Monetary Authority of Singapore Technology Risk Management Guidelines 5.3: 5.3 System Acquisition

The FI should set standards and procedures for vendor evaluation and selection, with due diligence commensurate with the criticality of deliverables; assess the robustness of the vendor's development and quality assurance practices and ensure stringent security over any sensitive data the vendor accesses, with vendor access to FI systems controlled and monitored; for commercial off-the-shelf solutions that miss security requirements, assess the risk and implement mitigating controls before deployment; and decide, by the software's criticality, whether a source code escrow agreement is needed, identifying replacement alternatives where escrow cannot be arranged.