MAS Technology Risk Management Guidelines
MAS Technology Risk Management Guidelines — 88% of in-scope requirements covered.
4 requirements · 4 in scope (3 enforced · 1 designed). The 88% is weighted over the in-scope base.
Source: Monetary Authority of Singapore, Technology Risk Management Guidelines (January 2021) — access control, audit logging, IT incident management, and third-party risk for financial institutions.
By category
| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
|---|---|---|---|---|---|---|
| Access control | 1 | 1 | 0 | 0 | 0 | 100% |
| Audit logging & retention | 1 | 1 | 0 | 0 | 0 | 100% |
| IT incident management | 1 | 0 | 1 | 0 | 0 | 50% |
| Third-party risk management | 1 | 1 | 0 | 0 | 0 | 100% |
Every requirement → the KYE™ artefact that enforces it
| ID | Title | Status | KYE™ enforcement |
|---|---|---|---|
mas-trm.access-control | MAS TRM Guidelines — strong access controls, including least-privilege and just-in-time privileged access for systems handling financial data | enforced | audit_events: kye.purpose.admissibility.v1, kye.risk.authority_register.v1engines: internal, internalconstitution_refs: constitution/12-PURPOSE-PERMISSION.md |
mas-trm.audit-logging | MAS TRM Guidelines — comprehensive, tamper-resistant audit logging of system and security events with adequate retention | enforced | audit_events: kye.evidence.pack.v1, kye.replay.context_seal.v1engines: internal, internalconstitution_refs: constitution/30-AUDIT-WORM-RETENTION.md, constitution/35-STREAMING-LOGS.md |
mas-trm.incident-management | MAS TRM Guidelines — IT incident management, including timely detection, escalation and notification to MAS of relevant incidents | designed | audit_events: kye.signal.incident.opened.v1, kye.compliance.attestation.v1engines: internal, internalconstitution_refs: constitution/13-RESILIENCE-LOOP.md |
mas-trm.third-party-risk | MAS TRM Guidelines — manage technology risk arising from third-party service providers across the lifecycle of the arrangement | enforced | audit_events: kye.risk.authority_register.v1, kye.risk_assessment.v1engines: internal, internalconstitution_refs: constitution/51-NO-SPOF.md |
Canonical KYE™ surfaces referenced on this page: KYE Protocol™.