{"id":1536,"date":"2019-08-20T09:48:58","date_gmt":"2019-08-20T04:18:58","guid":{"rendered":"https:\/\/www.cloud-kinetics.com\/?p=1536"},"modified":"2024-06-21T12:37:04","modified_gmt":"2024-06-21T07:07:04","slug":"abs-guidelines-for-singapore-banks","status":"publish","type":"post","link":"https:\/\/www.cloud-kinetics.com\/blog\/abs-guidelines-for-singapore-banks\/","title":{"rendered":"ABS Guidelines For Singapore Banks"},"content":{"rendered":"

The Association of Banks in Singapore (ABS) has recently released the second version of the implementation guide for Financial Institutions (FIs) when entering into Cloud outsourcing arrangements, as well as the on-going maintenance. The first version was released in 2016 and significant technological advancements since then have prompted the ABS to release an update to address these changes. It is also intended to further support the practice of migrating material workloads to the Cloud, including systems of record and those classified as Monetary Authority of Singapore (MAS) Critical. Please refer to MAS Notice 644 for the definition of MAS Critical.<\/p>\n

The Guide is intended to assist Financial Institutions in understanding approaches to due diligence, vendor management and key controls that should be implemented on an on-going basis in Cloud outsourcing arrangements. It can also be used by Cloud Service Providers (CSPs) to better understand what is required to achieve successful Cloud outsourcing arrangements with FIs.<\/p>\n

Cloud outsourcing classification<\/h2>\n

ABS has also provided guidance as to the definition of differing risk categories in Cloud outsourcing arrangements and what is likely to constitute material and non-material outsourcing in the context of cloud. This guidance helps FIs understand the inherent risk profile of a Cloud Outsourcing arrangement, and then ensure that appropriate controls are in place.<\/p>\n

A broad guideline for the classification of material and non-material outsourcing is given as below. This is to be used as only a broad guideline and the final decision should be made based on the FI\u2019s risk appetite.<\/p>\n

Cloud Outsourcing Category<\/h2>\n

Non-Material<\/h2>\n

Non-Material Common characteristics:<\/h4>\n

\u2022 Staff data which does not include bank account or credit card data (e.g. information on name cards)
\n\u2022 Development and Test environments
\n\u2022 Services not defined as \u2018critical\u2019<\/p>\n

Non-Material Examples:<\/h4>\n

\u2022 Application binaries, or risk management quant libraries that are being tested on masked data (i.e. performance & volume testing, regression testing, or Monte Carlo simulations)
\n\u2022 Information Security solutions such as Managed Security Services \/ Operations Centres, where information assets are encrypted and logically segregated
\n\u2022 Websites for accessing information that is classified as \u2018public\u2019
\n\u2022 Service Management applications<\/p>\n

Material:<\/h2>\n

Material Common characteristics:<\/h4>\n

\u2022 Use of customer information, the unauthorized access or disclosure, loss or theft of which may have a material impact on the customer
\n\u2022 Use of staff data, including Personally Identifiable Information (PII), payroll and bank account or credit card data
\n\u2022 Software used for the trading of financial instruments or other transactions
\n\u2022 Financial Risk management systems (Market, Credit and Liquidity)
\n\u2022 Non-public commercially sensitive information that could influence financial markets
\n\u2022 Regulatory reporting or accounting data
\n\u2022 Outsourced business activity as defined as critical by the FI
\n\u2022 Systems of record, including core banking applications
\n\u2022 Any Cloud based implementation of a system classified as \u2018MAS Critical\u2019<\/p>\n

Material Examples:<\/h4>\n

\u2022 Email and document storage
\n\u2022 Authentication services providing One Time Passwords (OTP) or 2 Factor Authentication (2FA)
\n\u2022 Vulnerability Scanning Services<\/p>\n

Activities recommended as part of due diligence<\/h4>\n

ABS has further laid out recommended due diligence process and vendor management activities for Cloud outsourcing arrangements. The recommendations cover pre-engagement of the CSP as well as on-going risk assessment and oversight. Again, FIs are recommended to take a risk-based approach and understand the applicability for their specific outsourcing arrangement.<\/p>\n

Governance<\/h4>\n

FIs are encouraged to establish a risk management and governance framework to assist in the identification and monitoring of risks during cloud adoption. Expectations should be agreed between the CSP and the FI, in particular with regard to operational contract management, SLA management, technology risk management, business continuity management and contract exit. The contractual terms and conditions governing the roles, relationships, obligations and responsibilities of all contracting parties are set out fully in written agreements.<\/p>\n

Assessment of the Cloud Service Provider<\/h4>\n

ABS has highlighted data confidentiality, financial, operational and reputational factors including the ethical and professional standards held by the CSP and the CSP\u2019s ability to comply with its obligation under the outsourcing arrangement as top considerations while assessing a CSP.<\/p>\n

The scope of assessment of a CSP should minimally include the DC\u2019s perimeter, physical and environmental security, natural disasters, and the political and economic climate of the country in which the Data Centre resides.<\/p>\n

Contractual Considerations<\/h4>\n

When negotiating a contract with a CSP, the FI should ensure that it has the ability to contractually enforce agreed and measurable information security and operational requirements. FI is directed to ensure that outsourcing contract includes:<\/p>\n