If your firm holds a capital markets services licence in Singapore, for example as a fund manager, your IT team works under the Monetary Authority of Singapore's (MAS) Technology Risk Management (TRM) Guidelines and two Notices: the Cyber Hygiene Notice and the Notice on Technology Risk Management. This checklist turns them into practical points your IT team, or your IT provider, can work through and tick off.
Every point comes from our full guide, MAS TRM Guidelines and Cyber Hygiene Notice: a guide for IT, which quotes the MAS documents and links to each one. The reference in brackets after each point shows where it comes from.
Before you start: guidelines and notices are different. MAS says Notices impose legally binding requirements, while contravening Guidelines "is not a criminal offence", although MAS considers how well a firm observes them. The capital markets Notices are FSM-N22 (Cyber Hygiene) and FSM-N21 (Technology Risk Management); banks and insurers have their own versions. Check with your compliance team which apply to you.
1. The six cyber hygiene basics (Notice FSM-N22)
- Every administrative account secured against unauthorised use (para 4.1).
- Security patches applied within a timeframe that matches each vulnerability's risk, with other controls where no patch exists (para 4.2).
- A written security standard for every system, for example based on CIS Benchmarks, and checks that systems follow it (para 4.3; FAQ A4).
- Perimeter controls that block all unauthorised network traffic (para 4.4).
- Malware protection on every system where it can be installed (para 4.5).
- Multi-factor sign-in for admin accounts on critical systems and for every account used to reach customer information over the internet (para 4.6).
2. Governance
- A named CIO or Head of IT and a CISO or Head of Information Security, approved at least by the CEO (TRM Guidelines 3.1.3).
- A technology risk appetite approved by the board or its committee (3.1.7), and senior management kept informed of serious technology risks and incidents (3.1.8).
- A current inventory of information assets and a technology risk register (3.3.2, 4.5.2).
- A periodic report to senior management on compliance with the Cyber Hygiene Notice (MAS FAQ A8).
- Security awareness training at least once a year (3.6.2).
3. Changes and old systems
- Every change assessed, tested, reviewed and approved before it goes live, with a rollback plan (7.5.1, 7.5.5), and a defined route for emergency changes (7.5.6).
- No single person able to develop and move code into production alone (7.6.1).
- End-of-support dates tracked, with management sign-off for anything still in use after support ends (7.3.3).
4. Access
- Least privilege, segregation of duties and "never alone" for sensitive work (9.1.1).
- Multi-factor sign-in for users with access to sensitive system functions (9.1.5).
- Regular access reviews, and access removed promptly when people leave or change roles (9.1.6, 9.1.7).
- Privileged access only when needed, with activity logged and reviewed (9.2.1).
- Remote access encrypted, with multi-factor sign-in, and only from secured devices (9.3.1, 9.3.2).
5. Data and infrastructure
- Confidential data on systems and devices encrypted and protected by strong access controls (11.1.3), and unapproved file sharing blocked.
- Networks segmented, with intrusion prevention and regular firewall rule reviews (11.2.2, 11.2.3, 11.2.5); IoT devices on their own segment (11.5.3).
- Endpoint protection and application allow-listing (11.3.3, 11.3.6).
- A list of where encryption keys and certificates are used, with algorithms and expiry dates (10.1.2, 10.2.1).
6. Security monitoring
- Cyber intelligence monitoring (12.1.2) and a security operations centre or a managed security service (12.2.1).
- Logs collected, kept, protected and correlated, with clear alert levels and escalation contacts (12.2.2, 12.2.5, 12.2.6).
7. Incidents and reporting to MAS
- An incident management framework, a communications plan and a cyber incident response plan (7.7.1, 7.7.6, 12.3.1).
- Agreed in advance: who decides that an incident is a "relevant incident", and who calls MAS. Notice FSM-N21 says to notify MAS as soon as possible and not later than 1 hour after discovering one (para 7), with a root cause and impact report within 14 days (para 8).
- The MAS-Tx "Incident Reporting" role set up before you need it. Since 1 February 2026, incident reports go through MAS-Tx: an initial report within 24 hours and a final report within 14 days (incident reporting circular).
8. Resilience and recovery
- A list of critical systems (FSM-N21 para 4), each with a recovery time objective of no more than 4 hours and unplanned downtime of no more than 4 hours in 12 months (paras 5 and 6).
- Recovery tested and documented at least once every 12 months (para 6), and a disaster recovery plan reviewed at least once a year (TRM Guidelines 8.2.2).
- Backups kept offline or off-site, and restores tested, not just the backup jobs (8.4.3, 8.4.4).
9. IT providers and cloud
- Each provider's technology risks assessed before signing (TRM Guidelines 3.4.2).
- Cloud and managed IT services listed in the outsourcing register. MAS treats cloud services as outsourcing (Outsourcing Guidelines, Annex 5); the register goes to MAS at least once a year or on request (4.1.1).
- Contracts that cover security, audit, incident notification and exit (5.5.2), and material arrangements reviewed at least once a year (5.8.2).
10. Testing and audit
- Regular vulnerability assessments (13.1.1).
- A penetration test of internet-facing systems at least once a year and after major changes (13.2.4).
- Cyber exercises and attack simulations (13.3.1, 13.4.1), with findings tracked to closure within set timeframes (13.6.1).
- An independent IT audit (15.1.1).
How to use this checklist
Go through it with the person who runs your IT, mark each point done, partly done or not done, and keep the evidence: access reviews, patch reports, restore tests, training records and the senior management report. For the exact wording and the source documents, see our MAS TRM guide.
How Dual Layer IT can help
We are ISO/IEC 27001:2022 certified, with an office at Raffles Place, and our controls are built on ISO/IEC 27001, NIST CSF and CIS and mapped to MAS guidelines.
- IT compliance audits in Singapore: we go through this checklist with you and list the gaps by priority.
- Cybersecurity in Singapore: hardening, multi-factor sign-in, logging, 24/7 monitoring and incident response plans.
- Managed IT in Singapore: patching, access reviews, backups and restore tests, with records for your auditors.
This checklist summarises MAS publications for information. It is not legal or regulatory advice; read the documents in full and take advice from your compliance team.
