Monetary Authority of Singapore Technology Risk Management Guidelines 7.7: 7.7 Incident Management

The FI should have an incident management framework aimed at restoring affected IT services to a secure and stable state quickly, with sufficient resources (external incident response and forensic support may augment them), covering at least the handling process for IT and cyber incidents, preservation of evidence, and the roles of staff and external parties in recording, analysis, escalation, decision-making, resolution and monitoring. System events and alerts should be configured and actively monitored for early warning; senior management should be kept informed of major incidents so crisis decisions such as disaster recovery activation are timely; a communications plan should cover customer notification and media handling with spokespersons, experts and channels; and customers should get timely updates and, where appropriate, advice on protecting themselves.