Financial institutions need reliable IT, protected information and tested recovery—backed by clear evidence. Entrust Network Services brings together ITSM, cybersecurity and compliance support to strengthen daily operations, controls and oversight.
Connect service delivery to business risk
ITSM gives recurring work a consistent structure. Requests are authorized, incidents are prioritized, changes are assessed, and recurring problems are investigated.
For a financial institution, those processes should reflect business impact. A failed trading connection, a suspicious mailbox rule and a printer fault require different responses.
| Service area | Practical support | Evidence for the client |
|---|---|---|
| Helpdesk and incident management | Record issues, assess impact, escalate and coordinate restoration. | Incident records, timelines and closure reviews. |
| Access management | Process approved account changes, remove access and support access reviews. | Approvals, removal records and review results. |
| Endpoint and network security | Maintain agreed protections, configurations and device coverage. | Coverage reports, configuration records and exceptions. |
| Patch and vulnerability management | Prioritise exposure, coordinate remediation and verify completion. | Findings, patch results and outstanding-risk records. |
| Change management | Assess impact, obtain approval, test changes and prepare recovery steps. | Change requests, test evidence and implementation results. |
| Backup and recovery | Monitor jobs, investigate failures and perform agreed restoration tests. | Backup records, recovery results and corrective actions. |
| Monitoring and reporting | Review agreed alerts and service indicators, then escalate exceptions. | Alert records, service reports and action trackers. |
Establish and Maintain IT Governance and Operational Documentation
A practical documentation framework links requirements to action and evidence.
| Document type | Purpose | Example |
|---|---|---|
| Policy | Sets management requirements, responsibilities and expectations. | IT Security Policy. |
| Standard | Defines specific control settings or minimum requirements. | Server hardening standard. |
| Plan | Coordinates people, decisions and resources during an event. | Incident Response Plan. |
| SOP or runbook | Explains how to perform a repeatable task. | Compromised-account containment procedure. |
| Register | Tracks assets, risks, events, exceptions or obligations over time. | IT Risk Register. |
| Assessment or report | Records scope, findings, results and conclusions. | Recovery exercise report. |
| Supporting record | Demonstrates that an activity occurred. | Approval, ticket, log or test result. |
Establish a Risk-Based IT Policy Framework
A practical policy framework could cover:
| No. | Policy Area | Main Coverage |
|---|---|---|
| 1 | IT Security Governance | Responsibilities, access control, authentication, device security and network protection. |
| 2 | Acceptable Use | Staff use of systems, email, internet and approved tools. |
| 3 | Data Protection and Classification | Information handling, sharing, encryption, retention and disposal. |
| 4 | Technology Risk Management | Risk assessment, treatment, acceptance and reporting. |
| 5 | Patch and Vulnerability Management | Prioritisation, remediation and exception management. |
| 6 | Change Management | Change assessment, approval, testing and recovery arrangements. |
| 7 | Logging and Monitoring | Logging coverage, review, escalation and retention. |
| 8 | Incident Response | Incident classification, escalation, investigation and communications. |
| 9 | Backup, Disaster Recovery and Business Continuity | Recovery objectives, backup arrangements, continuity planning and testing. |
| 10 | Vendor and Outsourcing Risk | Risk assessment, oversight, contractual controls and exit arrangements. |
For a smaller institution, access control, authentication, endpoint security and network security can be sections of a master IT Security Policy, supported by technical standards.
This is a suggested organizing structure rather than a MAS-prescribed set of ten policy titles.
Each document should have an owner, approver, version, review date and defined scope. Review should also follow significant changes, incidents and exercise findings.
Establish and Maintain Operational Plans and Standard Operating Procedures
The core plans should explain how the institution will respond to disruption:
| Document | Main coverage |
|---|---|
| Incident Response Plan | Activation criteria, authority, containment, evidence preservation, communications and reporting. |
| Disaster Recovery Plan | System dependencies, restoration order, recovery objectives and validation. |
| Business Continuity Plan | Priority services, people, workarounds, alternative arrangements and external dependencies. |
Business continuity extends beyond IT recovery. A restored application is useful only if the business can resume the service that depends on it. MAS’s BCM Guidelines take this service-centered approach.
Supporting SOPs should cover recurring tasks such as:
| SOP or procedure | Main coverage |
|---|---|
| User onboarding, changes and offboarding | Account approval, access assignment, changes and timely removal. |
| Account approval, access assignment, changes and timely removal. | Administrative access approval, use, review and revocation. |
| Patch deployment | Assessment, testing, approval, installation and verification. |
| Vulnerability management | Finding validation, prioritisation, remediation and closure. |
| Change implementation | Approval, implementation steps, validation and rollback. |
| Backup monitoring and restoration | Job checks, failure handling, restoration and integrity verification. |
| Security alert and incident handling | Triage, escalation, containment and evidence preservation. |
| Secure disposal | Data sanitisation, equipment disposal and supporting records. |
| Supplier escalation | Contacts, escalation routes, responsibilities and follow-up. |
An effective SOP states its trigger, responsible person, required approval, steps, evidence and exception route. Engineers should be able to follow it during a real event.
Use registers to keep issues visible
Recommended MAS TRM Registers
The following is a practical register framework for Entrust to maintain on behalf of MAS-regulated clients within the agreed service scope. Clients retain responsibility for oversight, approvals and risk decisions.
| No. | Register | Purpose |
|---|---|---|
| 1 | IT Asset Register | Maintain an inventory of servers, computers, network equipment, applications and systems, including ownership, support status and criticality. |
| 2 | IT Risk Register | Record technology risks, risk ratings, mitigation actions, owners, target dates and risk acceptance decisions. |
| 3 | User Access Register | Track user accounts, privileged access, approvals and periodic access reviews. |
| 4 | IT Incident Register | Record IT and cybersecurity incidents, business impact, investigations, corrective actions and closure. |
| 5 | Vulnerability Register | Track vulnerabilities, severity, affected assets, remediation owners, deadlines and closure status. |
| 6 | Patch Management Register | Monitor security patches, firmware updates, deployment results and outstanding updates or exceptions. |
| 7 | Change Management Register | Record IT infrastructure and security configuration changes, risk assessments, approvals, implementation and recovery arrangements. |
| 8 | Backup and Restoration Register | Record backup status, failures, corrective actions, restoration tests and results. |
| 9 | BCP/DR Exercise Register | Track business continuity and disaster recovery exercises, participants, test results and improvement actions. |
| 10 | Vendor and Third-Party Register | Maintain details of IT service providers, outsourced services, risk assessments, contracts and service dependencies. |
Registers should be updated as activities occur. They may be maintained in service management systems or other controlled records rather than separate spreadsheets.
This framework is a practical recommendation. It does not imply that MAS universally requires ten separate registers with these exact titles.
Supplier records should support oversight throughout the relationship. MAS distinguishes bank and non-bank outsourcing frameworks, so the applicable requirements and guidance need to be selected carefully.
IT Security Assessment and Compliance Reports
The following reports provide a recommended framework for documenting security assessments, control reviews, and recovery testing.
| No. | Report | Purpose |
|---|---|---|
| 1 | Microsoft 365 Security Assessment | Assess Microsoft 365 security configurations, identity protection, access controls and data protection settings. |
| 2 | Firewall Security Assessment | Review firewall rules, configurations, remote access controls and logging to identify security weaknesses. |
| 3 | Endpoint Security Assessment | Assess device protection, security configurations, encryption and endpoint security coverage. |
| 4 | Network and Wireless Security Assessment | Review network architecture, segmentation, wireless security and access controls. |
| 5 | Patch Management Assessment | Evaluate patch coverage, deployment effectiveness, outstanding updates and exceptions. |
| 6 | Vulnerability Assessment and Penetration Testing (VAPT) | Identify vulnerabilities, assess exploitability within the agreed testing scope and recommend remediation. |
| 7 | Backup Restoration Test | Verify that backed-up data can be restored and assess data integrity and recovery performance. |
| 8 | Business Continuity and Disaster Recovery Test | Evaluate continuity and recovery arrangements, validate recovery objectives and identify improvement actions. |
| 9 | User Access Review | Verify that user and privileged access remain appropriate, authorised and aligned with job responsibilities. |
| 10 | IT Risk Assessment | Document technology risks, existing controls, risk ratings, treatment actions and accountable owners. |
FSM-N21 mandates recovery-testing validation and documentation at least every 12 months for applicable critical systems. Separately, the TRM Guidelines set supervisory expectations for annual or major-change penetration testing of internet-accessible systems, regular cyber exercises and annual security awareness training. Not every drill must occur annually; findings should have owners, deadlines and verified closure.
Strengthen Your Technology Risk Management with Entrust Network
Effective technology risk management requires clear accountability, consistent controls, and tested recovery capabilities.
Entrust Network Services helps financial institutions assess their IT environment, address security and documentation gaps, and strengthen daily operations through managed IT services, cybersecurity and compliance support. Your institution retains oversight of regulatory obligations, policy approvals and risk decisions.
Contact Entrust Network Services to discuss your MAS TRM support needs and develop a practical roadmap for improvement.
Previously in Part 1: MAS TRM Requirements Explained: A Guide for Financial Institutions in Singapore
Author
Jamson Lim
IT Director, Data Protection Officer (DPO) and Cybersecurity Consultant
Jamson Lim is an IT and cybersecurity professional with more than 20 years of experience in cloud security, data protection, secure infrastructure, cybersecurity governance, and compliance advisory.
He holds a Master of Computing from the National University of Singapore (NUS) and an Advanced Diploma in Data Protection from Singapore Management University (SMU). He is certified as a Certified Ethical Hacker (CEH) and Certified Linux Systems Engineer (CLSE).
He holds a Master of Computing from the National University of Singapore (NUS) and an Advanced Diploma in Data Protection from Singapore Management University (SMU). He is certified as a Certified Ethical Hacker (CEH) and Certified Linux Systems Engineer (CLSE).
