SFA

20 MINS ESTIMATED TIME TO COMPLETE, FOR EXISTING MEMBERS ONLY.

ENTER REGISTERED MEMBERSHIP EMAIL TO PROCEED

VERIFY YOUR EMAIL

Just one quick check to make sure you're really you. We've sent a verification code to
(remember to check your Spam).

Didn't receive an email?

APPLICATION ENTRY (COMPANY DETAILS)

COMPANY NAME *

Please ensure the company name is the same as per registered on ACRA/UEN

UEN NUMBER *

FSP Compliance Readiness Framework

FSP’s may select from an option of ‘Low’, ‘Medium’, ‘Medium to High’, ‘High’ or ’N/A’ in response to the questions posed for each of the control criteria set forth in this framework. These categories are defined in the legend below.

The responses to the questions could be either ‘Low’, ‘Medium’, ‘Medium to High’, ‘High’ or ’N/A’. The definitions of these categories are defined in the legend below

Low – FSP does not have the control in place.
Medium – FSP has the control in place but it has not been formalised into a policy/standard operating procedure. No evidence of the control performance is available for inspection.
Medium to High - FSP has the control in place but it has not been formalised into a policy/standard operating procedure. Evidence of the control performance is available for inspection.
High – FSP has the control in place and it has been formalised into a policy/standard operating procedure. Evidence of the control performance is available for inspection.
N/A - If the question is not applicable for the FSP’s control environment.

SECTION 1: ENTITY LEVEL CONTROLS (THERE ARE 5 PARTS TO THIS SECTION)

Part 1 - Control Environment

Questionnaire

Level of Compliance

Is there an established workplace conduct standard within the organisation?

Low

Medium

Medium to High

High

Are employees required to acknowledge their compliance to a defined code of conduct or established policies within the organisation?

Low

Medium

Medium to High

High

Are pre-employment checks (e.g. Education, Prior Employer, Criminal & Bankruptcy) conducted on candidates?

Low

Medium

Medium to High

High

Is there an organisational structure in place with reporting lines, authorities and responsibilities clearly defined?

Low

Medium

Medium to High

High

Are key responsibilities and expectations of the person responsible for information security clearly defined?

Low

Medium

Medium to High

High

Is onboarding training for new personnel conducted?

Low

Medium

Medium to High

High

Are ongoing training and certifications for staff conducted and tracked?

Low

Medium

Medium to High

High

Are refresher trainings on policy requirements conducted and tracked?

Low

Medium

Medium to High

High

Part 2 - Risk Assessment

Questionnaire

Level of Compliance

Are risk assessments performed on a regular basis (e.g. at least on an annual basis or when there are changes)?

Low

Medium

Medium to High

High

Are risk assessments that include a focus on the organisation's rapid growth conducted and approved by key management?

Low

Medium

Medium to High

High

Are risk assessments that include a focus on the implementation of new technology conducted and approved by key management?

Low

Medium

Medium to High

High

Are risk assessments related to new business models, products, or activities to be undertaken by the organisation conducted and approved by key management?

Low

Medium

Medium to High

High

Are risk assessments that include a focus on corporate restructurings conducted and approved by key management?

Low

Medium

Medium to High

High

Part 3 - Information and Communication

Questionnaire

Level of Compliance

Is there an internal communication channel for the FSP to communicate to its staff on roles, responsibilities and significant matters related to the services provided to FIs?

Low

Medium

Medium to High

High

Is there a communication channel with FIs for reporting exceptions, changes to operating environment and other significant matters?

Low

Medium

Medium to High

High

Is there a communication channel to allow for FIs to respond with any feedback/complaints on the services?

Low

Medium

Medium to High

High

Has your organisation implemented initiatives to enhance awareness of information security (e.g. phishing, document encryption) among the staff?

Low

Medium

Medium to High

High

Has your organisation implemented initiatives to enhance awareness of regulatory requirements (e.g. confidentiality/non-disclosure of client information) among the staff?

Low

Medium

Medium to High

High

Part 4 - Monitoring

Questionnaire

Level of Compliance

Does your organisation perform internal monitoring in relation to services provided to FIs to identify issues and concerns? (For example, self assessments, internal audits or independent external audits)

Low

Medium

Medium to High

High

Is periodic tracking and reporting on SLA compliance and service lapses relating to service provisioning performed?

Low

Medium

Medium to High

High

Part 5 - Practices related to Sub-Contracting

This section is only relevant if a sub-contractor (for example, cloud service provider) is engaged in service provisioning to FIs. If this section is relevant, please answer the following questions, (Select N.A if not applicable)

Questionnaire

Level of Compliance

Does your organisation perform due diligence and risk assessment of sub-contractors prior to onboarding?

Low

Medium

Medium to High

High

N.A

Are the contractual terms in sub-contracting arrangements aligned with your organisation's contract with FIs?

Low

Medium

Medium to High

High

N.A

Is ongoing monitoring of sub-contractor's activities performed (For example, receiving periodic updates on any changes, monthly reporting on SLAs)?

Low

Medium

Medium to High

High

N.A

Is a periodic review and risk assessment of sub-contractors performed? (For example, FSPs' review of the independent auditor's report to understand the implications of the report's conclusion)

Low

Medium

Medium to High

High

N.A

FSP Compliance Readiness Framework

The responses to the questions could be either ‘Low’, ‘Medium’, ‘Medium to High’, ‘High’ or ’N/A’. The definitions of these categories are defined in the legend below

Low – FSP does not have the control in place.
Medium – FSP has the control in place but it has not been formalised into a policy/standard operating procedure. No evidence of the control performance is available for inspection.
Medium to High - FSP has the control in place but it has not been formalised into a policy/standard operating procedure. Evidence of the control performance is available for inspection.
High – FSP has the control in place and it has been formalised into a policy/standard operating procedure. Evidence of the control performance is available for inspection.
N/A - If the question is not applicable for the FSP’s control environment.

SECTION 2: General IT Controls (THERE ARE 9 PARTS TO THIS SECTION)

Part 1 - Logical Security

Questionnaire

Level of Compliance

Are the IT systems used to provide service to FI's configured to require strong password parameters (e.g. password complexity, lockout settings, password history) to be in place for users to access the system?

Low

Medium

Medium to High

High

Does your organisation grant user access to the IT systems based on approvals and on a 'need-to-use' basis?

Low

Medium

Medium to High

High

Does your organisation review your user access rights to the IT systems (including subcontractors) on a periodic (e.g. quarterly or annual as relevant) basis?

Low

Medium

Medium to High

High

Does your organisation revoke user access to the IT system promptly when the access is no longer required?

Low

Medium

Medium to High

High

Does your organisation put in place logical access controls (e.g. access to critical data, segregation of data between different entities) to segregate and protect individual FI’s information?

Low

Medium

Medium to High

High

If your organisation handles FI data (including data that has been backed up or exists within UAT), do you have a process in place to ensure that the data is securely destroyed or removed as per (contractually) agreed retention and destruction protocols as well as upon termination of contractual arrangements?

Low

Medium

Medium to High

High

If your organisation handles FI data does your organisation deploy cryptography standards (e.g. cryptographic algorithms and encryption key length) to protect FIs’ customer information and other sensitive data based on industry-accepted standards (e.g. AES 256)?

Low

Medium

Medium to High

High

If your organisation owns cryptographic keys, are the keys securely generated and protected from unauthorised disclosure (including during transmission)?

Low

Medium

Medium to High

High

If your organisation owns cryptographic keys, is access to generate cryptographic keys restricted?

Low

Medium

Medium to High

High

10.

If your organisation owns cryptographic keys, are the cryptographic keys stored in systems that are hardened and tamper resistant (e.g. hardware security module)?

Low

Medium

Medium to High

High

11.

Are accounts with elevated access privileges (including administrative accounts and accounts which can deploy changes into production) and accounts on any system used by the relevant entity to access customer information through the internet implemented with two-factor authentication (2FA)?

Low

Medium

Medium to High

High

12.

Does your organisation implement put in place controls such as:
(a) Split-password control, never-alone principle etc
(b) Regular passwords are changed regularly
(c) Logging of activities performed by of privileged users?

Low

Medium

Medium to High

High

13.

Does your organisation review logs of activities of the accounts with elevated access privileges?

Low

Medium

Medium to High

High

Part 2 - Physical Security

This section is only relevant if your organisation manages your own data centre / server room. If this section is relevant, please answer the following questions:

Questionnaire

Level of Compliance

Is access to the data centre / server room (DCs) physically restricted (e.g. via card access, biometric systems, ISO standard locks) to authorised personnel on a need-to-have basis only?

Low

Medium

Medium to High

High

N.A

Are requests for access to DCs by employees, contractors and third parties documented and approved?

Low

Medium

Medium to High

High

N.A

Does your organisation require visitors to the DCs to be registered and issued with clear identification (e.g. an ID badge) and escorted by authorised personnel at all times?

Low

Medium

Medium to High

High

N.A

Does your organisation review the access rights to data centre/controlled areas on a periodic basis to verify that access is granted to authorised personnel on a need-to-have basis only?

Low

Medium

Medium to High

High

N.A

Are the access points to the DCs, including windows, to controlled areas fitted with audible intruder alarms?

Low

Medium

Medium to High

High

N.A

Are the entries and exits to secure areas of the DCs fitted with an audit trail (e.g. entry/exit log from door access system, CCTV footage, manual log-book with visitor’s name, date, time, purpose, escort’s name, etc.)?

Low

Medium

Medium to High

High

N.A

Are all physical access credentials (including security access cards that are damaged or lost) revoked or disabled promptly when not required?

Low

Medium

Medium to High

High

N.A

Does your organisation install environmental control features at the data centre (e.g. Locked cabinets for systems and network equipment, Uninterruptible power supply and backup generators, FM200 or other fire suppression system)?

Low

Medium

Medium to High

High

N.A

Are the environmental control as well as the alarm system equipment inspected, tested and maintained regularly?

Low

Medium

Medium to High

High

N.A

Part 3 - Change Management

Questionnaire

Level of Compliance

Are change requests initiated through a formal change request process?

Low

Medium

Medium to High

High

Does your organisation classify the change requests according to the priority, risk and impact of the changes?

Low

Medium

Medium to High

High

Are the change requests approved in accordance to an established Change Authority Matrix (includes internal approvals and notifications to FIs, if the changes are impacting the FIs)?

Low

Medium

Medium to High

High

Does your organisation perform a risk and impact analysis for the change requests relating to existing infrastructure, network, up-stream and downstream systems prior to granting approval to proceed with the change?

Low

Medium

Medium to High

High

Does your organisation prepare test plans (e.g. System Integration Testing (“SIT”) and User Acceptance Testing (“UAT”)) and sign off on the test plans in accordance to the established Change Authority Matrix?

Low

Medium

Medium to High

High

Are changes tested and appropriate approvals obtained prior to deployment to the production environment?

Low

Medium

Medium to High

High

Does your organisation have an emergency change escalation protocol (e.g. by telephone and email) and corresponding approval requirements established in the change approval matrix?

Low

Medium

Medium to High

High

Are retrospective documented approvals obtained after the emergency change?

Low

Medium

Medium to High

High

Are rollback plans (which may include a backup plan) prepared and approved prior to changes being made?

Low

Medium

Medium to High

High

10.

Has segregation of environments for development, testing, staging and production been established?

Low

Medium

Medium to High

High

11.

Is UAT data anonymised?

Low

Medium

Medium to High

High

12.

In the event UAT data contains production data, is the environment subjected to same level of controls as per production environment?

Low

Medium

Medium to High

High

13.

Is segregation of duties enforced to ensure that no single individual has the ability to develop, compile and migrate object codes into the production environment?

Low

Medium

Medium to High

High

14.

If your organisation uses DevOps methodology, are DevOps activities logged and reviewed in a timely manner?

Low

Medium

Medium to High

High

15.

Does your organisation conduct source code review on on-going basis for higher risk systems and applications changes (including APIs) to identify security vulnerabilities and deficiencies, coding errors, defects and malicious codes before these changes are implemented?

Low

Medium

Medium to High

High

16.

If your organisation uses agile development methodology, does your organisation use a mixture of static, dynamic and interactive application security testing methods (e.g. fuzzing or fuzz testing) to validate the security of the software application?

Low

Medium

Medium to High

High

17.

If your organisation uses agile development methodology, do you implement automated static or dynamic software scanning to detect security vulnerabilities or coding issues, and configurations that can impact the security of IT systems?

Low

Medium

Medium to High

High

18.

Does your organisation track the issues or software defects discovered from source code review and application security testing and ensure they are remediated before production deployment?

Low

Medium

Medium to High

High

Part 4 - Incident Management

Questionnaire

Level of Compliance

Does your organisation have a defined incident management process to report incidents that are identified?

Low

Medium

Medium to High

High

Is the incident severity level and escalation process pre-agreed with FIs?

Low

Medium

Medium to High

High

Does your organisation notify the FIs immediately upon discovery of an incident?

Low

Medium

Medium to High

High

Is an Incident Report is provided to the FIs during the post-event phase?

Low

Medium

Medium to High

High

Does your organisation record and track incidents to allow for timely resolution and root cause analysis?

Low

Medium

Medium to High

High

Does your organisation design and implement IT systems based on business needs to achieve the level of system availability required by business?

Low

Medium

Medium to High

High

Does your organisation measure and monitor the utilisation of your system and network resources against a set of pre-defined thresholds to ensure that IT resources are adequate to meet your business needs?

Low

Medium

Medium to High

High

Does your organisation review the network architecture on a periodic basis to identify any potential single point of failure, and implement appropriate measures to address and mitigate the risk of disruption?

Low

Medium

Medium to High

High

Part 5 - Backup and Disaster Recovery

Questionnaire

Level of Compliance

Does your organisation have a backup and restoration process in place to ensure that critical information systems can be recovered?

Low

Medium

Medium to High

High

Does your organisation maintain backups of cryptographic keys for recovery purposes and accord them with high level of protection?

Low

Medium

Medium to High

High

Are system level backups securely stored at off-site storage facilities?

Low

Medium

Medium to High

High

Does your organisation perform monitoring of the status of backups to identify and resolve unsuccessful backups?

Low

Medium

Medium to High

High

Are backup copies periodically tested to validate recovery capabilities?

Low

Medium

Medium to High

High

Is there a Disaster Recovery strategy and business continuity plan established?

Low

Medium

Medium to High

High

Does your organisation perform a Disaster Recovery or business continuity testing exercise?

Low

Medium

Medium to High

High

Are the Disaster Recovery exercise test results shared with FIs, if contractually required or requested by FIs?

Low

Medium

Medium to High

High

Are the RTO and RPO defined (in compliance with FI expectations and MAS regulations) and validated during the Disaster Recovery / business continuity testing exercise?

Low

Medium

Medium to High

High

Part 6 - Network and Security Management

Questionnaire

Level of Compliance

Has your organisation defined security baseline standards (i.e. system security baseline settings and configuration rules) for the various middleware, operating system, databases, virtual instances and network devices to ensure consistent application of security configurations and hardening of systems to the required level of protection?

Low

Medium

Medium to High

High

Does your organisation conduct regular enforcement checks against baseline standards to monitor compliance?

Low

Medium

Medium to High

High

Are anti-virus/anti-malware software installed and updated regularly on every system with detected threats quarantined and removed appropriately?

Low

Medium

Medium to High

High

Is an inventory of hardware and software platforms used (including open source platforms), being maintained to facilitate patching and vulnerability monitoring, timely monitoring, reviewing, testing and application of vendor provided patches, and prioritising security patches to address known vulnerabilities?

Low

Medium

Medium to High

High

Where no security patch is available to address a vulnerability, does your organisation ensure that controls are instituted to reduce any risk posed by such vulnerabilities to such a system?

Low

Medium

Medium to High

High

Does your organisation conduct file integrity checks to detect unauthorised changes (e.g. databases, files, programmes, system configuration, open source software downloaded from the internet)?

Low

Medium

Medium to High

High

Are network security controls such as firewalls and intrusion detection-prevention devices deployed to protect the internal network (including virtual network/cloud)?

Low

Medium

Medium to High

High

If your organisation uses IoT devices, are they secured with strong authentication and network access controls to limit the cyber attack surface?

Low

Medium

Medium to High

High

Are the rules for network security devices backed up regularly?

Low

Medium

Medium to High

High

10.

Are the security system events logged, retained and monitored?

Low

Medium

Medium to High

High

Part 7 - Security Incident Response

Questionnaire

Level of Compliance

Does your organisation have a security incident response procedure (for cyber, physical or system security) in place and is it tested annually?

Low

Medium

Medium to High

High

Part 8 - System Vulnerability Assessments

Questionnaire

Level of Compliance

Does your organisation perform vulnerability assessments ('VAs') on your IT environment at a regular frequency that is commensurate with the criticality of the system?

Low

Medium

Medium to High

High

Does your organisation perform penetration testings ('PTs') on your IT systems at a regular frequency that is commensurate with the criticality of the system?

Low

Medium

Medium to High

High

Are issues identified in the VAs and PTs remediated in a timely manner based on the severity assessment and classification of each issue?

Low

Medium

Medium to High

High

Does your organisation conduct risk assessments and mitigation strategies to manage deviations?

Low

Medium

Medium to High

High

Part 9 - Technology Refreshment Management

Questionnaire

Level of Compliance

Does your organisation have an up-to-date inventory of software and hardware components used in the production and disaster recovery environments supporting FIs?

Low

Medium

Medium to High

High

Are all relevant associated warranty and supporting contracts related to the software and hardware components maintained as part of the organisation's up-to-date inventory?

Low

Medium

Medium to High

High

If your organisation uses IoT devices, are they managed and maintained with information on the networks they are connected to and their physical locations as part of an up-to-date inventory?

Low

Medium

Medium to High

High

Are the IT systems and software supporting FIs actively managed with close attention paid to the products' end-of-support (“EOS”) dates?

Low

Medium

Medium to High

High

Are IT systems and products’ nearing the end-of-support (“EOS”) dates being scheduled for timely replacement or undergoing a risk assessment if they are to be utilised beyond the EOS dates?

Low

Medium

Medium to High

High

YOU HAVE COMPLETED YOUR ASSESSMENT!

THANK YOU FOR YOUR TIME, A PDF OF YOUR RESULTS WILL BE SENT TO YOUR

REGISTERED EMAIL.

Give us a feedback