MAS TRMG

Singapore MAS Technology Risk Management Guidelines - governance, risk, security, IT operations.


Region	Asia-Pacific
Country or scope	Singapore
Sector	Finance
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers MAS TRMG

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for MAS TRMG.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for MAS TRMG and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`SG-TRMG-INV` IT Asset Inventory	Financial institutions should maintain an up-to-date inventory of their information system assets throughout the asset life cycle, so all software components must be enumerated (MAS TRMG 2021, IT asset-management expectations)	Scan
`SG-TRMG-OSS` Open-Source and Third-Party Software Risk	Institutions should assess and manage the risks of using third-party and open-source software in their applications, which requires the supplier or origin of each component to be identified (MAS TRMG 2021, software application development and management chapter)	Scan
`SG-TRMG-PATCH` Patch and Vulnerability Management	Institutions should establish processes to identify, categorise and remediate vulnerabilities and apply security patches timely, which requires every component's version to be recorded (MAS TRMG 2021, vulnerability and patch management expectations)	Scan
`SG-TRMG-INTEG` Software Integrity in the Delivery Pipeline	Secure development and deployment practices should verify the integrity and authenticity of software throughout the delivery pipeline, evidenced by cryptographic hashes on components (MAS TRMG 2021, secure software development expectations)	Scan
`SG-TRMG-VA` Cyber Security Assessment Readiness	Institutions should conduct regular vulnerability assessments and penetration tests of their systems, which requires standard component identifiers to correlate findings with known vulnerabilities (MAS TRMG 2021, cyber security assessment chapter)	Scan
`SG-TRMG-EOL` No Unsupported or Indeterminate Software	Institutions should manage the risk of outdated or unsupported systems, which excludes running components at vague or floating version specifications that prevent support-status determination (MAS TRMG 2021, IT asset life-cycle and obsolescence expectations)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`TRMG-4`	Board & Senior Management Oversight
`TRMG-5`	Technology Risk Management Framework
`TRMG-6`	IT Project & Procurement Management
`TRMG-7`	System Reliability & Availability
`TRMG-8`	System Lifecycle Management
`TRMG-9`	Cyber Resilience
`TRMG-10`	Online Financial Services Security
`TRMG-11`	Data Centre Security & Operations
`TRMG-13`	Cryptography Controls

Policy templates

Written for MAS TRMG:

MAS TRMG Technology & Cyber Incident Response Procedure

And 22 from the standard set, adapted to MAS TRMG.