What Do You Need to Know about MAS TRM Guidelines?
What Do You Need to Know about MAS TRM Guidelines?
The commercial world constantly upgrades following the rapid advancements in technology. As a matter of fact, to meet the need for digitization, organizations must come up with enough resources to streamline business procedures. However, when businesses do not possess their own IT facilities, they tend to outsource services from external IT companies. Financial institutions are one of the top organizations that require IT outsourcing at present. As IT outsourcing services often carry certain risks, the Monetary Authority of Singapore (MAS) has introduced Technology Risk Management Guidelines (TRM Guidelines) to help financial institutions keep up with cybersecurity best practices and strengthen cybersecurity standards in the financial sector.
The MAS TRM compliance guidelines of 2021 are a revision of the risk management principles and best practices established in the MAS’s 2013 guidelines. This revision was created in response to the financial sector’s rapid digital transformation and to incorporate the most recent developments in technology risk management.
What Do MAS TRM Guidelines Cover?
The current set of TRM guidelines mainly focus on two factors, which are,
- The significance of establishing sound and robust governance in technology risk management.
- Maintaining cyber resilience is a key goal for financial institutions.
These IT compliance guidelines advise that simply overseeing technology risks by boards and senior management is no longer sufficient; actual governance procedures, such as the development of a technology risk management framework, are required to effectively manage technology risk. Therefore, a greater responsibility lies with the board of directors and senior management in establishing and fostering a stronger risk management culture within the institution.
Furthermore, financial institutions must assess and improve their cyber resilience. As institutions rely more on technology for efficiencies and better customer service, they become more vulnerable to technology risks, including cyber risks. According to the Monetary Authority of Singapore, cyber resilience is critical to maintaining trust and confidence in financial services, and institutions must constantly strive to improve their processes and controls to ensure data confidentiality, integrity, and availability.
The Proposed Overarching Guidelines
The TRM guidelines proposed by the MAS to ensure adherence to the security requirements of financial institutions are as below.
- Building a technology risk management strategy.
- Ensuring that the board and senior management (BSM) of financial institutions have members with knowledge to understand and manage technology risks and that they have a technology risk management strategy in place.
- Appointing a Chief Information Officer (CIO) and a Chief Information Security Office (CISO) to establish and implement the overall IT strategy and IT risk management, and the Information Security strategy.
- Strengthening cyber resilience.
Strengthening Cyber Resilience
Cyber resilience is anticipating, withstanding, containing, and rapidly recovering from cyber threats. According to the latest revisions of MAS TRM compliance guidelines, financial institutions are supposed to improve their cyber resilience as follows,
- Manage the external services.
– Assess and manage third-party exposure to technology risks.
– Ensure that third-party vendors have the necessary skills to perform IT functions and manage technology risks.
– Develop criteria and procedures for evaluating and selecting qualified vendors.
– Implement safeguards and checks for all personnel who have access to data and systems in order to reduce the risk of insider threats.
– Evaluate the risks of allowing third-party access to an institution’s application programming interface (API).
- Select a security-by-design approach for IT project management.
– Adopt security-by-design principles and include the IT security function in all stages of the system development life cycle (SDLC) for all IT projects.
– Agile (an incremental approach to software development) should be used throughout the development process.
– Incorporate the SDLC framework and security-by-design principles into DevOps (the combined practice of IT operations and software development) for a combined, security-focused (DevSecOps) approach.
- Involve emerging technologies.
– Create policies and standards for the management of virtualization solutions.
– Institutions should keep a device inventory and put in place appropriate security controls for Internet of Things (IoT) devices.
– To protect customer data, ensure that biometric technologies are encrypted.
To Sum Up
With TRM guidelines being taken into account during MAS risk assessments for financial institutions, it is highly important to maintain compliance. Using IT outsourcing services from a MAS compliance provider can help ensure that all your IT needs are perfectly met.
At NEX CorporateIT, we always strictly adhere to the MAS TRM Guidelines as well as the Outsourcing Guidelines introduced by the Monetary Authority of Singapore (MAS) when providing IT solutions. Furthermore, we annually undergo external audits to fulfill the goals of security monitoring and ensure all vulnerabilities are promptly attended with rectifications or mediation processes.
