MAS enhances Guidelines to combat heightened cyber risks

The Monetary Authority of Singapore (MAS) issued revised Technology Risk Management (TRM) Guidelines in January to keep pace with emerging technologies and shifts in the cyber threat landscape.

The Guidelines are a set of best practices that provide financial institutions (FIs) with guidance on the oversight of technology risk management, practices and controls to address technology and cyber risks. MAS expects FIs to observe the guidelines as this will be considered in MAS’ risk assessment of the FIs.

The move follows a recent spate of cyber attacks on supply chains, which targeted multiple IT service providers through the exploitation of widely used network management software. The revised Guidelines focus on addressing technology and cyber risks in an environment of growing use by FIs of cloud technologies, application programming interfaces and rapid software development.

The revised Guidelines reinforce the importance of incorporating security controls as part of FIs’ technology development and delivery lifecycle, as well as in the deployment of emerging technologies, and set out the following enhanced risk mitigation strategies for FIs to:

• Establish a robust process for the timely analysis and sharing of cyber threat intelligence within the financial ecosystem; and
• Conduct cyber exercises to allow FIs to stress test their cyber defences by simulating the attack tactics, techniques, and procedures used by real-world attackers.

In light of FIs’ growing reliance on third party service providers, the revised Guidelines set out the expectation for FIs to exercise strong oversight of arrangements with third party service providers, to ensure system resilience as well as maintain data confidentiality and integrity.

The revised Guidelines provide additional guidance on the roles and responsibilities of the board of directors and senior management, which include that:

• The board and senior management should ensure that a Chief Information Officer and a Chief Information Security Officer, with the requisite experience and expertise, are appointed and accountable for managing technology and cyber risks; and
• The board should include members with the relevant knowledge to provide effective oversight of technology and cyber risks.

MAS Chief Cyber Security Officer Tan Yeow Seng said: “Technology now underpins most aspects of financial services. Not only are financial institutions adopting new technologies, they are also increasingly reliant on third party service providers. The revised Guidelines set out MAS’ higher expectations in the areas of technology risk governance and security controls in financial institutions.”

The TRM Guidelines apply to all FIs that MAS regulates, ranging from large ones like banks, insurers and exchanges, to small ones like venture capital managers and payments services firms. They should be read in conjunction with the Notice on Technology Risk Management and Notice on Cyber Hygiene.