Monetary Authority of Singapore Technology Risk Management Guidelines CHN.4.2: Notice on Cyber Hygiene 4.2: apply security patches within a risk-based timeframe

The FI must ensure security patches are applied to every system to address vulnerabilities, within a timeframe commensurate with the risk each vulnerability poses, and where no patch exists must institute controls to reduce the risk. The FAQ calls for severity assessment and a remediation plan reflecting system criticality and vulnerability risk, and compensating measures such as network devices that intercept exploit payloads for unpatched zero-day vulnerabilities.