MAS Technology Risk Management Guidelines
Technology risk governance, security, resilience and third-party expectations for financial institutions.
- Issued by
- Monetary Authority of Singapore
- Applies in
- Singapore
- Edition
- January 2021
- Area
- Operational resilience & ICT
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- GOVTechnology risk governance and oversightGovernance
- SDLCSecure system development and changeOperations
- ACCAccess control and privileged accessSecurity
- RESSystem resilience and recoveryContinuity
- 3PThird-party and cloud riskThird parties
How Amoreg keeps you on it.
Enable the MAS Technology Risk Management Guidelines and add Monetary Authority of Singapore’s pages as a monitor of your own. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 5 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read Monetary Authority of Singapore’s pages
- Check the library against 5 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: technology risk governance and oversight
- Rule
- MAS Technology Risk Management Guidelines, GOV
- Area
- Governance
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- DORA — Digital Operational Resilience ActICT risk management, incident reporting, resilience testing and third-party risk for financial entities.European Union · 8 controls
- NIS2 DirectiveCybersecurity risk-management measures and incident reporting for essential and important entities.European Union · 4 controls
- UK Operational Resilience (FCA SYSC 15A / PRA SS1/21)Important business services, impact tolerances, mapping and scenario testing.United Kingdom · 5 controls
- UK Outsourcing & Third-Party Risk (SYSC 8 / PRA SS2/21)Requirements for outsourcing and third-party arrangements, including critical third parties.United Kingdom · 5 controls
- CSSF Circular 20/750 — ICT and security risk managementEBA ICT and security risk guidelines applied to Luxembourg entities outside DORA's scope.Luxembourg · 5 controls
- CSSF Circular 22/806 — Outsourcing arrangementsThe single outsourcing framework, now applying to DORA entities for business process outsourcing only.Luxembourg · 5 controls
Also in Singapore
- MAS AML/CFT Notices (626 / SFA04-N02)MAS Notice 626 for banks and Notice SFA04-N02 for capital markets intermediaries, with their guidelines.Singapore · 8 controls
- Singapore Personal Data Protection Act 2012Consent, purpose limitation, notification and the mandatory data breach notification regime.Singapore · 5 controls
Questions
Does Amoreg watch for changes to the MAS Technology Risk Management Guidelines?
Enable it and add the issuer’s pages as a monitor of your own. Every publication the Monitor records keeps its source, stage and date.
Can Amoreg check our policies against the MAS Technology Risk Management Guidelines?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records January 2021. Editions were last verified in August 2026, and the Monitor records new publications as they appear.