SingaporeMAS Notice FSM-N06, Cyber Hygiene Requirements for Banks
Monetary Authority of Singapore Notice FSM-N06 on Cyber Hygiene issued under section 29(1) of the Financial Services and Markets Act 2022, paras. 4.1 to 4.6
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- Applies to every bank in Singapore, that is a locally incorporated or branch full bank or wholesale bank; reached by declaring that you are a bank.
- Secure every administrative account on an operating system, database, application, security appliance or network device to prevent unauthorised access or use (paragraph 4.1).
- Apply security patches to every system within a timeframe commensurate with the risk of each vulnerability, and where no patch exists put controls in place to reduce the risk (paragraph 4.2).
- Keep a written set of security standards for every system, make each system conform to it or add risk-reducing controls, restrict unauthorised network traffic at the network perimeter, and run malware protection on every system where it is available (paragraphs 4.3 to 4.5).
- Implement multi-factor authentication for administrative accounts on critical systems and for all accounts on any system used to access customer information through the internet (paragraph 4.6).
- You need not comply to the extent you cannot control a system directly or indirectly through its provider and it is not reasonable to switch to a provider you could control (paragraph 3.1).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Monetary Authority of Singapore, which issues the Notice and supervises banks.
Settledness
- As of
- Open questions
- What penalty does the Financial Services and Markets Act 2022 attach to contravening a notice issued under section 29(1), a provision not read for this row?
What this law does
Paragraph 4.1 of the Notice requires a bank to secure every administrative account on any operating system, database, application, security appliance or network device against unauthorised access or use. Paragraph 4.2(a) requires a bank to apply security patches to every system within a timeframe commensurate with the risk each vulnerability poses.
Paragraph 4.6 requires a bank to implement multi-factor authentication for administrative accounts on critical systems and for all accounts on any system it uses to access customer information through the internet. The Notice is issued under section 29(1) of the Financial Services and Markets Act 2022 and applies to all banks in Singapore. The Notice takes effect on .
When LexLint raises it
When your app profile says your app is a bank.