{"text_format":"1","workbook":"xlsx","n_sheets":19,"sheets":["Cover Page","3","4","5","6","7","8","9","10","11","12","13","14","Appendix A","Appendix B","Appendix C","Appendix D","Appendix E","Appendix F"],"not_rendered":{"charts":0,"images":1,"macros":1,"external_links":1,"defined_names":76,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Cover Page","index":0,"n_rows":19,"n_cols":11,"rows_kept":19,"cut":false,"hidden":false,"merged":[[3,2,3,3],[1,2,1,3],[18,2,24,3]]}
[]
[null,null,"Confidential"]
[]
[null,null,"COMPLIANCE CHECKLIST\nFOR\nTECHNOLOGY RISK MANAGEMENT GUIDELINES",null," ",null," "," ",null," "]
[null,null,null,null,null,null,null,null,null,null," "]
[null,null,"Name of Financial Institution"," ",null,null,null,null," ",null," "]
[null,null,"Date Completed",null,null,null,null," "]
[]
[null,null,"Name of Respondent"]
[null,null,"Designation / Title"]
[null,null,"Contact Number"]
[null,null,"Email Address",null,null,null,null,null,null,null," "]
[null,null,null,null,null,null,null,null," "]
[null,null,"Name of Reviewer",null,null,null,null,null,null,null," "]
[null,null,"Designation / Title"]
[null,null,"Contact Number"]
[null,null,"Email Address"]
[]
[null,null,"Instructions\n\n1. This compliance checklist should be completed each year by senior officers who have direct knowledge of the financial institution’s information systems and operations. The information provided in this checklist should be reviewed by their superiors.\n\n2. Each guideline description in the checklist should be evaluated in the context of the relevant sections in the Technology Risk Management Guidelines. Some guideline descriptions in this checklist have been condensed and may not be verbatim with the Guidelines.\n\n3. For each guideline description, place an “X” in the appropriate column to indicate whether the financial institution is fully compliant, partially compliant, or not compliant. Otherwise, place an “X” in the NA column.\n\n4. If full compliance has not been achieved, explain in the Comments column why, and how and when remedial action would be made."]

{"sheet":"3","index":1,"n_rows":21,"n_cols":8,"rows_kept":21,"cut":false,"hidden":false,"merged":[[18,1,20,1],[18,0,20,0],[0,0,0,7],[14,1,16,1],[14,0,16,0],[10,0,11,0],[10,1,11,1],[2,1,3,1],[2,0,3,0],[4,1,5,1],[4,0,5,0]]}
["3 OVERSIGHT OF TECHNOLOGY  RISKS BY BOARD OF DIRECTORS AND SENIOR MANAGEMENT "]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","3.0.2","The board of directors and senior management have oversight of technology risks."]
[null,null,"The IT function is capable of supporting business strategies and objectives."]
["2","3.1.1","A sound and robust technology risk management framework is established and maintained."]
[null,null,"The board of directors and senior management are involved in key IT decisions. "]
[3,"3.1.2","The board of directors and senior management are fully responsible for ensuring that effective internal controls and risk management practices are implemented to achieve security, reliability, resiliency and recoverability. "]
[4,"3.1.3","The board of directors and senior management have given due consideration to cost-benefit issues, including factors such as reputation, customer confidence, consequential impact and legal implications, with regard to investment in controls and security measures for computer systems, networks, data centres (DC), operations and backup facilities.  "]
[5,"3.2.1","IT policies, standards and procedures are established to manage technology risks and safeguard information system assets."]
[6,"3.2.2","IT policies, standards and procedures are regularly reviewed and updated. "]
[7,"3.2.3","Compliance processes are implemented to verify that IT security standards and procedures are enforced. "]
[null,null,"Follow-up processes are implemented to ensure that compliance deviations are addressed and remedied on a timely basis.     "]
[8,"3.3.1","A comprehensive and effective personnel screening process is implemented to minimise technology risks due to system failure, internal sabotage or fraud."]
[9,"3.3.2","Staff, vendors and contractors, who are authorised to access the organisation's systems, are required to protect sensitive or confidential information.  "]
[10,"3.4.1","A comprehensive IT security awareness training program is established to enhance the overall IT security awareness level in the organisation.  "]
[null,null,"The training program includes information on IT security policies and standards as well as individual responsibility in respect of IT security and measures that should be taken to safeguard information system assets."]
[null,null,"Every staff in the organisation is made aware of the applicable laws, regulations, and guidelines pertaining to the usage, deployment and access to IT resources. "]
[11,"3.4.2","The training program is conducted and updated at least annually and extended to all new and existing staff, contractors, and vendors who have access to the organisation's IT resources and systems. "]
[12,"3.4.3","The training program is endorsed by senior management."]
[null,null,"The training program is reviewed and updated to ensure that the contents of the program remain current and relevant."]
[null,null,"The review takes into consideration the evolving nature of technology as well as emerging risks."]

{"sheet":"4","index":2,"n_rows":34,"n_cols":8,"rows_kept":34,"cut":false,"hidden":false,"merged":[[32,0,33,0],[32,1,33,1],[30,0,31,0],[30,1,31,1],[17,1,19,1],[17,0,19,0],[0,0,0,7],[2,1,8,1],[2,0,8,0],[27,1,29,1],[27,0,29,0],[23,1,26,1],[23,0,26,0],[11,0,12,0],[11,1,12,1],[20,0,21,0],[20,1,21,1],[3,2,3,7]]}
["4 TECHNOLOGY RISK MANAGEMENT FRAMEWORK"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","4.0.1","A technology risk management framework is established to manage technology risks in a systematic and consistent manner."]
[null,null,"The framework encompasses the following:"]
[null,null,"a. Roles and responsibilities in managing technology risks;"]
[null,null,"b. Identification and prioritisation of information system assets;"]
[null,null,"c. Identification and assessment of impact and likelihood of current and emerging threats, risks and vulnerabilities;"]
[null,null,"d. Implementation of appropriate practices and controls to mitigate risks; and"]
[null,null,"e. Periodic update and monitoring of risk assessment to include changes in systems, environmental or operating conditions that would affect risk analysis."]
["2","4.0.2","Effective risk management practices and internal controls are instituted to achieve data confidentiality, system security, reliability, resiliency and recoverability in the organisation."]
["3","4.1.1","Information system assets are adequately protected from unauthorised access, misuse or fraudulent modification, insertion, deletion, substitution, suppression or disclosure."]
["4","4.1.2","A clear policy on information system asset protection is established."]
[null,null,"The criticality of information system assets is ascertained and appropriate plans are developed to protect them. "]
["5","4.2.4","Mutating and growing risks are monitored vigilantly."]
["6","4.3.1","The potential impact and consequences of risks on overall business and operations are analysed and quantified."]
["7","4.3.3","A threat and vulnerability matrix is developed to assess the impact of threat to the organisation's IT environment, and to prioritise IT risks."]
["8","4.4.1","For each type of risk identified, risk mitigation and control strategies that are consistent with the value of the information system assets and level of risk tolerance are developed and implemented."]
["9","4.4.3","Priority is given to threat and vulnerability pairings with high risk ranking which could cause significant harm or impact to the organisation’s operations."]
[null,null,"The organisation's risk tolerance for damages and losses is assessed."]
[null,null,"The costs of risk controls are balanced against the benefits to be derived."]
["10","4.4.4","Risks are managed and controlled in a manner that will maintain the organisation's financial and operational viability and stability.  "]
[null,null,"The costs and effectiveness of controls with regard to the risks being mitigated are assessed when deciding on the adoption of alternative controls and security measures."]
["11","4.4.6","Insurance cover is taken for insurable risks, including recovery and restitution costs."]
["12","4.5.1","A risk register is maintained to facilitate monitoring and reporting of risks."]
[null,null,"Risks of the highest severity are accorded top priority and monitored closely with regular reporting on the actions that have been taken to mitigate them."]
[null,null,"The risk register is updated periodically."]
[null,null,"A monitoring and review process for continuous assessment and treatment of risks is instituted."]
["13","4.5.2","IT risk metrics are developed to highlight the systems, processes or infrastructure that have the highest risk exposure."]
[null,null,"An overall technology risk profile of the organisation is provided to the board of directors and senior management. "]
[null,null,"In determining IT risk metrics, risk events, regulatory requirements and audit observations are considered."]
["14","4.5.3","Risk processes are reviewed and updated in accordance with changes in IT environment and delivery channels."]
[null,null,"Past risk-control methods are re-evaluated with renewed testing and assessment of the adequacy and effectiveness of risk management processes. "]
["15","4.5.4","IT risk control and mitigation approach are reviewed and updated by the Management of the organisation's IT function. "]
[null,null,"The review has taken into account changing circumstances and variations in the organisation's risk profile.  "]

{"sheet":"5","index":3,"n_rows":20,"n_cols":8,"rows_kept":20,"cut":false,"hidden":false,"merged":[[14,1,15,1],[14,0,15,0],[0,0,0,7],[2,1,3,1],[2,0,3,0],[5,1,7,1],[5,0,7,0]]}
["5 MANAGEMENT OF IT OUTSOURCING RISKS"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","5.1.1","The board of directors and senior management fully understand risks associated with IT outsourcing.  "]
[null,null,"Before a service provider is appointed, due diligence is carried out to determine its capability, reliability, track record and financial position. "]
["2","5.1.2","Contractual terms and conditions governing the roles, relationships, obligations and responsibilities of all contracting parties are set out fully in written agreements."]
["3","5.1.3","Access to the service provider's systems, operations, documentation and facilities is granted to all parties nominated by the organisation to carry out review or assessment for regulatory, audit or compliance purposes."]
[null,null,"The engagement of the service provider does not hinder the ability of regulatory authorities to assess the organisation's IT risks which would include inspecting, supervising or examining the service provider’s roles, responsibilities, obligations, functions, systems and facilities.  "]
[null,null,"Contractual agreements with the service provider recognise the authority of regulators to perform an assessment on the service provider."]
["4","5.1.4","The service provider is required to employ a high standard of care and diligence in its security policies, procedures and controls to protect the confidentiality and security of the organisation's sensitive or confidential information, such as customer data, computer files, records, object programs and source codes. "]
["5","5.1.5","The service provider is required to implement security policies, procedures and controls that are at least as stringent as the organisation's."]
["6","5.1.6","The security policies, procedures and controls of the service provider are monitored and reviewed on a regular basis by the organisation, including commissioning or obtaining periodic expert reports on security adequacy and compliance in respect of the operations and services provided."]
["7","5.1.7","The service provider is required to develop and establish a disaster recovery contingency framework which defines its roles and responsibilities for documenting, maintaining and testing its contingency plans and recovery procedures.  "]
["8","5.1.8","All parties concerned, including staff from the service provider, receive regular training in activating the contingency plan and executing recovery procedures.  "]
["9","5.1.9","The disaster recovery plan is reviewed, updated and tested regularly in accordance with changing technology conditions and operational requirements."]
["10","5.1.10","A contingency plan based on credible worst-case scenarios for service disruptions is established to prepare for the possibility that the current service provider may not be able to continue operations or render the services required.  "]
[null,null,"The contingency plan incorporates identification of viable alternatives for resuming IT operations elsewhere."]
["11","5.2.2","The organisation is aware of cloud computing’s unique attributes and risks especially in areas of data integrity, sovereignty, commingling, platform multi-tenancy, recoverability and confidentiality, regulatory compliance, auditing and data offshoring. "]
["12","5.2.3","The service provider is able to isolate and clearly identify the organisation's customer data and other information system assets for protection."]
["13","5.2.4","The organisation has the contractual power and means to promptly remove or destroy data stored at the service provider’s systems and backups in the event of contract termination with the service provider."]
["14","5.2.5","The service provider’s ability to recover outsourced systems and IT services within the stipulated recovery time objective (RTO) is verified prior to contracting with the service provider. "]

{"sheet":"6","index":4,"n_rows":26,"n_cols":8,"rows_kept":26,"cut":false,"hidden":false,"merged":[[13,1,14,1],[19,1,20,1],[19,0,20,0],[9,1,10,1],[9,0,10,0],[11,1,12,1],[11,0,12,0],[15,1,16,1],[15,0,16,0],[17,1,18,1],[17,0,18,0],[13,0,14,0],[0,0,0,7],[4,1,5,1],[4,0,5,0],[6,0,7,0],[6,1,7,1]]}
["6 ACQUISITION AND DEVELOPMENT OF INFORMATION SYSTEMS"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","6.0.1","System deficiencies and defects are identified at the system design, development and testing phases.  "]
["2","6.0.2","A steering committee, consisting of business owners, the development team and other stakeholders is established to provide oversight and monitoring of the progress of the project, including deliverables to be realised at each phase of the project and milestones to be reached according to the project timetable.  "]
["3","6.1.1","Tasks and processes for developing or acquiring new systems include project risk assessment and classification, critical success factors for each project phase, definition of project milestones and deliverables."]
[null,null,"The roles and responsibilities of staff involved in the project are clearly defined in the project management framework."]
["4","6.1.2","The project plans for all IT projects are clearly documented."]
[null,null,"The deliverables to be realised at each phase of the project as well as milestones to be reached are clearly documented in the project plans.  "]
["5","6.1.3","User functional requirements, business cases, cost-benefit analysis, systems design, technical specifications, test plans and service performance expectation are approved by the relevant business and IT management. "]
["6","6.1.4","Management oversight of the project is established to ensure that milestones are reached and deliverables are realised in a timely manner. "]
[null,null,"Issues or problems which could not be resolved at the project committee level are escalated to senior management for attention and intervention. "]
["7","6.2.1","Security requirements relating to system access control, authentication, transaction authorisation, data integrity, system activity logging, audit trail, security event tracking and exception handling are clearly specified in the early phase of system development or acquisition."]
[null,null,"Compliance checks on the organisation's security standards against relevant statutory requirements are performed."]
["8","6.2.2","A methodology for system testing is established. "]
[null,null,"The scope of tests covers business logic, security controls and system performance under various stress-load scenarios and recovery conditions.  "]
["9","6.2.3","Full regression testing is performed before system rectification or enhancement is implemented."]
[null,null,"Users whose systems and operations are affected by the changes have reviewed and signed off on the outcome of the tests."]
["10","6.2.4","Penetration testing is conducted prior to the commissioning of a new system which offers internet accessibility and open network interfaces."]
[null,null,"Vulnerability scanning is performed on external and internal network components that support the new system."]
["11","6.2.5","Separate physical or logical environments for unit, integration, as well as system and user acceptance testing (“UAT”) is maintained."]
[null,null,"Vendor and developers’ access to the UAT environment is closely monitored."]
["12","6.3.3","Due diligence is exercised to ensure applications have appropriate security controls, taking into consideration the type and complexity of services these applications provide."]
["13","6.3.4","Based on the organisation’s risk analysis, specific applications modules and security safeguards are rigorously tested with a combination of source code review, exception testing and compliance review to identify errant coding practices and systems vulnerabilities that could lead to security problems, violations and incidents."]
["14","6.4.2","An assessment is performed to ascertain the importance of simple applications that were developed by business users."]
["15","6.4.3","Recovery measures, user access and data protection controls are implemented for simple applications that were developed by business users."]
["16","6.4.4","End user developed program codes, scripts and macros are reviewed and tested before they are used  to ensure the integrity and reliability of the applications. "]

{"sheet":"7","index":5,"n_rows":69,"n_cols":8,"rows_kept":69,"cut":false,"hidden":false,"merged":[[40,2,40,7],[45,2,45,7],[46,2,46,7],[52,2,52,7],[56,2,56,7],[60,1,61,1],[60,0,61,0],[62,1,63,1],[62,0,63,0],[64,1,65,1],[64,0,65,0],[45,1,59,1],[45,0,59,0],[40,1,44,1],[40,0,44,0],[38,1,39,1],[38,0,39,0],[35,1,37,1],[35,0,37,0],[11,0,13,0],[23,1,25,1],[23,0,25,0],[11,1,13,1],[16,1,17,1],[16,0,17,0],[20,1,22,1],[20,0,22,0],[26,1,27,1],[26,0,27,0],[29,1,30,1],[29,0,30,0],[31,1,33,1],[31,0,33,0],[0,0,0,7],[4,1,5,1],[4,0,5,0],[6,1,9,1],[6,0,9,0]]}
["7 IT SERVICE MANAGEMENT"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","7.1.1","A change management process is established to ensure that changes to production systems are assessed, approved, implemented and reviewed in a controlled manner."]
["2","7.1.2","The change management process applies to changes pertaining to system and security configurations, patches for hardware devices and software updates."]
["3","7.1.3","Prior to deploying changes to the production environment, a risk and impact analysis of the change request in relation to existing infrastructure, network, up-stream and downstream systems is performed."]
[null,null,"Prior to deploying changes to the production environment, an assessment of whether the introduced change would spawn security implications or software compatibility problems to affected systems or applications is performed."]
["4","7.1.4","The impending change is adequately tested."]
[null,null,"The impending change is accepted by users prior to the migration of the changed modules to the production system."]
[null,null,"Appropriate test plans for the impending change are developed and documented."]
[null,null,"Test results with user sign-offs are obtained prior to the migration."]
["5","7.1.5","All changes to the production environment are approved by personnel delegated with the authority to approve change requests. "]
["6","7.1.6","To minimise risks associated with changes, backups of affected systems or applications are performed prior to the change."]
[null,null,"A rollback plan is established prior to the change."]
[null,null,"Alternative recovery options are established to address situations where a change does not allow the organisation to revert to a prior status."]
["7","7.1.7","Logging facility is enabled to record activities performed during the migration process. "]
["8","7.2.2","Separate physical or logical environments for systems development, testing, staging and production are established. "]
["9","7.2.3","Where controls in the non-production environment are different or less stringent from those in the production environment, a risk assessment is performed."]
[null,null,"Sufficient preventive and detective controls are implemented before a non-production environment is connected to the internet."]
["10","7.2.4","Segregation of duties is enforced so that no single individual has the ability to develop, compile and move object codes from one environment to another."]
["11","7.2.5","After a change has been successfully implemented in the production environment, the change is replicated and migrated to disaster recovery systems or applications."]
["12","7.3.2","An incident management framework is established to restore normal IT service as quickly as possible following the incident, and with minimal impact to the organisation's business operations.  "]
[null,null,"The roles and responsibilities of staff involved in the incident management process are established."]
[null,null,"The roles and responsibilities of staff involved in the incident management process include recording, analysing, remediating and monitoring incidents."]
["13","7.3.3","Incidents are accorded with the appropriate severity level. "]
[null,null,"Helpdesk staff are trained to discern incidents of high severity level.  "]
[null,null,"The criteria used for assessing severity levels of incidents is established and documented.  "]
["14","7.3.4","Incident escalation and resolution procedures are established."]
[null,null,"The resolution timeframe is commensurate with the severity level of the incident. "]
["15","7.3.5","The predetermined escalation and response plan for security incidents is tested on a regular basis."]
["16","7.3.6","A computer emergency response team is formed."]
[null,null,"The computer emergency response team comprises staff with necessary technical and operational skills to handle major incidents."]
["17","7.3.7","Senior management is kept apprised of the development of major incidents so that the decision to activate the disaster recovery plan can be made on a timely basis."]
[null,null,"The procedures to notify MAS of major incidents are established. "]
[null,null,"MAS is informed as soon as possible in the event that a critical IT system has failed over to its disaster recovery system. "]
["18","7.3.8","A predetermined action plan to address public relations issues is established."]
["19","7.3.9","Customers are kept informed of any major incident.  "]
[null,null,"The effectiveness of the mode of communication is assessed."]
[null,null,"The general public is informed where necessary. "]
["20","7.3.10","A root-cause and impact analysis is performed for major incidents which result in severe disruption of IT services."]
[null,null,"Remediation actions are taken to prevent the recurrence of similar incidents. "]
["21","7.3.11","The incident report includes the following:"]
[null,null,"a. an executive summary of the incident; "]
[null,null,"b. an analysis of root cause which triggered the event;"]
[null,null,"c. impact of the event; and"]
[null,null,"d. measures taken to address the root cause and consequences of the event."]
["22","7.3.12","The root-cause and impact analysis covers the following areas:"]
[null,null,"a.   Root Cause Analysis"]
[null,null,"i. When did it happen? "]
[null,null,"ii. Where did it happen?"]
[null,null,"iii. Why and how did the incident happen?"]
[null,null,"iv. How often had a similar incident occurred over the last 3 years? "]
[null,null,"v. What lessons were learnt from this incident?"]
[null,null,"b.   Impact Analysis"]
[null,null,"i. Extent, duration or scope of the incident including information on the  systems, resources and customers that were affected;"]
[null,null,"ii. Magnitude of the incident including forgone revenue, losses, costs, investments, number of customers affected, implications, consequences to reputation and confidence; and"]
[null,null,"iii. Breach of regulatory requirements and conditions as a result of the incident."]
[null,null,"c.   Corrective and Preventive Measures"]
[null,null,"i. Immediate corrective action to be taken to address consequences of the incident. Priority should be placed on addressing customers’ concerns and / or compensation;"]
[null,null,"ii. Measures to address the root cause of the incident; and"]
[null,null,"iii. Measures to prevent similar or related incidents from occurring."]
["23","7.3.13","All incidents are adequately addressed within corresponding resolution timeframes."]
[null,null,"All incidents are monitored to their resolution."]
["24","7.4.2","Clear roles and responsibilities of staff involved in the problem management process are established."]
[null,null,"Problems are identified, classified, prioritised, and addressed in a timely manner."]
["25","7.4.3","The criteria to categorise problems by severity level is clearly defined to facilitate the classification process."]
[null,null,"Target resolution time and appropriate escalation processes for each severity level are established."]
["26","7.4.4","A trend analysis of past incidents is performed to facilitate the identification and prevention of similar problems."]
["27","7.5.1","Indicators such as performance, capacity and utilisation are monitored and reviewed to ensure that IT systems and infrastructure are able to support business functions."]
["28","7.5.2","Monitoring processes are established and appropriate thresholds are implemented to provide sufficient time to plan and determine additional resources."]

{"sheet":"8","index":6,"n_rows":30,"n_cols":8,"rows_kept":30,"cut":false,"hidden":false,"merged":[[27,1,28,1],[27,0,28,0],[13,1,14,1],[13,0,14,0],[21,1,22,1],[21,0,22,0],[23,1,24,1],[23,0,24,0],[0,0,0,7],[2,1,3,1],[2,0,3,0],[11,1,12,1],[11,0,12,0],[4,0,5,0],[4,1,5,1],[7,0,8,0],[7,1,8,1],[9,1,10,1],[9,0,10,0]]}
["8 SYSTEMS RELIABILITY, AVAILABILITY AND RECOVERABILITY"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","8.0.2","Recovery and business resumption priorities are defined."]
[null,null,"Contingency procedures are tested and practised so that disruptions to business arising from a serious incident are minimised.  "]
["2","8.1.2","Built-in redundancies are developed to reduce single points of failure which can bring down the entire network.  "]
[null,null,"Standby hardware, software and network components that are necessary for fast recovery are maintained."]
["3","8.1.3","High availability for critical systems is achieved."]
["4","8.2.1","A scenario analysis is performed to identify and address various types of contingency scenarios."]
[null,null,"Scenarios such as major system outages which may be caused by system faults, hardware malfunction, operating errors or security incidents, as well as a total incapacitation of the primary DC are considered."]
["5","8.2.2","Recovery plan and incident response procedures are evaluated at least annually."]
[null,null,"Recovery plan and incident response procedures are updated as and when changes to business operations, systems and networks occur.  "]
["6","8.2.3","Rapid backup and recovery capabilities are implemented at the individual system or application cluster level. "]
[null,null,"In drawing up a recovery plan and conducting contingency tests, inter-dependencies between critical systems are considered."]
["7","8.2.4","System recovery and business resumption priorities are defined."]
[null,null,"Specific recovery objectives including RTO and recovery point objective (RPO) for IT systems and applications are established."]
["8","8.2.5","A recovery site that is geographically separate from the primary site is established to enable the restoration of critical systems and resumption of business operations should a disruption occur at the primary site. "]
["9","8.2.6","Recovery strategies and technologies such as on-site redundancy and real-time data replication are implemented to enhance the organisation's recovery capability."]
["10","8.2.7","Cross-border network redundancy such as engagement of different network service providers and alternate network paths is instituted to minimise impact on business operations in the event of a disruption."]
["11","8.3.1","Impromptu and untested recovery measures are not implemented during a system outage."]
["12","8.3.2","The effectiveness of recovery requirements and the ability of staff to execute the necessary emergency and recovery procedures are tested and validated at least annually."]
["13","8.3.3","Various scenarios, including total shutdown or incapacitation of the primary site as well as component failure at the individual system or application cluster level, are covered in disaster recovery tests."]
["14","8.3.4","Recovery dependencies between systems are tested."]
[null,null,"Where networks and systems are linked to specific service providers and vendors, bilateral or multilateral recovery testing is conducted."]
["15","8.3.5","Business users are involved in the design and execution of comprehensive test cases to verify that recovered systems function properly.  "]
[null,null,"Participation in disaster recovery tests that are conducted by service provider(s)."]
["16","8.4.1","A data backup strategy is developed for the storage of critical information on a regular basis."]
["17","8.4.2","Processes are implemented to review the architecture and connectivity of sub disk storage systems for single points of failure and fragility in functional design and specifications, as well as the technical support by service providers. "]
["18","8.4.3","Periodic testing and validation of the recovery capability of backup media is carried out."]
[null,null,"An assessment is performed to determine if backup media is adequate and sufficiently effective to support the recovery process."]
["19","8.4.4","Backup tapes and disks, including USB disks, containing sensitive or confidential information are encrypted before they are transported offsite for storage."]

{"sheet":"9","index":7,"n_rows":57,"n_cols":8,"rows_kept":57,"cut":false,"hidden":false,"merged":[[21,0,22,0],[21,1,22,1],[16,1,17,1],[55,1,56,1],[55,0,56,0],[35,1,38,1],[35,0,38,0],[43,0,44,0],[43,1,44,1],[41,1,42,1],[41,0,42,0],[46,1,48,1],[46,0,48,0],[25,1,27,1],[25,0,27,0],[32,1,34,1],[32,0,34,0],[30,1,31,1],[30,0,31,0],[23,1,24,1],[23,0,24,0],[28,1,29,1],[28,0,29,0],[16,0,17,0],[19,1,20,1],[19,0,20,0],[7,1,11,1],[0,0,0,7],[3,1,5,1],[3,0,5,0],[12,1,13,1],[12,0,13,0],[7,0,11,0],[14,0,15,0],[14,1,15,1],[8,2,8,7]]}
["9 OPERATIONAL INFRASTRUCTURE SECURITY MANAGEMENT"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","9.0.1","Security solutions are implemented at the data, application, database, operating systems and network layers to adequately address and contain threats."]
["2","9.0.2","Measures are implemented to protect sensitive or confidential information such as customer personal, account and transaction data which are stored and processed in systems.  "]
[null,null,"Customers are properly authenticated before access to online transaction functions and sensitive personal or account information is permitted."]
[null,null,"Customer information including login credentials, passwords and personal identification numbers (PINs) are secured against exploits such as ATM skimming, card cloning, hacking, phishing and malware."]
["3","9.1.1","Important data are identified and adequate measures are adopted to detect and prevent unauthorised access, copying or transmission of confidential information."]
["4","9.1.2","A comprehensive data loss prevention strategy is developed to protect sensitive or confidential information. "]
[null,null,"The data loss prevention strategy takes into consideration the following:"]
[null,null,"a. Data at endpoint - Data which resides in notebooks, personal computers, portable storage devices and mobile devices;"]
[null,null,"b. Data in motion - Data that traverses a network or that is transported between sites; and"]
[null,null,"c. Data at rest - Data in computer storage which includes files stored on servers, databases, backup media and storage platforms."]
["5","9.1.3","Measures are implemented to address risks of data theft, data loss and data leakage from endpoint devices, customer service locations and call centres."]
[null,null,"Confidential information stored in all types of endpoint devices are protected with strong encryption."]
["6","9.1.4","Unsafe internet services such as social media sites, cloud-based internet storage sites, and web-based emails are not used to communicate or store confidential information."]
[null,null,"Measures are implemented to prevent and detect the use of unsafe internet services within the organisation."]
["7","9.1.5","When exchanging confidential information with external parties, utmost care is taken to preserve the confidentiality of confidential information."]
[null,null,"Encryption key is sent via a separate transmission channel to the intended recipients. "]
["8","9.1.6","Confidential information stored on IT systems, servers and databases are encrypted and protected through strong access controls, bearing in mind the principle of “least privilege”. "]
["9","9.1.7","Measures are implemented to prevent the loss of confidential information through the disposal of IT systems.  "]
[null,null,"In determining the appropriate media sanitisation method to use, the security requirements of the data residing on the media are taken into consideration."]
["10","9.2.1","An up-to-date inventory of software and hardware components used in the production and disaster recovery environments is maintained."]
[null,null,"The inventory includes associated warranty and other support contracts related to the software and hardware components."]
["11","9.2.2","IT systems and software are actively managed so that outdated and unsupported systems are replaced on a timely basis.  "]
[null,null,"The end-of-support (“EOS”) date of products is closely monitored as it is common for vendors to cease the provision of patches, including those relating to security vulnerabilities that are uncovered after the product’s EOS date.  "]
["12","9.2.3","A technology refresh plan is established to ensure that systems and software are replaced in a timely manner. "]
[null,null,"A risk assessment for systems approaching EOS dates is conducted to assess the risks of continued usage."]
[null,null,"Effective risk mitigation controls are established where necessary."]
["13","9.3.1","IT systems and devices are configured with security settings that are consistent with the expected level of protection.  "]
[null,null,"Baseline standards are established to facilitate consistent application of security configurations to operating systems, databases, network devices and enterprise mobile devices within the IT environment."]
["14","9.3.2","Regular enforcement checks are conducted to ensure that baseline standards are applied uniformly and non-compliances are detected and raised for investigation."]
[null,null,"The frequency of enforcement reviews is commensurate with the risk level of systems."]
["15","9.3.3","Anti-virus software is deployed to servers, if applicable, and workstations."]
[null,null,"Anti-virus definition files are regularly updated."]
[null,null,"Automatic anti-virus scanning on servers and workstations are scheduled on a regular basis. "]
["16","9.3.4","Network security devices, such as firewalls as well as intrusion detection and prevention systems, are installed at critical junctures to protect network perimeters.  "]
[null,null,"Firewalls, or other similar measures are deployed within internal networks to minimise the impact of security exposures originating from third party or overseas systems, as well as from the internal trusted network."]
[null,null,"Rules on network security devices are regularly backed up."]
[null,null,"Rules on network security devices are regularly reviewed to determine their appropriateness and relevancy."]
["17","9.3.5","Measures are implemented to secure the organisation's Wireless Local Area Networks (WLAN) from unauthorised access.  "]
["18","9.4.1","Vulnerability assessments are conducted regularly to detect security vulnerabilities in the IT environment. "]
["19","9.4.2","Automated tools and manual techniques are used to perform a vulnerability assessment."]
[null,null,"For web-based external facing systems, the scope of vulnerability assessment includes common web vulnerabilities such as SQL injection and cross-site scripting."]
["20","9.4.3","A process is established to remedy issues identified in vulnerability assessments."]
[null,null,"Subsequent validation of the remediation is performed to validate that gaps are fully addressed. "]
["21","9.4.4","Penetration tests on internet-facing systems are conducted at least annually. "]
["22","9.5.1","Patch management procedures are established."]
[null,null,"Patch management procedures include the identification, categorisation and prioritisation of security patches.   "]
[null,null,"Implementation timeframe for each category of security patches is established."]
["23","9.5.2","Security patches are rigorously tested before deployment into the production environment."]
["24","9.6.1","Security monitoring systems and processes are established to facilitate prompt detection of unauthorised or malicious activities by internal and external parties."]
["25","9.6.2","Network surveillance and security monitoring procedures are implemented with the use of network security devices, such as intrusion detection and prevention systems, to protect against network intrusion attacks as well as provide alerts when an intrusion occurs."]
["26","9.6.3","Security monitoring tools which enable the detection of changes to critical IT resources such as databases, system or data files and programs, are implemented to facilitate the identification of unauthorised changes.  "]
["27","9.6.4","Real-time monitoring of security events for critical systems and applications are performed to facilitate the prompt detection of malicious activities on these systems and applications. "]
["28","9.6.5","Security logs of systems, applications and network devices are regularly reviewed for anomalies.  "]
["29","9.6.6","System logs are adequately protected and retained to facilitate future investigation."]
[null,null,"When determining the log retention period, the statutory requirements for document retention and protection are considered."]

{"sheet":"10","index":8,"n_rows":24,"n_cols":8,"rows_kept":24,"cut":false,"hidden":false,"merged":[[20,1,22,1],[20,0,22,0],[11,1,12,1],[11,0,12,0],[13,1,14,1],[13,0,14,0],[15,1,16,1],[15,0,16,0],[18,1,19,1],[18,0,19,0],[8,0,10,0],[8,1,10,1],[0,0,0,7],[3,1,4,1],[3,0,4,0],[5,1,7,1],[5,0,7,0]]}
["10 DATA CENTRES PROTECTION AND CONTROLS"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","10.1.2","Threat and Vulnerability Risk Assessment (TVRA) assessment is based on possible scenarios of threats which include theft, explosives, arson, unauthorised entry, external attacks and insider sabotage. "]
["2","10.1.3","The scope of the TVRA included a review of the DC’s perimeter and surrounding environment, as well as the building and DC facility.  "]
[null,null,"Daily security procedures, critical mechanical and engineering systems, building and structural elements, and physical, operational and logical access controls are reviewed."]
["3","10.1.4","The TVRA report on the DC facility is obtained and assessed when selecting a DC provider."]
[null,null,"TVRA reports are verified to be current and the DC provider is committed to address all material vulnerabilities identified."]
[null,null,"An assessment of threats and vulnerabilities is performed at the feasibility study stage if the organisation chooses to build its own DC."]
["4","10.2.1","Access to the DC is limited to authorised staff only."]
[null,null,"Access to the DC is granted on a need to have basis."]
[null,null,"Physical access of staff to the DC is revoked immediately if it is no longer required."]
["5","10.2.2","Proper notification of and approval for visits by non-DC personnel such as vendors, system administrators or engineers are put in place."]
[null,null,"Visitors are accompanied at all times by an authorised employee while in the DC."]
["6","10.2.3","The perimeter of the DC, DC building, facility, and equipment room are physically secured and monitored.  "]
[null,null,"Physical, human and procedural controls such as the use of security guards, card access systems, mantraps and bollards are deployed where appropriate."]
["7","10.2.4","Security systems and surveillance tools are deployed where appropriate, to monitor and record activities that take place within the DC."]
[null,null,"Physical security measures are established to prevent unauthorised access to systems, equipment racks and tapes."]
["8","10.3.1","The redundancy and fault tolerance of electrical power, air conditioning, fire suppression and data communications are assessed."]
["9","10.3.2","The environment within the DC is rigorously controlled and regulated."]
[null,null,"Any abnormality in environmental conditions is escalated promptly to management and resolved timely."]
["10","10.3.3","Fire protection and suppression systems are implemented in the DC to control a full scale fire if it occurs."]
[null,null,"Smoke detectors and hand-held fire extinguishers are installed in the DC. "]
[null,null,"Passive fire protection elements, such as fire walls are implemented around the DC to restrict the spread of a fire to a portion of the facility. "]
["11","10.3.4","Backup power consisting uninterruptible power supplies, battery arrays, and/or diesel generators are installed to ensure there is sufficient backup power."]

{"sheet":"11","index":9,"n_rows":26,"n_cols":8,"rows_kept":26,"cut":false,"hidden":false,"merged":[[14,1,25,1],[14,0,25,0],[0,0,0,7],[2,0,3,0],[2,1,3,1],[7,1,8,1],[7,0,8,0],[9,1,11,1],[9,0,11,0],[12,1,13,1],[12,0,13,0],[15,2,15,7]]}
["11 ACCESS CONTROL"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","11.1.1","User access to IT systems and networks is granted on a need-to-use basis and within the period when the access is required."]
[null,null,"All requests to access IT resources are duly authorised and approved by the resource owner."]
["2","11.1.2","Employees of vendors or service providers are subjected to close supervision, monitoring and access restrictions similar to those expected of the organisation's own staff."]
["3","11.1.3","Records of user access are uniquely identified and logged for audit and review purposes."]
["4","11.1.4","User access privileges are regularly reviewed to verify that privileges are granted appropriately and according to the ‘least privilege’ principle."]
["5","11.1.5","Strong password controls are enforced over users’ access to applications and systems."]
[null,null,"Password controls include a change of password upon first logon, minimum password length and history, password complexity as well as maximum validity period."]
["6","11.1.6","No person has concurrent access to both production systems and backup systems, particularly data files and computer facilities.  "]
[null,null,"Any person who needs to access backup files or system recovery resources is duly authorised for a specific reason and time only."]
[null,null,"Access is granted for a specific purpose and for a defined period."]
["7","11.2.1","The duties of staff and their access to systems resources are placed under close scrutiny. "]
[null,null,"Stringent selection criteria and thorough screening are applied when appointing staff to critical operations and security functions.  "]
["8","11.2.3","The systems activities of staff with elevated system access entitlements are logged and reviewed. "]
[null,null,"The following controls and security practices are adopted:"]
[null,null,"a. Implement strong authentication mechanisms such as two-factor authentication for privileged users;"]
[null,null,"b. Institute strong controls over remote access by privileged users;"]
[null,null,"c. Restrict the number of privileged users;"]
[null,null,"d. Grant privileged access on a “need-to-have” basis;"]
[null,null,"e. Maintain audit logging of system activities performed by privileged users;"]
[null,null,"f. Disallow privileged users from accessing systems logs in which their activities are being captured;"]
[null,null,"g. Review privileged users’ activities on a timely basis;"]
[null,null,"h. Prohibit sharing of privileged accounts;"]
[null,null,"i. Disallow vendors and contractors from gaining privileged access to systems without close supervision and monitoring; and"]
[null,null,"j. Protect backup data from unauthorised access."]

{"sheet":"12","index":10,"n_rows":27,"n_cols":8,"rows_kept":27,"cut":false,"hidden":false,"merged":[[0,0,0,7],[6,1,7,1],[6,0,7,0],[2,1,3,1],[2,0,3,0],[20,1,22,1],[20,0,22,0],[23,1,25,1],[23,0,25,0],[8,1,9,1],[8,0,9,0],[18,1,19,1],[18,0,19,0],[10,1,11,1],[10,0,11,0],[14,1,15,1],[14,0,15,0],[12,0,13,0],[12,1,13,1]]}
["12 ONLINE FINANCIAL SERVICES "]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","12.0.3","Risks associated with different types of services provided over the internet are clearly identified in the risk management process."]
[null,null,"Security controls and system availability and recovery capabilities that are commensurate with the level of risk exposure, are formulated for all internet operations. "]
["2","12.1.1","A security strategy is devised and measures are put in place to ensure the confidentiality, integrity and availability of data and systems.  "]
["3","12.1.2","Assurance is given to customers and users of internet services that online login access and transactions are adequately protected and authenticated.   "]
["4","12.1.3","Security requirements associated with internet systems are evaluated."]
[null,null,"Only encryption algorithms which are of well-established international standards are adopted."]
["5","12.1.4","Physical and logical access security are implemented to allow only authorised staff to access systems."]
[null,null,"Appropriate processing and transmission controls are implemented to protect the integrity of systems and data."]
["6","12.1.5","Monitoring or surveillance systems are implemented so that the organisation can be alerted of any abnormal system activities, transmission errors or unusual online transactions."]
[null,null,"A follow-up process is established to verify that issues or errors are adequately addressed. "]
["7","12.1.6","High resiliency and availability of online systems and supporting systems (such as interface systems, backend host systems and network equipment) are maintained."]
[null,null,"Measures are put in place to plan and track capacity utilisation as well as guard against online attacks."]
["8","12.1.7","Two-factor authentication at login is implemented for all types of online financial systems."]
[null,null,"Transaction-signing is implemented for authorising transactions."]
["9","12.1.8","A risk assessment is performed on systems which use alternate controls and processes to authorise transactions to ensure that the level of security for these controls and processes, are equivalent or better than using token-based mechanism to authorise transactions."]
["10","12.1.9","Measures are taken to minimise exposure to cyber attacks such as middleman attack."]
["11","12.1.10","Customers are educated on security measures that are put in place to protect them in an online environment."]
[null,null,"Customers have access to continual education to raise their security awareness."]
["12","12.2.3","Security measures which are similar to those of online financial and payment systems are implemented on mobile online services and payment systems."]
[null,null,"A risk assessment is performed to identify possible fraud scenarios."]
[null,null,"Appropriate measures are put in place to counteract payment card fraud via mobile devices. "]
["13","12.2.4","Adequate safeguards are implemented to protect sensitive or confidential information used for mobile online services and payments."]
[null,null,"Sensitive or confidential information are encrypted to ensure the confidentiality and integrity of information in storage and transmission."]
[null,null,"The processing of sensitive or confidential information is performed in a secure environment. "]
["14","12.2.5","Customers are educated on security measures to protect their own mobile devices from viruses and other errant software which cause malicious damage and have harmful consequences."]

{"sheet":"13","index":11,"n_rows":28,"n_cols":8,"rows_kept":28,"cut":false,"hidden":false,"merged":[[21,2,21,7],[21,1,26,1],[21,0,26,0],[15,1,16,1],[15,0,16,0],[17,1,19,1],[17,0,19,0],[9,1,11,1],[9,0,11,0],[0,0,0,7],[2,1,4,1],[2,0,4,0],[5,1,8,1],[5,0,8,0]]}
["13 PAYMENT CARD SECURITY (ATM, CREDIT AND DEBIT CARDS)"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","13.1.1","Adequate safeguards are implemented to protect sensitive payment card data."]
[null,null,"Sensitive payment card data is encrypted to ensure the confidentiality and integrity of these data in storage and transmission."]
[null,null,"The processing of sensitive or confidential information is done in a secure environment."]
["2","13.1.2","Secure chips are deployed to store sensitive payment card data."]
[null,null,"Strong card authentication methods such as dynamic data authentication (DDA) or combined data authentication (CDA) are implemented for online and offline card transactions."]
[null,null,"Magnetic stripes are not used as a mean to store sensitive or confidential information for payment cards."]
[null,null,"Adequate controls are implemented to manage transactions that can only be effected by using information from the magnetic stripe on a card."]
["3","13.1.3","For transactions that customers perform with their ATM cards, only online transaction authorisation is allowed."]
[null,null,"The card issuer, and not a third party payment processing service provider, performs the authentication of customers' sensitive static information, such as PINs or passwords."]
[null,null,"The infrastructure and processes used by service providers are subjected to regular security review."]
["4","13.1.4","Security controls are implemented at payment card systems and networks."]
["5","13.1.5","New payment cards sent to a customer via post are only activated upon obtaining the customer’s instruction.  "]
["6","13.1.6","A dynamic one-time-password (OTP) for card-not-present (CNP) transactions via internet is implemented to reduce fraud risk associated with CNP."]
["7","13.1.7","Cardholders are promptly notified via transaction alerts when withdrawals / charges exceeding customer-defined thresholds are made on their payment cards."]
[null,null,"Information such as the source and amount of the transaction is included in the transaction alert."]
["8","13.1.8","Robust fraud detection systems with behavioural scoring or equivalent are implemented to identify and curb fraudulent activities."]
[null,null,"Robust fraud detection systems with correlation capabilities are implemented to identify and curb fraudulent activities."]
[null,null,"To enhance fraud detection capabilities, risk management parameters according to risks posed by cardholders, the nature of transactions or other risk factors are set out."]
["9","13.1.9","Transactions exhibiting behaviour which deviates significantly from a cardholder’s usual card usage patterns are investigated and cardholder’s authorisation are obtained prior to completing the transaction."]
["10","13.2.2","The following measures are put in place to counteract fraudsters’ attacks on ATMs and payment kiosks:"]
[null,null,"a. Install anti-skimming solutions on these machines and kiosks to detect the presence of foreign devices placed over or near a card entry slot;"]
[null,null,"b. Install detection mechanisms and send alerts to appropriate staff at the organisation for follow-up response and action; "]
[null,null,"c. Implement tamper-resistant keypads to ensure that customers’ PINs are encrypted during transmission;"]
[null,null,"d. Implement appropriate measures to prevent shoulder surfing of customers’ PINs; and "]
[null,null,"e. Conduct video surveillance of activities at these machines and kiosks; and maintain the quality of CCTV footage."]
["11","13.2.3","Physical security measures are implemented at third party payment kiosks, which accept and process the organisation's payment cards."]

{"sheet":"14","index":12,"n_rows":10,"n_cols":8,"rows_kept":10,"cut":false,"hidden":false,"merged":[[8,1,9,1],[8,0,9,0],[6,1,7,1],[6,0,7,0],[0,0,0,7],[4,1,5,1],[4,0,5,0]]}
["14 IT AUDIT"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","14.0.3","Organisational structure and reporting lines for IT audit are established in a way that preserves the independence and objectivity of the IT audit function. "]
["2","14.1.1","The scope of IT audit is comprehensive and includes all critical IT operations. "]
["3","14.1.2","An IT audit plan, comprising auditable IT areas for the coming year, is developed."]
[null,null,"The IT audit plan is approved by the organisation's Audit Committee.  "]
["4","14.1.3","An audit cycle that determines the frequency of IT audits is established."]
[null,null,"The audit frequency is commensurate with the criticality and risk of the IT system or process."]
["5","14.1.4","A follow-up process is established to track and monitor IT audit issues."]
[null,null,"An escalation process is established to notify the relevant IT and business management of key IT audit issues."]

{"sheet":"Appendix A","index":13,"n_rows":47,"n_cols":8,"rows_kept":47,"cut":false,"hidden":false,"merged":[[25,2,25,7],[30,2,30,7],[35,2,35,7],[4,1,46,1],[4,0,46,0],[8,2,8,7],[9,2,9,7],[16,2,16,7],[38,2,38,7],[40,2,40,7],[42,2,42,7],[18,2,18,7],[21,2,21,7],[0,0,0,7],[2,1,3,1],[2,0,3,0],[4,2,4,7],[5,2,5,7]]}
["APPENDIX A: SYSTEMS SECURITY TESTING AND SOURCE CODE REVIEW"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","A.1.1","Rigorous testing of systems is conducted to verify the security, reliability and availability of systems under normal and extreme conditions.  "]
[null,null,"A review of the system source code  is included in the system development life cycle (SDLC) to  identify and detect threats and weaknesses in systems."]
["2","A.1.2","The following areas are considered during system testing and source code review:"]
[null,null,"a. Information Leakage "]
[null,null,"Sensitive or confidential information such as cryptographic keys, account details, passwords, system configurations and database connection strings are protected.  "]
[null,null,"Potential sources of information leakages like verbose error messages and banners, hard-coded data, files and directories operations for accidental information disclosure are scrutinised."]
[null,null,"b. Resiliency Against Input Manipulation  "]
[null,null,"Data validation includes the following:"]
[null,null,"i. all inputs to an application should be validated;"]
[null,null,"ii. all forms of data (such as text boxes, select boxes and hidden fields) should be checked;"]
[null,null,"iii. the handling of null and incorrect data input should be verified;"]
[null,null,"iv. content formatting should be checked; and"]
[null,null,"v. maximum length for each input field should be validated."]
[null,null,"All input validation routines are reviewed and tested to assess their effectiveness against known vulnerabilities. "]
[null,null,"c. Unsafe Programming Practices "]
[null,null,"Unsafe programming practices are identified during source code review."]
[null,null,"d. Deviation From Design Specifications "]
[null,null,"Critical modules such as those containing authentication and session management functions are reviewed for any deviation from design specifications. "]
[null,null,"Testing of authentication functions cover the verification of security requirements (such as credential expiry, revocation and reuse) and the protection of cryptographic keys.  "]
[null,null,"Session management is tested to ensure that:"]
[null,null,"i. sensitive or confidential information that is stored in cookies is encrypted; "]
[null,null,"ii. the session identifier is random and unique; and"]
[null,null,"iii. the session expires after a pre-defined length of time."]
[null,null,"e. Cryptographic Functions "]
[null,null,"Cryptographic implementation is evaluated to ensure that only cryptographic modules that are based on authoritative standards and reputable protocols are installed."]
[null,null,"Cryptographic algorithms and crypto-key configurations are reviewed for deficiencies and loopholes."]
[null,null,"The choice of ciphers, key sizes, key exchange control protocols, hashing functions and random number generators is thoroughly assessed.  "]
[null,null,"Rigorous testing is conducted on all cryptographic operations (encryption, decryption, hashing, signing) and key management procedures (generation, distribution, installation, renewal, revocation and expiry). "]
[null,null,"f. Exception Handling"]
[null,null,"Adequate controls are in place when exception or abnormal conditions occur, so that resulting errors do not allow users to bypass security checks or obtain core dumps."]
[null,null,"Sufficient processing details are logged at the source of the exception to assist problem diagnosis."]
[null,null,"Robust exception/error handling that facilitates fail-safe processing under various exception conditions is implemented."]
[null,null,"Leakage of sensitive or confidential information due to improper error handling is prevented."]
[null,null,"g. Business Logic "]
[null,null,"Business logic is tested to ensure that a user cannot perform an unauthorised function or transaction."]
[null,null,"Negative testing is included in the test to determine the response of a system when an unexpected input is received."]
[null,null,"h. Authorisation "]
[null,null,"Tests are performed to confirm that the actual access rights granted to a user in the system conform to the approved security access matrix.  "]
[null,null,"i. Logging "]
[null,null,"Logging is implemented to facilitate follow-up investigation and troubleshooting when a system incident occurs."]
[null,null,"The following requirements and specifications are built into system testing:"]
[null,null,"a. sensitive or confidential information such as passwords, authentication credentials, cryptographic keys, confidential business data should not be recorded in system logs;"]
[null,null,"b. the maximum data length for logging is pre-determined;"]
[null,null,"c. successful and unsuccessful authentication attempts are logged; and"]
[null,null,"d. successful and unsuccessful authorisation events are logged."]

{"sheet":"Appendix B","index":14,"n_rows":15,"n_cols":8,"rows_kept":15,"cut":false,"hidden":false,"merged":[[13,1,14,1],[13,0,14,0],[10,1,12,1],[10,0,12,0],[8,1,9,1],[8,0,9,0],[0,0,0,7],[5,1,7,1],[5,0,7,0],[2,1,4,1],[2,0,4,0]]}
["APPENDIX B: STORAGE SYSTEM RESILIENCY"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","B.2.1","The architecture and connectivity of storage systems used by critical applications are regularly reviewed for single points of failure and fragility in functional design and specifications."]
[null,null,"Technical support performed in-house and by vendors are regularly reviewed."]
[null,null,"The resiliency of storage systems for both centralised and distributed systems are regularly reviewed."]
["2","B.2.2","Redundancy is incorporated in all SAN components. "]
[null,null,"Multiple links and switches are installed for all Input/Output operations between hosts, adapters, storage processors and storage arrays."]
[null,null,"A high availability, resilient and flexible SAN architecture is established."]
["3","B.2.3","A sound patch management process is established to update storage systems with the latest stable and proven microcode release on a timely basis.  "]
[null,null,"The deployment of configuration changes and upgrades to storage systems is governed by a rigorous change management process."]
["4","B.2.4","In-house alert and monitoring capability are established for early detection of warnings and outages in storage systems and data replication mechanisms.  "]
[null,null,"The implementation of vendor call-home capability to perform advanced diagnostics and remediation is considered."]
[null,null,"Oversight of diagnostics and remediation activities, whether performed in-house or by vendors, is maintained to minimise the risk of multiple failures, human errors and security breaches."]
["5","B.3.1","The architecture of the storage system has the capability to switch over from the primary production site to an alternate site to meet expected RTO and RPO in the event of a major site outage."]
[null,null,"The recoverability and consistency of data at the alternate site are regularly tested."]

{"sheet":"Appendix C","index":15,"n_rows":22,"n_cols":8,"rows_kept":22,"cut":false,"hidden":false,"merged":[[20,1,21,1],[20,0,21,0],[0,0,0,7],[6,1,9,1],[6,0,9,0],[10,1,11,1],[10,0,11,0],[18,1,19,1],[18,0,19,0],[2,1,3,1],[2,0,3,0],[12,1,13,1],[12,0,13,0]]}
["APPENDIX C: CRYPTOGRAPHY"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","C.2.2","Functions that involved cryptographic algorithms and crypto-key configurations are vetted for deficiencies and loopholes."]
[null,null,"The choice of ciphers, key sizes, key exchange control protocols, hashing functions and random number generators are evaluated."]
["2","C.2.3","There is sufficient size and randomness of the seed number to preclude the possibility of optimised brute force attack."]
["3","C.3.1","Cryptographic key management policy and procedures covering key generation, distribution, installation, renewal, revocation and expiry are established. "]
["4","C.3.2","Cryptographic keys are generated securely.  "]
[null,null,"All materials used in the key generation process are destroyed after usage."]
[null,null,"No single individual knows any key in its entirety or has access to all the constituents making up the keys."]
[null,null,"All keys are created, stored, distributed or changed under stringent conditions."]
["5","C.3.3","Unencrypted symmetric keys are entered into tamper-resistant device, such as hardware security module, only in the form of at least two components using the principles of dual control."]
[null,null,"Cryptographic keys are used for a single purpose to reduce the impact of an exposure of a key.  "]
["6","C.3.4","The appropriate cryptoperiod for each cryptographic key is considered and decided."]
[null,null,"The frequency of key changes is determined by the sensitivity of data and operational criticality. "]
["7","C.3.5","Hardware security modules and keying materials are physically and logically protected. "]
["8","C.3.6","Cryptographic keys are not exposed during usage and transmission. "]
["9","C.3.7","When cryptographic keys expired, a secure key destruction method is used to ensure keys could not be recovered by any parties. "]
["10","C.3.8","When changing a cryptographic key, a new key is generated independently from the previous key."]
["11","C.3.9","A backup of cryptographic keys is maintained."]
[null,null,"The same level of protection as the original cryptographic keys is accorded to backup keys. "]
["12","C.3.10","Compromised keys and all keys encrypted under or derived from compromised keys are immediately revoked, destroyed and replaced."]
[null,null,"All parties concerned with the revocation of the compromised keys are informed."]

{"sheet":"Appendix D","index":16,"n_rows":17,"n_cols":8,"rows_kept":17,"cut":false,"hidden":false,"merged":[[11,1,13,1],[11,0,13,0],[14,1,16,1],[14,0,16,0],[0,0,0,7],[3,1,4,1],[3,0,4,0],[6,1,10,1],[6,0,10,0],[6,2,6,7]]}
["APPENDIX D: DISTRIBUTED DENIAL-OF-SERVICE PROTECTION"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","D.2.1","Appropriate equipment is deployed to facilitate the detection of and response to distributed denial-of-service (DDoS) attacks."]
["2","D.2.2","Devices such as application and network firewalls, network and host-based intrusion detection/preventions systems, routers and other specialised equipment are installed and configured to alert security staff and divert and/or filter network traffic in real-time once an attack is suspected or confirmed."]
[null,null,"Purpose-built appliances designed for high-speed performance are used to remove malicious packets so that legitimate traffic en route to the internet banking and trading systems could flow through."]
["3","D.2.3","Source code review, network design analysis and configuration testing are performed to identify potential bottlenecks and single points of failure."]
["4","D.3.2","When selecting an internet service provider (ISP),  the following are evaluated:"]
[null,null,"a. whether an ISP offers DDoS protection or clean pipe services to assist in detecting and deflecting malicious traffic;"]
[null,null,"b. the ability of the ISP to scale up network bandwidth on demand;"]
[null,null,"c. the adequacy of an ISP’s incident response plan; and"]
[null,null,"d. the ISP’s capability and readiness in responding quickly to an attack."]
["5","D.4.1","An incident response framework is developed."]
[null,null,"The incident response framework is routinely validated to facilitate fast response to a DDoS onslaught or an imminent attack."]
[null,null,"A plan detailing the immediate steps to be taken to counter an attack, invoke escalation procedures, activate service continuity arrangements, trigger customer alerts, and report any such attack to MAS is developed."]
["6","D.4.2","Incident response plans of ISPs are assimilated into the incident response framework.  "]
[null,null,"A communication protocol is established with ISPs. "]
[null,null,"Periodic joint incident response exercises are conducted with ISPs."]

{"sheet":"Appendix E","index":17,"n_rows":16,"n_cols":8,"rows_kept":16,"cut":false,"hidden":false,"merged":[[11,1,12,1],[11,0,12,0],[14,1,15,1],[14,0,15,0],[0,0,0,7],[3,1,6,1],[3,0,6,0],[8,1,10,1],[8,0,10,0]]}
["APPENDIX E: SECURITY MEASURES FOR ONLINE SYSTEMS"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","E.2.1","Adequate controls and security measures are implemented to minimise exposure to man-in-the middle attacks (MITMA)."]
["2","E.2.2","Digital signatures and key-based message authentication codes (KMAC) are used for transaction-signing of high-risk transactions to detect unauthorised modification or injection of transaction data in a MITMA."]
[null,null,"The customer using a hardware token is able to distinguish the process of generating a one-time password from the process of digitally signing a transaction."]
[null,null,"What the customer signs digitally is meaningful to him."]
[null,null,"Different crypto keys are used for generating OTPs and for signing transactions."]
["3","E.2.3","A time window that is as short as practicable is established to lower the risks of OTP misuse."]
["4","E.2.4","Customers are notified through a second channel, of high-risk transactions as well as payment or fund transfer above a specified value determined by customers."]
[null,null,"The notifications contain meaningful information such as type of transaction and payment amounts.  "]
[null,null,"The notification is sent to a customer’s device that is not used to perform the transaction."]
["5","E.2.5","Secure Socket Layer (SSL) is implemented to provide communication security."]
[null,null,"End-to-end encryption security at the application layer is implemented so that PINs and passwords are not exposed at any intermediate nodes between the browser and the host where PINs and passwords are verified."]
["6","E.2.6","An online session is automatically terminated after a fixed period of time unless the customer is re-authenticated."]
["7","E.2.7","Customers using the internet application are informed about how they should react to SSL server certificate warning. "]
[null,null,"Customers are advised to inform the organisation immediately of warning messages on the internet application."]

{"sheet":"Appendix F","index":18,"n_rows":48,"n_cols":8,"rows_kept":48,"cut":false,"hidden":false,"merged":[[18,2,18,7],[18,1,23,1],[18,0,23,0],[31,2,31,7],[31,1,44,1],[31,0,44,0],[29,1,30,1],[29,0,30,0],[45,1,47,1],[45,0,47,0],[24,1,26,1],[24,0,26,0],[16,1,17,1],[16,0,17,0],[13,1,15,1],[13,0,15,0],[0,0,0,7],[2,1,3,1],[2,0,3,0],[4,1,12,1],[4,0,12,0],[4,2,4,7]]}
["APPENDIX F: CUSTOMER PROTECTION AND EDUCATION"]
["Item","TRMG Section","Guideline Description","Full        Compliance","Partial Compliance","Non-        compliance","NA","Comments"]
["1","F.2.1","Software are not distributed to customers via the internet or through a web-based system unless adequate security and safeguards are provided for customers.  "]
[null,null,"Appropriate measures are implemented to alert and assist customers in verifying the origin and integrity of downloaded software."]
["2","F.2.2","The following control measures are observed when handling customers’ login credentials for online applications:"]
[null,null,"a. Implement dual control and/or segregation of duties in the generation of passwords, printing of password mailers and activation of online accounts;"]
[null,null,"b. Print password mailers in a secure location where physical access is restricted and monitored;"]
[null,null,"c. Destroy all mailer spoilages immediately and generate a new password for each reprint;"]
[null,null,"d. Destroy all stationery which may contain any password imprint during mailer printing;"]
[null,null,"e. Strengthen password dissemination process to ensure that passwords are not being exposed or compromised;"]
[null,null,"f. Ensure that passwords are not processed, transmitted or stored in clear-text;"]
[null,null,"g. Require customers and system users to change issued passwords immediately upon first login; and"]
[null,null,"h. Only distribute a hardware token that has been assigned to a customer account."]
["3","F.2.3","Customers are informed about the risks and benefits of using online financial services before they subscribe to the services.  "]
[null,null,"Customers are clearly and precisely informed of theirs as well as the organisation's respective rights, obligations and responsibilities on all matters relating to online transactions, and in particular, any problems that may arise from processing errors and security breaches.  "]
[null,null,"The information is presented in an easy to understand format.  "]
["4","F.2.4","Terms and conditions that apply to online financial services are readily available to customers within the internet application."]
[null,null,"Positive acknowledgement of the terms and conditions from the customer is required from the customer on initial logon or subscription to a particular service."]
["5","F.2.5","The following disclosures are posted on the organisation's website:"]
[null,null,"Customer privacy and security policy. "]
[null,null,"Customer dispute handling, reporting and resolution procedures, including the expected timing for the FI's response."]
[null,null,"An explanation on the process to resolve the problem or dispute, as well as the conditions and circumstances in which the resultant losses or damages would be attributable to the FI or its customers if security breaches occur. "]
[null,null,"Security measures and reasonable precautions that customers should take when accessing their online accounts."]
[null,null,"Precautionary procedures include taking adequate steps to prevent unauthorised transactions and fraudulent use of customers' accounts, as well as making sure that no one else would be able to observe or steal their access credentials or other security information to impersonate them or obtain unauthorised access to their online accounts. "]
["6","F.2.6","An authenticated session, together with its encryption protocol, remains intact throughout the interaction with the customer."]
[null,null,"In the event of interference, measures are in place to ensure that the session is terminated and the affected transactions are resolved or reversed out. "]
[null,null,"Customers are promptly notified of such an incident as the session is being concluded or subsequently by email, telephone or through other means."]
["7","F.3.1","Customers are educated on the security and reliability of their interaction with the organisation. "]
["8","F.3.2","When new operating features or functions relating to security, integrity and authentication are being introduced for the online financial services, sufficient instruction and information on the new features and functions are provided to customers."]
["9","F.3.3","Customers are reminded on the need to protect their PINs, security tokens, personal details and other confidential data."]
[null,null,"Static PIN and OTP security instructions are displayed prominently in the user login page or the USER ID, PIN and OTP entry page. "]
["10","F.3.4","Customers are advised to adopt the following security precautions and practices:"]
[null,null,"a. Install anti-virus, anti-spyware and firewall software in their personal computers and mobile devices;"]
[null,null,"b. Update operating systems, anti-virus and firewall products with security patches or newer versions on a regular basis;"]
[null,null,"c. Remove file and printer sharing in computers, especially when they are connected to the internet;"]
[null,null,"d. Make regular backup of critical data;"]
[null,null,"e. Consider the use of encryption technology to protect highly sensitive or confidential information;"]
[null,null,"f. Log off the online session;"]
[null,null,"g. Clear browser cache after the online session;"]
[null,null,"h. Do not install software or run programs of unknown origin;"]
[null,null,"i. Delete junk or chain emails;"]
[null,null,"j. Do not open email attachments from strangers;"]
[null,null,"k. Do not disclose personal, financial or credit card information to little-known or suspect websites;"]
[null,null,"l. Do not use a computer or a device which cannot be trusted; and"]
[null,null,"m. Do not use public or internet café computers to access online services or perform financial transactions."]
["11","F.3.5","Customers are educated on the features of payment cards such as ATM, credit and debit cards as well as their associated risks."]
[null,null,"Adequate information and instructions are provided to customers on the security features of cards and the steps to report card loss or fraud cases."]
[null,null,"Updated security information and best practice guidelines are provided to customers in a user-friendly manner."]