Monetary Authority of Singapore Technology Risk Management Guidelines 11.1: 11.1 Data Security

The FI should have comprehensive data loss prevention policies and measures to detect and prevent unauthorised access, modification, copying or transmission of confidential data in motion, at rest (endpoints, servers, databases, backup media, cloud storage) and in use; prevent and detect data theft and unauthorised modification, applying the same protection to systems managed by service providers; encrypt confidential data on systems and endpoints and protect it with strong access controls; allow only authorised storage media, systems and endpoints to handle confidential data; prevent and detect use of unauthorised internet services such as social media, cloud storage, file sharing, email and messaging to move confidential data; restrict production data in non-production environments to exceptions approved by senior management, with access and removal controls and masking where possible; and irrevocably delete confidential data from media, systems and devices before disposal or redeployment.