Meet the MAS Cyber Hygiene Notice with evidence you can show

The MAS Cyber Hygiene Notice is a legally binding notice from the Monetary Authority of Singapore that sets baseline cyber security practices for financial institutions. It requires firms to secure administrative accounts, apply security patches, maintain written security standards, control network perimeter traffic, deploy malware protection and use multi-factor authentication. MAS issues a version for each type of regulated firm, for example FSM-N06 for banks and FSM-N04 for insurers.

Financial institutions regulated by MAS must comply. MAS issues separate notices for banks, merchant banks, insurers and insurance agents, credit and charge card issuers, finance companies, payment system operators and digital payment token providers, financial holding companies, credit bureaus, insurance brokers, capital markets firms, financial advisers and trust companies. The text of the six cyber hygiene practices is broadly the same across these notices.

No. MAS cancelled Notice 655, the original cyber hygiene notice for banks issued in August 2019, with effect from 10 May 2024. It was replaced by Notice FSM-N06, issued under the Financial Services and Markets Act 2022. Other sector notices were replaced at the same time. The six cyber hygiene requirements carried over, so firms that met Notice 655 should already be close to meeting the current notice.

The six requirements are: secure every administrative account against unauthorised access; apply security patches within risk-based timeframes, with compensating controls where no patch exists; keep written security standards for every system and make systems conform to them; restrict unauthorised traffic at the network perimeter; implement malware protection on every system where available; and enforce multi-factor authentication for administrative accounts on critical systems and for internet access to customer information.

No. According to MAS's FAQ, firms do not need to submit an attestation or audit report on compliance with the notice. MAS expects each firm to report the state of its compliance to senior management, and MAS reviews compliance as part of its normal supervision. Firms should therefore keep current evidence that each requirement is met.

The notice is a short set of mandatory minimum controls, while the MAS Technology Risk Management Guidelines give broader, principles-based guidance on managing technology risk. ISO 27001 is a voluntary international standard for an information security management system. Many ISO 27001 Annex A controls, such as privileged access, patching, malware protection and secure configuration, overlap with the notice, so evidence can often be reused.

Yes, but it is narrow. A firm need not comply with a requirement only to the extent it cannot control the system in all three ways set out in paragraph 3.1: it cannot control the system directly, it cannot require the system provider to ensure compliance, and it is not reasonable to switch to a provider it could control. In most outsourcing arrangements firms are expected to secure compliance through their providers.

The MAS Cyber Hygiene Notice is mapped in OneClickComply's control library and is available on request rather than enabled by default. Once enabled, it uses the same automated evidence collection, continuous monitoring and policy generation as our other frameworks, and it reuses controls you already meet for standards such as ISO 27001. Our in-house audit team can answer specific questions through Ask an Auditor.