MAS Technology Risk Management (TRM) Guide (2026): Guidelines, Notices and Cyber Hygiene

Who it applies to

• The TRM Guidelines apply to a wide range of institutions, including banks, merchant banks, insurers and reinsurers, insurance brokers, capital markets intermediaries, fund managers, exchanges and clearing houses, payment institutions, trust companies and financial advisers (MAS).
• The TRM Notices are issued per sector. FSM-N05 covers banks, and other Notices cover insurers, card issuers, finance companies, merchant banks, payment system operators and digital payment token service providers, credit bureaus, insurance brokers, capital markets institutions, financial advisers and trust companies (MAS FAQ). For example, FSM-N21 covers capital markets institutions and took effect on 10 May 2024 (MAS).
• Notice FSM-N06 (Cyber Hygiene) applies to banks in Singapore and took effect on 10 May 2024 (MAS).
• Proportionality. Implementation should be "commensurate with the level of risk and complexity" of the institution's services (MAS TRM Guidelines).

Key requirements

TRM Guidelines (best practice, supervised)

The 2021 Guidelines are organised into chapters (MAS TRM Guidelines):

• Governance and oversight. The board and senior management must ensure effective internal controls. The board needs members with enough technology knowledge, and there must be a technology risk management function that gives an independent view.
• Technology risk management framework. Asset management, risk identification, assessment and treatment, and the management of third-party services.
• Secure software development and acquisition. Vendor due diligence, source code review, application security testing, DevSecOps, API security, and end-user computing.
• IT service management. Configuration, patching, change and incident management, including trend analysis of past incidents.
• IT resilience. System availability, RTOs and RPOs aligned to recovery priorities, regular disaster recovery testing, and periodically operating from alternate sites.
• Access control. Need-to-use privileged access, with service providers subject to the same monitoring as staff.
• Cryptography, data and infrastructure security. This includes deleting data irrevocably before disposal, and network security devices.
• Cyber resilience. Cyber intelligence monitoring, information sharing, and detecting misinformation about the institution.
• Cyber security assessment.
• vulnerability assessments, at a frequency matched to criticality
• penetration tests, combining black-box and grey-box testing for online services
• cyber exercises
• adversarial attack simulation exercises (red teaming)
• intelligence-based scenario design
• Online financial services and IT audit. IT audit gives the board an independent and objective opinion.

TRM Notices (legally binding)

According to the MAS FAQ (MAS FAQ):

• Critical systems. You must keep a framework for identifying critical systems, such as ATMs, online banking and payment systems. MAS may request this framework but doesn't need to approve it.
• Availability. Maximum unscheduled downtime for each critical system is 4 hours within any 12-month period, including partial or intermittent disruption.
• Recovery. Each critical system needs an RTO of no more than 4 hours, validated by testing once every 12 months.
• Incident notification. Notify MAS within 1 hour of discovering a system malfunction or IT security incident with "severe and widespread impact" on operations or a material impact on customers.
• Root-cause report. Due within 14 days. MAS may grant an extension.

Cyber hygiene (FSM-N06, banks)

Banks must (MAS):

• secure administrative accounts
• apply security patches within risk-based timeframes, or use compensating controls
• keep written security standards for every system
• control traffic at the network perimeter
• deploy malware protection
• enforce multi-factor authentication on critical-system admin accounts and on internet-facing access to customer information

Certification process and timeline

There is no MAS TRM certification. Compliance is assessed through MAS supervision, inspections and incident reporting. MAS can ask for your critical-systems documentation, downtime records and recovery test results during ongoing supervision (MAS FAQ).

Recent and upcoming changes:

• 10 May 2024: the FSMA-based TRM and Cyber Hygiene Notices took effect, and the older notices were cancelled (MAS; MAS).
• June 2026: MAS proposed TRM Notice amendments covering:
• IT asset management
• IT risk assessment and monitoring
• capacity planning
• change management
• continuous monitoring
• immutable and offline backups
• incident management

The amendments would take effect 12 months after the final Notice is published (MAS CP P012-2026).

• 7 October 2026: MAS published its response on the AI Risk Management Guidelines, which apply to all financial institutions (MAS).

Penalties

Under FSMA section 29(2), failing to comply with a technology risk direction or regulation is an offence. The fine is up to S$1 million, plus up to S$100,000 for every day the offence continues after conviction (FSMA 2022).

Mapping to related frameworks

• ISO 27001 and NIST CSF: these cover governance, access, cryptography and monitoring.
• ISO 22301: supports the IT resilience and disaster recovery expectations.
• DORA and APRA CPS 234: comparable regulatory regimes for financial services.
• Singapore PDPA: applies alongside TRM for personal data.
• MAS AI Risk Management Guidelines: extend governance to AI use (MAS).

Readiness checklist

1. Confirm which TRM Notice applies to your licence type.
2. Document your critical-system identification framework and system list.
3. Set RTOs of 4 hours or less for critical systems, and test recovery every year.
4. Track unscheduled downtime on a rolling 12-month basis.
5. Build a 1-hour MAS notification path, and a 14-day template for root-cause reports.
6. For banks, map controls to the six FSM-N06 cyber hygiene areas, including MFA.
7. Run vulnerability assessments, penetration tests and red-team exercises in proportion to your risk.
8. Report technology risk to the board regularly, and keep IT audit coverage in place.
9. Track the outcome of P012-2026 and plan for the 12-month runway.

Common pitfalls

• Treating the Guidelines as optional. MAS considers how closely you observe them during supervision.
• Starting the RTO clock at discovery. The RTO runs from the point of disruption, not discovery.
• Leaving out partial outages from downtime calculations.
• Missing MFA on internet-facing access to customer information.
• Weak oversight of service providers' privileged access.

How AssureCore helps

• The Controls Register and Cross-framework Mapping align MAS TRM with ISO 27001.
• The Risk Register records technology risks.
• Evidence Management, with expiry alerts, tracks DR tests and access reviews.
• Audit Reports support supervisory requests.

Frequently asked questions

Official references

• MAS – Guidelines on Risk Management Practices: Technology Risk
• MAS – Technology Risk Management Guidelines (January 2021, PDF)
• MAS – FAQs on Notice on Technology Risk Management (PDF)
• MAS – Notice FSM-N06 Cyber Hygiene
• MAS – Notice FSM-N21 Technology Risk Management
• Singapore Statutes Online – Financial Services and Markets Act 2022, section 29
• MAS – Consultation Paper P012-2026 on amendments to TRM Notices (PDF)
• MAS – Consultation on Guidelines on AI Risk Management

Related frameworks

• PCI DSS guide
• SOX IT guide
• ICIF guide
• DORA guide