What it covers
MAS does not approve data room vendors. It sets expectations for the firms it regulates, and those firms pass the expectations on to their suppliers. The Technology Risk Management Guidelines cover governance, IT project and vendor management, cyber security, access control, cryptography, incident management and resilience. The outsourcing guidelines add requirements when a service is material to the firm, and the cyber hygiene notices make some controls, such as multi-factor authentication for privileged and remote access, mandatory.
For a data room this usually shows up as a security questionnaire and a contract review. Procurement and IT risk teams at a bank or fund manager will ask for SOC 2 or ISO 27001 reports, penetration test summaries, encryption details, where data is hosted, how access is logged, how incidents are reported and how data is returned and deleted at the end.
The level of scrutiny depends on the use. A data room for a one-off sale of a non-core subsidiary may be treated differently from an ongoing platform holding customer data. Either way, a vendor that already has the documents ready shortens the review considerably.
Key provisions and what they mean in the room
| Rule | What it says | In the data room |
|---|---|---|
| Technology Risk Management Guidelines | Principles and practices for managing technology risk, including third-party services, access control and cryptography. | Expect questions on encryption at rest and in transit, admin access and logging. |
| Guidelines on outsourcing | Due diligence, contract terms, audit access and business continuity for outsourced services, with more for material arrangements. | Contracts may need audit rights, incident notice periods and data return clauses. |
| Cyber hygiene notices | Legally binding baseline controls such as multi-factor authentication and security patching. | Two-factor login for every user is a minimum. |
| Cloud advisory | MAS guidance on using public cloud services, including shared responsibility and data location. | Ask where data is hosted and which cloud provider sits underneath. |
Setting up the room
Prepare the vendor pack early
Ask the vendor for its SOC 2 report, ISO certificate, penetration test letter and standard security questionnaire answers before procurement starts.
Turn on strong login controls
Require two-factor authentication for all users and SSO for internal staff if the vendor supports it.
Log everything
Make sure activity logs can be exported for the firm's own audit and incident records.
Agree the exit
Document how the archive is delivered and how data is deleted when the project closes.
Checklist
- Vendor certifications and audit reports reviewed.
- Hosting region and cloud provider documented.
- Two-factor login for every user.
- Activity log export tested.
- Incident notification terms in the contract.
- Data return and deletion process agreed.
Source: MAS Technology Risk Management Guidelines (January 2021); MAS Guidelines on Outsourcing; MAS Notices on Cyber Hygiene. This page is general information, not legal or tax advice.
Questions people ask
Does MAS approve or certify data room providers?
No. MAS regulates financial institutions, not their software suppliers. The institution must assess the vendor under the MAS guidelines and notices, which is why banks and fund managers run detailed security reviews.
Is a data room an outsourcing arrangement under MAS guidelines?
It can be, depending on what the service does and how material it is to the institution. Many firms treat a project data room as a technology service subject to vendor due diligence, and apply the outsourcing guidelines where the arrangement is material. Check with your compliance team.
Which certifications do Singapore banks ask for?
Most ask for ISO 27001 certification or a SOC 2 Type II report, plus penetration test results, encryption details and a completed security questionnaire.