Implement Tier 3 Additional Controls per MTCS SS 584 for highest sensitivity workloads (critical systems + government classified + Critical Information Infrastructure CII + MAS-regulated systemically-important systems + healthcare clinical data + Restricted/Sensitive/Confidential government data). Enhanced governance: Board-level oversight + monthly Risk Committee + quarterly Board reporting + annual independent risk assessment. Enhanced data residency: Singapore mandatory + restrictions on data egress + cross-border transfer requires MAS approval (financial) or specific approval (government) + Sovereign Cloud requirements + multi-tenant isolation proof. Enhanced encryption: Customer-Managed Keys (CMK) mandatory + Bring Your Own Key (BYOK) + Hold Your Own Key (HYOK) + Hardware Security Module (HSM) integration + Post-Quantum Cryptography (PQC) readiness + algorithm rotation policies. Enhanced access controls: Zero standing privileges + Just-in-time access + Privileged Access Workstation (PAW) + segregation of duties + dual-person controls for critical operations + biometric authentication + continuous authentication. Enhanced monitoring: 24x7 SOC with named contact + < 15 minute response SLA + Cloud SIEM integration + threat hunting + behavioural analytics + insider threat programme + DLP. Enhanced incident response: 1-hour notification SLA (faster than Tier 2 24-hour) + dedicated incident commander + crisis communications + forensic readiness + post-incident review + lessons learned. Tier 3 audit: Stage 1 + Stage 2 + Stage 3 (residual risk assessment) + annual surveillance + 3-year recertification + sample customer interviews. Sectoral mappings: MAS Notice 658 Cloud Material Outsourcing requires Tier 2/3 + GovTech IM8 requires Tier 3 + MOH NEHR requires Tier 3 + CSA CCoP for CII requires Tier 3 + Smart Nation Sensor Platform Tier 3 + Government Commercial Cloud (GCC) requires Tier 3.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.