MAS revises tech risk management guidelines amid growing cyberthreats

THE Monetary Authority of Singapore (MAS) on Monday issued revised technology risk management guidelines amid "clear indication" of a worsening cyberthreat environment.

This comes after the recent spate of cyberattacks on supply chains, which targeted multiple IT service providers through the exploitation of widely-used network management software, said the regulator in a statement.

MAS said the revised guidelines focus on addressing technology and cyber risks in an environment of growing use by financial institutions (FIs) of cloud technologies, application programming interfaces and rapid software development.

The guidelines outlined enhanced risk mitigation strategies for FIs, that is, to establish a robust process for the timely analysis and sharing of cyberthreat intelligence within the financial ecosystem; and to conduct cyber exercises to allow FIs to stress test their cyber defences by simulating the attack tactics, techniques and procedures used by real-world attackers.

MAS also said that in light of FIs' growing reliance on third-party service providers, the guidelines set out the expectation for FIs to exercise strong oversight of arrangements with third-party service providers, to ensure system resilience as well as maintain data confidentiality.

Additional guidance on the roles and responsibilities of the board of directors and senior management are also included in the new guidelines.

GET BT IN YOUR INBOX DAILY

Start and end each day with the latest news stories and analyses delivered straight to your inbox.

Sign UpVIEW ALL

The board and senior management should ensure that a chief information officer and a chief information security officer, with the requisite experience and expertise, are appointed and accountable for managing technology and cyber risks. The board should also include members with the relevant knowledge to provide effective oversight of technology and cyber risks, said MAS.

The revised guidelines had incorporated feedback received from a public consultation conducted in 2019, MAS's engagement with the industry and MAS's cybersecurity advisory panel.

Tan Yeow Seng, MAS chief cyber security officer, said: "Technology now underpins most aspects of financial services. Not only are financial institutions adopting new technologies, they are also increasingly reliant on third-party service providers. The revised guidelines set out MAS's higher expectations in the areas of technology risk governance and security controls in financial institutions."