MAS Notice on Cyber Hygiene¶
Overview¶
The MAS Cyber Hygiene regime establishes mandatory baseline cyber security requirements for all licensed financial institutions in Singapore. Originally issued in 2019 under sector-specific Notices (Banking Act, Insurance Act, Securities and Futures Act, Payment Services Act), the regime was consolidated and reissued on 10 May 2024 under the Financial Services and Markets Act 2022 (FSM Act) — a single statutory basis with sector-specific Notices (FSM-N06 for banks, FSM-N22 for capital markets FIs, etc.). Unlike the TRM Guidelines which are advisory, the Cyber Hygiene Notices carry the force of law.
Applicable to: All licensed financial institutions, via sector-specific Notices issued under the FSM Act 2022 — banks (FSM-N06), capital markets FIs (FSM-N22; effective 10 May 2024), insurers, finance companies, merchant banks, licensed financial advisers, licensed trust companies, payment service providers, and digital payment token service providers (each with a corresponding FSM-Nxx Notice).
Legal basis: Issued under section 29(1) of the Financial Services and Markets Act 2022.
Effective date: Originally August 2019 under sector-specific Notices; reissued 10 May 2024 under the FSM Act 2022 (FSM-N06, FSM-N22, etc.).
1. Administrative Account Management¶
1.1 Requirements¶
FIs must implement the following controls for administrative accounts:
- Multi-factor authentication (MFA): All administrative accounts for critical systems must be secured with MFA. This includes system administrators, database administrators, and network administrators.
- Separate admin accounts: Administrative functions should be performed using dedicated administrator accounts, separate from accounts used for daily operations (e.g., email, web browsing).
- Privileged Access Management (PAM): Implement PAM solutions to manage, monitor, and audit privileged access to critical systems.
- Account review: Regular review (at least quarterly) of administrative accounts to ensure only authorized personnel retain privileged access.
1.2 Practical Implementation¶
- Just-in-time access provisioning for privileged accounts
- Session recording and monitoring for privileged sessions
- Automatic timeout and session termination for idle privileged sessions
- Immediate revocation of administrative access upon role change or termination
- Password vaults for managing administrative credentials
2. Patch Management¶
2.1 Requirements¶
FIs must maintain a rigorous patch management program:
- Critical patches: Security patches for critical vulnerabilities (CVSS score 7.0 and above) must be applied within one month of release. For internet-facing systems, this timeline should be shortened.
- Regular patches: Non-critical security patches should be applied in a timely manner based on risk assessment.
- Legacy systems: Where patches are unavailable (e.g., end-of-life systems), FIs must implement compensating controls such as network segmentation, enhanced monitoring, and virtual patching.
- Patch testing: Patches should be tested in a non-production environment before deployment to production.
2.2 Patch Management Process¶
- Automated vulnerability scanning to identify missing patches
- Risk-based prioritization of patch deployment
- Defined maintenance windows for patch application
- Rollback procedures in case of patch-related issues
- Documentation and tracking of patch status across all systems
3. Network Security¶
3.1 Requirements¶
FIs must implement robust network security controls:
- Network segmentation: Critical systems and sensitive data should be isolated in separate network segments with controlled access between segments.
- Firewall management: Properly configured firewalls at all network boundaries with documented rule bases reviewed at least annually.
- Intrusion detection/prevention: Deployment of IDS/IPS solutions to detect and prevent malicious network activity.
- Secure remote access: VPN or equivalent secure channels for all remote access to FI networks, with MFA required.
- Wireless security: Wireless networks used for business purposes must implement WPA3 or equivalent encryption, with guest networks segregated from corporate networks.
3.2 Network Monitoring¶
- Real-time monitoring of network traffic for anomalies
- Logging of all network access and traffic at boundaries
- Regular review of network architecture and security controls
- Penetration testing of network defenses at least annually
4. Access Controls¶
4.1 Requirements¶
FIs must enforce comprehensive access control measures:
- Principle of least privilege: Users should be granted only the minimum access necessary to perform their job functions.
- Role-based access control (RBAC): Access rights should be assigned based on defined roles aligned with job responsibilities.
- Access reviews: Regular reviews (at least semi-annually) of user access rights to ensure appropriateness.
- Strong authentication: All users must authenticate using strong passwords or passphrases meeting minimum complexity requirements.
- Account lockout: Automatic account lockout after a defined number of failed authentication attempts.
- Session management: Automatic session timeout after a defined period of inactivity.
4.2 Customer-Facing Systems¶
- MFA required for customer access to internet-facing systems that process financial transactions
- Transaction signing or secondary authorization for high-value transactions
- Device binding or recognition capabilities
- Real-time fraud detection and alerting for suspicious account activity
5. Malware Protection¶
5.1 Requirements¶
FIs must maintain effective malware protection:
- Anti-malware solutions: Deployment of anti-malware software on all endpoints (desktops, laptops, servers) with real-time scanning enabled.
- Signature updates: Anti-malware definitions must be updated at least daily.
- Email security: Email filtering solutions to detect and quarantine malicious attachments and links.
- Web filtering: URL filtering and web proxy solutions to prevent access to known malicious websites.
- Application whitelisting: For critical servers, application whitelisting should be implemented to prevent execution of unauthorized software.
5.2 Advanced Threat Protection¶
- Endpoint Detection and Response (EDR) solutions for advanced threat detection
- Sandboxing for analysis of suspicious files and URLs
- Threat intelligence feeds integrated with security monitoring
- Regular malware simulation exercises to test detection capabilities
6. Security Monitoring and Incident Response¶
6.1 Security Event Monitoring¶
FIs must implement continuous security monitoring:
- Security Information and Event Management (SIEM): Centralized collection, correlation, and analysis of security events from across the IT environment.
- Log management: Collection and retention of security-relevant logs for at least one year, with at least three months readily accessible for analysis.
- Alert triage: Defined processes for investigating and responding to security alerts.
- 24/7 monitoring: Critical systems should be monitored around the clock, either through internal SOC capabilities or managed security services.
6.2 Incident Response¶
FIs must maintain incident response capabilities:
- Incident response plan: Documented plan with defined roles, responsibilities, and procedures for different types of security incidents.
- Incident classification: Framework for classifying incidents by severity and potential impact.
- Escalation procedures: Clear escalation paths from technical response teams to senior management and the board.
- Communication protocols: Pre-defined communication templates and channels for internal and external stakeholders, including MAS notification.
- Forensic capabilities: Ability to preserve evidence and conduct forensic analysis of security incidents.
- Post-incident review: Formal lessons-learned process after significant incidents.
6.3 MAS Incident Reporting¶
Under MAS Notice on Technology Risk Management, FIs must report:
- Reportable incidents: System outages affecting customer services, data breaches involving customer information, cyber attacks with material impact, and significant disruptions to critical business functions.
- Reporting timeline: Initial notification within 1 hour of incident discovery; root cause analysis within 14 calendar days.
- Reporting format: Using the prescribed MAS incident reporting template.
7. Data Protection¶
7.1 Requirements¶
FIs must protect sensitive data:
- Encryption at rest: Sensitive data stored in databases, file systems, and storage devices must be encrypted using industry-standard algorithms (AES-256 or equivalent).
- Encryption in transit: All data transmitted over networks must be encrypted using TLS 1.2 or higher.
- Key management: Cryptographic keys must be securely generated, stored, distributed, and rotated.
- Data masking: Sensitive data should be masked in non-production environments.
- Secure disposal: Data on decommissioned devices and media must be securely erased or destroyed.
7.2 Customer Data Protection¶
- Compliance with Personal Data Protection Act (PDPA)
- Customer consent for data collection and processing
- Data minimization in collection and retention
- Breach notification to affected customers within defined timeframes
- Cross-border data transfer controls
8. Physical Security¶
8.1 Data Centre Security¶
- Physical access controls (biometrics, card access) for data centres and server rooms
- Environmental controls (fire suppression, UPS, cooling)
- Visitor management and escort procedures
- CCTV surveillance with recording retention
- Clean desk and clear screen policies
9. Security Awareness and Training¶
9.1 Requirements¶
FIs must maintain a security awareness program:
- Regular training: All employees must complete cyber security awareness training at least annually.
- Phishing simulations: Regular phishing simulation exercises to test employee vigilance.
- Specialized training: Technical staff involved in security operations should receive specialized training relevant to their roles.
- New hire orientation: Cyber security awareness training should be part of the onboarding process for new employees.
- Contractors and third parties: Personnel with access to FI systems should receive appropriate security awareness training.
10. Compliance and Enforcement¶
10.1 Self-Assessment¶
- FIs should conduct regular self-assessments against the Cyber Hygiene Notice requirements
- Results should be reported to senior management and the board
- Remediation plans for identified gaps with defined timelines
10.2 MAS Supervision¶
- MAS may conduct inspections to assess compliance with the Notice
- Non-compliance may result in supervisory actions, including warnings, restrictions, or penalties
- FIs should maintain evidence of compliance for MAS review
Compliance Relevance for Regnify¶
As a technology platform serving financial institutions, Regnify must support its FI customers' Cyber Hygiene compliance:
- Access controls: Multi-factor authentication, role-based access (5 roles), and session management capabilities align with Section 4 requirements.
- Data encryption: All data in transit (TLS) and at rest must be encrypted, consistent with Section 7.
- Audit logging: Comprehensive audit trails (36 action types) support Section 6 security monitoring requirements.
- Incident response: Platform incident management procedures must meet MAS notification timelines.
- Patch management: Regular security updates to the platform infrastructure per Section 2 requirements.