Monetary Authority of Singapore Technology Risk Management Guidelines 9.1: 9.1 User Access Management

Access should follow the principles of never alone, segregation of duties and least privilege so no one person can perform sensitive system functions (such as system initialisation, PIN generation, key creation or administrative account use), with rights granted according to roles of staff, contractors and service providers. The FI should have a process to provision, change and revoke access, authorised by appropriate parties such as asset owners; uniquely identify and log user access and user management activity; enforce a strong password policy (change at first logon, minimum length, history, complexity); implement multi-factor authentication for users with access to sensitive system functions; have asset owners perform periodic access reviews that find dormant and redundant accounts and inappropriate rights, resolving exceptions promptly; grant access only on need-to-use and revoke it promptly on transfer or termination; and apply the same monitoring and restrictions to service providers with access.