps to
    ISO 27001 A.5.19–A.5.22

Binding notices 3

  1. TRM Notice (1)Incident notification within 1 hourBinding notice

    Notify MAS within one hour of discovering a relevant incident, and submit a root-cause report within the required period.

    In QULDEXIncidents start a one-hour timer.

    Typical evidence
    Incident notices

  2. TRM Notice (2)Critical system availabilityBinding notice

    Critical systems must not be unavailable for more than four hours in any 12-month period, with recovery-time targets.

    In QULDEXAvailability is tracked per critical system.

    Typical evidence
    Availability reports

  3. Cyber HygieneCyber hygiene noticeBinding notice

    Six baseline measures: secure administrative accounts, patching, security standards, network perimeter defence, malware protection and MFA.

    In QULDEXThe six measures are tracked as controls.

    Typical evidence
    Cyber hygiene evidence
    Maps to
    Essential Eight

Chapter numbers follow the MAS TRM Guidelines (January 2021); notice summaries follow the MAS Notices on Technology Risk Management and Cyber Hygiene. Summaries are QULDEX paraphrases.

Compliance path

How do you comply with MAS TRM?

Map the guidelines and notices to your controls, close the gaps with board oversight, prove availability and incident reporting, and keep evidence for MAS inspections. Most institutions need 4 to 9 months to close gaps.

  1. Gap assessment

    Against the guidelines and the binding notices.

    3–6 weeksReadiness assessment →

  2. Governance and risk framework

    Board oversight, roles and a technology risk framework.

    1–2 monthsRisk register →

  3. Incident and availability processes

    One-hour notification and critical system availability tracking.

    1–2 monthsCAPA automation →

  4. Cyber hygiene and security controls

    The six hygiene measures and the wider controls.

    2–5 monthsPre-mapped control library →

  5. Testing and IT audit

    Penetration tests, red teaming and independent audit.

    1–3 monthsMulti-auditor workspace →

  6. Keep it current

    Every incidentNotify MAS within 1 hour
    YearlyDR tests and audit
    OngoingAvailability tracking
    OngoingSecure evidence vault →

Durations are QULDEX planning ranges.

Records to keep

Which documents does MAS TRM need?

MAS inspections and auditors ask for these records.

DocumentAreaWhere it lives in QULDEX
Technology risk framework and board reviews3–4Policy library
Technology risk register4Risk register
SDLC and change records5–7Evidence vault
DR test reports and availability metrics8, NoticeEvidence vault
Access reviews9Evidence vault
Penetration test and red team reports13CAPA automation
Incident notifications and root-cause reportsNoticeCAPA automation
Cyber hygiene evidenceCyber Hygiene NoticeEvidence vault
Outsourcing due diligence2Vendor register
IT audit reports15Audit workspace

Chapter references follow the TRM Guidelines.

Time and cost

How long does MAS TRM take and what drives the effort?

Most institutions need 4 to 9 months. Availability engineering, incident reporting and outsourcing oversight drive the effort.

Where the time goes

Gap assessment3–6 wk
Governance1–2 mo
Incident and availability1–2 mo
Security controls2–5 mo
Testing and audit1–3 mo

Bars show the upper end of each range on one scale (9 months = full width).

What changes the effort

  • Critical systems: each needs availability and DR evidence
  • Outsourcing: cloud and vendors need due diligence
  • Online services: customer authentication requirements
  • Existing ISO 27001: covers much of chapters 9–13
  • Licence type: notices differ by institution type
Readiness check · 2 minutes

How ready are you for MAS TRM?

Check these eight things first. Nothing you enter leaves this page.

3Does the board oversee technology risk with regular reporting?
4Is there a current technology risk register?
NoticeCan you notify MAS within one hour of a relevant incident?
NoticeDo you track critical system downtime against the four-hour limit?
Cyber HygieneAre the six cyber hygiene measures in place?
9Are privileged accounts controlled and reviewed?
13Do you run penetration tests and fix findings?
2Are technology providers assessed under the outsourcing rules?
Crosswalk

How MAS TRM maps to ISO 27001, DORA and the Essential Eight

MAS TRM shares its structure with ISO 27001 and its resilience goals with DORA; the cyber hygiene notice overlaps with the Essential Eight.

MAS TRM crosswalk

MAS TRMISO 27001:2022DORAEssential EightShared evidence
3 Governance5.1Art. 5—Board minutes
4 Risk framework6.1Art. 6—Risk register
8 IT resilienceA.5.29–A.5.30Art. 11BackupsDR tests
9 Access controlA.5.15–A.5.18Art. 9Admin privileges, MFAAccess reviews
13 AssessmentA.8.8Art. 24–26PatchingTest reports
Notice: 1-hour reportingA.5.24–A.5.26Art. 19—Incident notices
2 Third partiesA.5.19–A.5.22Art. 28—Vendor register

Indicative mapping for planning.

Where QULDEX fits

How QULDEX runs MAS TRM from gap assessment to inspection

QULDEX is MAS TRM compliance and audit management software built from EGV Group's audit delivery, used by financial institutions, their advisors and IT auditors. Pick your role to see who does what.

For MAS-regulated banks, insurers and payment firms.

  1. AssessRun the gap assessmentGuidelines and notices mapped
  2. GovernReport to the boardBoard pack from live data
  3. OperateTrack availabilityDowntime per critical system
  4. IncidentsNotify MAS in 1 hourOne-hour timers
  5. ProtectClose control gapsControls mapped to ISO 27001
  6. AuditHost the IT auditControlled evidence sharing
Controls

Pre-mapped control library

Requirements with owners, test steps and the crosswalk to 50+ frameworks.

Explore →Evidence

Secure evidence vault

Evidence linked to controls and findings, with upload, review and approval history.

Explore →Risk

Risk register

Risk assessment and treatment, with decisions traced to the controls they drive.

Explore →Findings

CAPA remediation

Findings from internal and external audits tracked to closure with due dates.

Explore →
Without one systemWith QULDEX
Downtime counted after the factAvailability tracked per critical system
One-hour deadline missed in a crisisTimers from the first log entry
Guidelines and notices tracked separatelyOne map of both
Vendor checks scatteredOne outsourcing register
10+years of audit delivery500+audits deliveredBoth sidesof the audit on one platformRBACand a full audit trail on every action
FAQ

MAS TRM questions people ask

What are the MAS TRM Guidelines?

Guidance from the Monetary Authority of Singapore on managing technology risk, revised in January 2021. They cover governance, development, operations, resilience, access, cyber security, testing, online services and IT audit.

Are the MAS TRM Guidelines mandatory?

The guidelines set supervisory expectations; MAS considers how institutions follow them. The Notices on Technology Risk Management and on Cyber Hygiene are legally binding.

How fast must incidents be reported to MAS?

Within one hour of discovering a relevant incident, followed by a root-cause and impact report within the required period.

What does the MAS cyber hygiene notice require?

Six measures: securing administrative accounts, applying security patches, maintaining security standards, network perimeter defence, malware protection and multi-factor authentication.

What are the MAS availability limits?

Critical systems must not be unavailable for more than four hours in any 12-month period under the Notice on Technology Risk Management, with recovery-time targets for disruptions.

From the QULDEX blog

Go deeper on MAS TRM

blog.quldex.com

NIST & CIS topic hub

NIST CSF, 800-53 and CIS Controls articles.

blog.quldex.com

Audit evidence naming convention

A file-naming scheme auditors can follow.

blog.quldex.com

Audit sampling size for compliance

How many samples auditors look at.

Essential EightAustralian baselineDORAEU financial resilienceISO 27001Information securityISO 22301Business continuityNIST CSF 2.0Cybersecurity frameworkSOC 2Trust services criteria
Sources

References

  1. MAS Technology Risk Management Guidelines, January 2021. mas.gov.sg
  2. MAS Notices on Technology Risk Management. mas.gov.sg
  3. MAS Notices on Cyber Hygiene. mas.gov.sg
  4. Tripwire, MAS compliance key regulations. tripwire.com

Reviewed by

Swati Chaturvedi

Framework reviewer · QULDEX

Reviewed this page against the MAS TRM Guidelines (2021) and the Notices on Technology Risk Management and Cyber Hygiene.

Page history
  • : Page first built: guideline and notice explorer, availability and reporting rules, readiness check

Prove your one-hour reporting and availability

Answer a short readiness check and get a gap summary by area. No sales call needed to see the result.

Check your MAS TRM readinessBook a walkthrough
Schedule
Book a Demo