MAS Notice FSM-N06, issued 9 May 2024 and effective 10 May 2024, sets six cyber hygiene practices for banks in Singapore: secure administrative accounts, apply security patches, keep written security standards, defend the network perimeter, deploy malware protection and use multi-factor authentication for defined accounts. A notice is binding, unlike the TRM guidelines.
The six practices
4.1 Administrative accounts: every administrative account on any operating system, database, application, security appliance or network device must be secured against unauthorised access or use.
4.2 Security patches: patches must be applied to every system within a timeframe commensurate with the risk of each vulnerability. Where no patch is available, the bank must put controls in place to reduce the risk.
4.3 Security standards: a written set of security standards for every system, with every system conforming, or controls to reduce the risk of any non conformity.
4.4 Network perimeter defence: controls at the network perimeter to restrict all unauthorised network traffic.
4.5 Malware protection: one or more measures on every system, where such measures are available and can be implemented.
4.6 Multi-factor authentication: for all administrative accounts on critical systems, and for all accounts on any system used to access customer information through the internet.
Definitions that matter
A "vulnerability" is any weakness, susceptibility or flaw that can be exploited, including by allowing an unauthorised person access or compromising security configuration settings. A "critical system" is one whose failure would significantly disrupt operations or materially impact service to customers. A "system" is any hardware or software used by the bank, so applications and libraries are in scope.
Paragraph 3.1 also gives relief when a bank cannot control a system directly or indirectly through the provider, and cannot reasonably replace the provider.
What this means for software teams
- Patching: the notice says "commensurate with the risks", so you need a risk rating method and a record of when each patch landed. A clear method for software dependencies helps, since they are part of every system.
- No patch available: have a mitigation playbook such as a configuration change, a WAF rule or disabling a feature, and record it.
- Standards: write them, and check systems against them automatically where possible.
- MFA: include service and admin consoles, not only the main login.
For vendors to banks
Expect a bank to ask how fast you ship fixes and how you handle a flaw with no fix yet. Prepare a patch policy with target times by severity and a mitigations list.
Try it yourself
In the demo, find a vulnerability that has a fix available and one that does not, and compare the actions it suggests.
Click through it at your own pace, or open it full screen.
Safeguard's policies can set fix windows by risk, and autonomous remediation can open fix PRs, off by default with every category on manual. These support a patch process, not the notice itself.
Quick check
Does the notice give a fixed number of days to patch?
No. It says a timeframe commensurate with the risk of each vulnerability.
Does it apply to insurers?
This notice is for banks in Singapore. Insurers have their own technology risk notice.
Sources
Last reviewed: 19 October 2026.
