---
title: "MAS Technology Risk Management Guidelines — KYE Protocol™ coverage"
description: "MAS Technology Risk Management Guidelines coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it."
url: https://kyeprotocol.com/compliance/mas-trm/
lang: en
source: "KYE Protocol"
---

> MAS Technology Risk Management Guidelines coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.

MAS Technology Risk Management Guidelines

# MAS Technology Risk Management Guidelines — 88% of in-scope requirements covered.

4 requirements · 4 in scope (3 enforced · 1 designed). The 88% is weighted over the in-scope base.

**Source:** Monetary Authority of Singapore, Technology Risk Management Guidelines (January 2021) — access control, audit logging, IT incident management, and third-party risk for financial institutions.

## By category

| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
| --- | --- | --- | --- | --- | --- | --- |
| Access control | 1 | 1 | 0 | 0 | 0 | **100%** |
| Audit logging & retention | 1 | 1 | 0 | 0 | 0 | **100%** |
| IT incident management | 1 | 0 | 1 | 0 | 0 | **50%** |
| Third-party risk management | 1 | 1 | 0 | 0 | 0 | **100%** |

## Every requirement → the KYE™ artefact that enforces it

| ID | Title | Status | KYE™ enforcement |
| --- | --- | --- | --- |
| `mas-trm.access-control` | MAS TRM Guidelines — strong access controls, including least-privilege and just-in-time privileged access for systems handling financial data | enforced | **audit\_events**: `kye.purpose.admissibility.v1`, `kye.risk.authority_register.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `mas-trm.audit-logging` | MAS TRM Guidelines — comprehensive, tamper-resistant audit logging of system and security events with adequate retention | enforced | **audit\_events**: `kye.evidence.pack.v1`, `kye.replay.context_seal.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md`, `constitution/35-STREAMING-LOGS.md` |
| `mas-trm.incident-management` | MAS TRM Guidelines — IT incident management, including timely detection, escalation and notification to MAS of relevant incidents | designed | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.compliance.attestation.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `mas-trm.third-party-risk` | MAS TRM Guidelines — manage technology risk arising from third-party service providers across the lifecycle of the arrangement | enforced | **audit\_events**: `kye.risk.authority_register.v1`, `kye.risk_assessment.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |

Canonical KYE™ surfaces referenced on this page: [KYE Protocol™](https://kyeprotocol.com/).