MAS Technology Risk Management for Small FA and Fund Firms

Which MAS technology rules apply to your firm

MAS issues binding Notices per type of financial institution, and non-binding Guidelines that apply across the sector. For small advisory and fund firms, the relevant ones are:

These Notices replaced older ones, such as FAA-N18 and CMG-N02, which MAS cancelled with effect from 10 May 2024. The TRM Guidelines say the degree to which a firm implements them should be commensurate with the risk and complexity of its services, so a 20-person firm is not expected to run a bank-scale security operation.

The TRM Notice: critical systems, downtime and 1-hour reporting

The TRM Notice for financial advisers (FSM-N23) is short and specific. A licensee must:

• Have a framework and process to identify critical systems: systems whose failure would significantly disrupt operations or materially affect customer service.
• Keep unscheduled downtime for each critical system to no more than 4 hours in any 12 months.
• Set a recovery time objective (RTO) of 4 hours or less for each critical system, and validate and document recovery testing at least once every 12 months.
• Notify MAS as soon as possible, and no later than 1 hour, after discovering a relevant incident (a system malfunction or IT security incident with severe and widespread impact, or material impact on customer service).
• Submit a root cause and impact analysis report within 14 days.
• Implement IT controls to protect customer information from unauthorised access or disclosure.

The Cyber Hygiene Notice: six mandatory controls

The Cyber Hygiene Notice for financial advisers (FSM-N24) sets six controls. The capital markets version, FSM-N22, has the same structure. Here is what each means in a typical Microsoft 365 or Google Workspace firm.

If a system cannot meet a requirement, the Notice says you must put other controls in place to reduce the risk, and the same applies where a third-party system provider runs it on your behalf.

TRM Guidelines: what a small firm should also do

The Guidelines are not binding like the Notices, but MAS considers how well firms observe their spirit during supervision. The parts that matter most for a small firm:

For a plain-English view of vulnerability assessments and pentests, see our VA vs penetration test guide.

Meeting the requirements on Microsoft 365 or Google Workspace

Most small firms can meet the Cyber Hygiene controls with the tools they already pay for, if they are configured properly.

1. 1

   Enforce MFA for every account

   Use Conditional Access on Microsoft 365 Business Premium, or enforce 2-Step Verification in Google Workspace.

2. 2

   Separate and limit admin accounts

   Two to four named admins with dedicated admin accounts and phishing-resistant MFA.

3. 3

   Manage and patch every device

   Enrol laptops and phones in Intune or Google endpoint management, require encryption and screen locks, and enforce updates.

4. 4

   Deploy endpoint protection

   Business Premium includes Defender for Business. Check every device reports in.

5. 5

   Write the security standards

   Two to four pages: device baseline, account rules, sharing settings, firewall rules. Review yearly.

6. 6

   Plan for incidents and recovery

   Back up email and files, list critical systems and their RTO, and write the 1-hour notification procedure. Test it once a year.

Our Microsoft 365 security checklist covers the detailed settings, and our ransomware response guide covers the first hours of an incident.

The 2026 consultation on amended TRM Notices

On 10 June 2026 MAS published consultation paper P012-2026, proposing to amend 11 TRM Notices, including FSM-N21 and FSM-N23. The proposals include a full IT asset inventory, risk registers, stronger change management and monitoring, and immutable or offline backups of critical data. The consultation closed on 31 July 2026, and MAS proposed the changes take effect 12 months after the final Notice is published.

As of 18 October 2026 we found no final amended Notice on the MAS website. Our summary of the MAS TRM Notice consultation has the details. Starting an asset list and offline backups now costs little and will help whatever the final text says.

Do it yourself or get help?

A small firm's compliance officer can own the policies and the incident procedure. The technical controls, such as MFA enforcement, device management and endpoint protection, usually need someone who configures Microsoft 365 or Google regularly. CSA's Cyber Essentials mark is a useful way to show the basics are in place.

We can start with a Security Health Check (S$290) against these requirements, configure the controls with a Microsoft 365 / Google Security Lockdown (S$590), and write your 1-hour incident procedure as an Incident & Ransomware Response Plan (S$390). We are an IT provider, not a compliance consultant, so confirm your regulatory position with your compliance adviser.