MAS Technology Risk Management: the Guidelines, the Notices and what MAS expects

Guidelines versus Notices: what is binding

MAS revised the TRM Guidelines on 18 January 2021, effective from the date of issue. The Guidelines are non-binding: a failure to follow them is not an offence and carries no civil penalty. MAS has said, however, that the degree of observance is taken into account in its risk assessment of each institution. In practice, supervisors expect the Guidelines to be followed or departures to be justified.

The binding obligations are in the Notices. MAS issues Notices on Technology Risk Management and Notices on Cyber Hygiene for each sector, so the exact Notice depends on how you are licensed. For banks these are Notice FSM-N05 on Technology Risk Management and Notice FSM-N06 on Cyber Hygiene, which replaced MAS Notices 644 and 655 on 10 May 2024. Other sectors have their own FSM-numbered Notices.

TRM Guidelines

Principles and best practices for managing technology and cyber risk. Non-binding, but considered in MAS's supervisory risk assessment.

Notice on Technology Risk Management

Legally binding requirements on critical system availability, recovery and incident notification, issued per sector.

Notice on Cyber Hygiene

Legally binding baseline cyber security practices, issued per sector.

Critical system

A system the institution has identified as critical to its operations or its service to customers. The Notices' availability and recovery limits apply to these systems.

What the TRM Guidelines expect

The Guidelines set out risk management principles and best practices for technology and cyber risk. They are written as principles rather than prescriptions, so institutions can implement them in proportion to their size and risk. MAS strengthened them in 2021 in response to heightened cyber risk.

Read them alongside the Notices. The Guidelines describe how MAS expects technology risk to be governed and managed across the whole lifecycle; the Notices fix the points where MAS sets a hard requirement, such as incident notification, critical system availability and cyber hygiene.

The one-hour incident notification

Under the Notices on Technology Risk Management, an institution must notify MAS as soon as possible, and no later than one hour, after discovering a relevant incident. A relevant incident is a system malfunction or IT security incident that has a severe and widespread impact on the institution's operations or materially affects its service to customers.

The one-hour clock leaves no time to work out the process during the incident. Classification criteria, the person who decides, and the contact route to MAS need to be agreed in advance.

MAS published a consultation in 2026 proposing amendments to the Notices on Technology Risk Management. The proposal keeps the one-hour and 14-day deadlines. Until amendments are issued, the current Notices apply.

Availability and recovery limits for critical systems

The Notices set two hard limits for critical systems. Both are numbers you can test against and show evidence for.

• Unscheduled downtime. No more than four hours of unscheduled downtime for each critical system in any 12-month period.
• Recovery time objective. A recovery time objective of no more than four hours for each critical system.

The cyber hygiene baseline

The Notices on Cyber Hygiene set baseline security practices. For banks this is Notice FSM-N06, which replaced MAS Notice 655 (in force since 6 August 2020) on 10 May 2024. It covers six areas; read the Notice for your sector for the exact wording of each.

• Administrative accounts. Control and secure administrative accounts.
• Security patching. Apply security patches to address vulnerabilities.
• Security standards. Set security standards for systems and keep systems in line with them.
• Network perimeter defence. Defend the network perimeter.
• Malware protection. Protect systems against malware.
• Multi-factor authentication. Use MFA where the Notice requires it.

How MAS TRM relates to ISO 27001 and other frameworks

MAS TRM is a supervisory framework for one regulator's licensees. ISO 27001 is an international management system standard that any organisation can be certified against. We are not aware of an official MAS mapping between the two, so treat any overlap as something to confirm control by control.

Many institutions already run ISO 27001 or SOC 2 controls. Mapping TRM requirements to those controls shows where existing evidence can be reused and where TRM asks for something specific to MAS, such as the one-hour notification, the four-hour limits on critical systems and the cyber hygiene baseline.