In this guide · 7 sections
Short answer
MTCS (SS 584) is Singapore's cloud security standard with three levels: Level 1 for public, non-critical data, Level 2 for most business-critical systems, and Level 3 for regulated, high-impact data. Certificates last 3 years with yearly audits; check IMDA's list for the exact service.
What MTCS (SS 584) is
IMDA's cloud computing standards page describes SS 584:2020, the Specification for multi-tiered cloud computing security, as the world's first cloud security standard covering multiple tiers. It was developed under Singapore's Information Technology Standards Committee for cloud service providers, and it specifies three levels of certification for different types of service, such as Infrastructure-as-a-Service.
The point of the tiers is that not every cloud needs bank-grade controls. A provider can certify a service at the level that matches the data its customers put in it, and buyers can match that to their own needs. Microsoft's MTCS compliance page says the standard has 535 controls in total across the three levels.
MTCS Levels 1, 2 and 3 explained
The definitions below are from IMDA's MTCS fact sheet. Level 1 is the base and Level 3 the most stringent.
| Level | Designed for | Typical data | Who should look for it |
|---|---|---|---|
| Level 1 | Non-business-critical data and systems, baseline controls | Website hosting public information | Brochure websites, public content |
| Level 2 | Most organisations running business-critical data and systems | Business and personal information, moderate impact | Most SMEs storing customer or staff data |
| Level 3 | Regulated organisations with specific, more stringent requirements | Highly confidential business data, financial or medical records | Clinics, financial services, firms with regulated clients |
IMDA also notes that industry-specific regulations may apply on top of Level 3 controls. A Level 3 certificate does not on its own make a service compliant with, say, MAS or MOH rules; it shows the provider's controls meet a high bar.
How certification works and where to check it
IMDA's compliance and certification page sets out the scheme. Providers choose an accredited certification body, prepare a self-disclosure form describing the scope, and are audited. Certification is valid for 3 years, with a yearly surveillance audit. IMDA lists only accredited MTCS certificates.
Open IMDA's list of MTCS certified cloud services
It is on the compliance and certification page, split into IaaS/PaaS and SaaS tables.
Find the exact service, not just the company
Certificates cover named services. A provider can be certified for its infrastructure but not for the app you are buying.
Check the level
The certificate file name starts with the level (1, 2 or 3). Match it to the data you will store.
Read the self-disclosure form
It describes what is in scope, where data is hosted and what the customer is responsible for.
Check the dates
Open the certificate and confirm it is still valid. Ask the vendor for the latest surveillance audit if it is near expiry.
When we checked in October 2026, IMDA's list included Level 3 IaaS from providers such as Amazon Web Services, Microsoft Azure, Google Cloud, Alibaba Cloud and Oracle, and Level 3 SaaS such as Google Workspace, Microsoft Dynamics 365, ServiceNow and Box. Microsoft's own page also says Office 365 holds Level 3. If a service is not on IMDA's list, ask the vendor for the accredited certificate directly.
MTCS vs ISO 27001 vs Cyber Trust
These are often mentioned together but answer different questions. MTCS is about the cloud provider's service. ISO 27001 and CSA's Cyber Trust mark are about an organisation's own information security management, which can include yours.
| MTCS (SS 584) | ISO/IEC 27001 | CSA Cyber Trust | |
|---|---|---|---|
| Who gets certified | Cloud service providers, per service | Any organisation | Any organisation, aimed at Singapore businesses |
| What it shows | Cloud security controls at Level 1, 2 or 3 | A working information security management system | Cybersecurity measures matched to the organisation's risk tier |
| Who runs it | IMDA scheme, accredited certification bodies | International standard, accredited certification bodies | CSA, with appointed assessment bodies |
| Use it when | Choosing a cloud, SaaS or hosting provider | Customers or tenders ask for it by name | You want a Singapore-recognised mark sized to your business |
For your own business, the usual path is CSA's Cyber Essentials, then Cyber Trust or ISO 27001. Our ISO 27001 vs Cyber Trust guide explains those, and the Cyber Essentials checklist covers the starting point. CSA's Cyber Trust page has the current documents.
Using MTCS when choosing a cloud vendor
For most small businesses, MTCS is one line in a vendor checklist, not the deciding factor. Use it alongside the other questions that matter.
Cloud vendor questions
Remember that a certified cloud can still be misconfigured by its customer. Weak passwords, no MFA and files shared with 'anyone with the link' are your side of the shared responsibility, whatever the provider's certificate says.
Do it yourself or get help?
Checking a vendor's MTCS status takes ten minutes on IMDA's website. The bigger risk for most small businesses is how their own cloud accounts are set up.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. A Security Health Check (S$290) reviews your domain, email and Microsoft 365 or Google Workspace settings, including MFA, sharing and admin roles, and gives you a ranked fix list. We do not issue certifications or carry out audits; those are done by accredited certification bodies.
Frequently asked questions
MTCS Level 3 is the most stringent of the three levels in Singapore Standard SS 584. IMDA says it is designed for regulated organisations with specific, more stringent security requirements, such as those handling highly confidential business data, financial records or medical records. Industry-specific regulations may still apply on top.
No. MTCS is a voluntary certification scheme run in conjunction with the SS 584 standard. Some buyers, especially government agencies and regulated industries, ask for it in procurement. For a small business, it is a useful signal when choosing a cloud provider rather than a legal requirement.
IMDA publishes a list of MTCS-certified cloud services on its compliance and certification page, split into IaaS, PaaS and SaaS. Each entry shows the service, the MTCS level and certificate, and the provider's self-disclosure form. Only accredited certificates are listed, so check the exact service you plan to use.
IMDA says MTCS certification is valid for 3 years, with a yearly surveillance audit carried out by the accredited certification body to confirm the provider still meets the standard. When you rely on a vendor's certificate, check the dates and ask for evidence of the latest surveillance audit.
Only if you provide cloud services to others, such as a SaaS product or hosting. MTCS certifies cloud service providers. For your own business's security, look at CSA's Cyber Essentials and Cyber Trust marks or ISO 27001, which certify how an organisation manages its own information security.