The Notice on Cyber Hygiene sets out the measures that financial institutions must take to mitigate the growing risk of cyber threats.

The Notice will make compulsory key elements in the existing MAS Technology Risk Management (TRM) GuidelinesThe TRM Guidelines are a set of best practices that provide financial institutions with guidance on the oversight of technology risk management, security practices and controls to address technology risks. MAS expects financial institutions to observe the guidelines as this will be taken into account in MAS’ risk assessment of the financial institutions. . Specifically, it is mandatory for financial institutions to comply with the following requirements:

establish and implement robust security for IT systems;
ensure updates are applied to address system security flaws in a timely manner;
deploy security devices to restrict unauthorised network traffic;
implement measures to mitigate the risk of malware infection;
secure the use of system accounts with special privileges to prevent unauthorised access; and
strengthen user authentication for critical systems as well as systems used to access customer information.

Financial institutions have 12 months to put these measures in place before the requirements come into effect on 6 August 2020. Mr Tan Yeow Seng, Chief Cyber Security Officer, MAS, said, “Cyber threats in the financial sector are growing as a result of an increased digital footprint and pervasive use of the Internet. The financial sector needs to remain vigilant and ensure that defences are able to counter varied and evolving threats. Good cyber hygiene can go a long way in protecting financial institutions from common types of cyber incursions. These fundamental and essential measures can be implemented by all financial institutions regardless of size or system complexity.”

MAS had sought feedback from the public in September 2018 on the proposal to make this suite of cyber security measures into legally binding requirements. Financial institutions generally welcomed these measures and provided some suggestions regarding implementation of the requirements. These include:

a) focusing on strengthening user access to systems that store or access customer data; and

b) allowing more timeThe additional six months will apply from 6 August 2020 that was set out in Para 3, if a financial institution implements measures to reduce the risks in the interim. for financial institutions to design, acquire and integrate robust user authentication technology into their critical systems.

5 MAS has taken the industry’s feedback into consideration when finalising the Notice.