IM8 and MAS TRM Questions Singapore Buyers Should Ask Cloud and Software Vendors

Singapore buyers evaluating cloud and custom software vendors get stuck on naming: search shorthand still says IM8 cloud outsourcing Singapore, while regulated banks must also map vendors to binding MAS outsourcing notices and the MAS Technology Risk Management (TRM) Guidelines. This article is a copy-paste diligence questionnaire—IM8-aligned cloud themes crossed with MAS TRM / outsourcing themes—so procurement, risk, and technology owners can demand evidence (contracts, logs, runbooks), not slideware. Educational only—not legal or compliance advice. Confirm obligations with your counsel and the live MAS / agency documents linked below.

Who this is for — and who should skip

For: Singapore FI and fintech buyers selecting IaaS/PaaS/SaaS or custom software touching customer or regulated data; public-sector ICT owners needing IM8-ready vendor packs; procurement/vendor-risk teams building SGD questionnaires with PDPA hygiene. Complements our MAS TRM fintech custom-software questions with a broader cloud + outsourcing diligence pack.

Skip if: you only need a single ISO certificate checkbox; you want invented audit pass-rates or “MAS-approved vendor” claims (MAS does not certify vendors that way); you are buying a pure commodity tool with no data or operational dependency; or you already signed without audit/exit clauses and need remediation counsel—not a questionnaire.

Direct answer: name the regime, then ask for artefacts

Use three public pillars—and do not treat them as interchangeable:

• IM8 (Instruction Manual on ICT & Smart Systems Management) — Singapore Government ICT/security policy framework administered for agencies (GovTech). Vendors rarely “hold an IM8 licence”; agencies apply IM8 to systems and expect vendor evidence that fits agency System Security Plans and cloud adoption rules. Exact control text is agency-internal; this pack uses public themes (cloud governance, CSP assessment, data residency/sovereignty, logging, access) without inventing clause numbers.
• MAS Notices on Management of Outsourced Relevant Services — for banks, MAS Notice 658 (published 11 December 2023; effective 11 December 2024); merchant banks mirror under Notice 1121. Annex C expressly treats public cloud services (IaaS, PaaS, SaaS) as outsourced relevant services. Material ongoing arrangements trigger due diligence, agreement terms, customer-information protections, and independent audit expectations.
• MAS Technology Risk Management Guidelines (January 2021) — supervisory guidance on technology risk governance, third-party technology risk, access control, resilience, cyber operations, and secure development (MAS TRM Guidelines page; PDF). Read alongside the Notices and the bank Guidelines on Outsourcing (banks), which include cloud-computing guidance (multi-tenancy, data segregation, recoverability, auditability).

If older RFPs still say “IM Notice / IM8 / old outsourcing guidelines,” translate them into the instruments that apply to your entity today. For banks, Notice 658/1121 is binding law for outsourced relevant services; TRM Guidelines remain principles-based guidance MAS considers in supervision. For government systems, IM8 remains the agency ICT baseline—pair it with GeBIZ procedure when you buy (see yesterday’s GeBIZ software tender checklist).

Original element: IM8 × MAS TRM cloud/software vendor question matrix

Copy this matrix into your RFP annex or vendor-risk workbook. Columns map an IM8 / cloud-outsourcing theme to a MAS TRM / Notice theme, a concrete question, and the evidence you should expect. Mark Owner, Due date, and Status per row.

#	IM8 / cloud theme	MAS TRM / Notice theme	Ask the vendor	Evidence expected
1	Cloud adoption governance	Third-party technology risk (TRM §3.4); materiality of outsourced relevant service (Notice 658)	Which services are IaaS / PaaS / SaaS vs managed custom hosting? Who is the contracting entity and which regions process our data?	Service topology diagram; data-flow map; region/AZ list; subprocessors register; written materiality inputs for your ORS assessment
2	Cloud service provider assessment	Service-provider evaluation before material ongoing ORS (Notice 658 §5); vendor evaluation in system acquisition (TRM §5.3)	What independent assurance covers the control environment for our workload class (e.g. SOC 2 Type II, ISO/IEC 27001, MTCS where relevant)? How current is it?	Latest assurance reports under NDA; scope boundary letter; penetration-test summary covering shared/customer boundary; remediation tracker for open highs
3	Data residency / sovereignty	Customer-information confidentiality; overseas performance risks (Notice 658 §§5, 7–8, 11); data security (TRM §11.1); PDPA transfers	Can you pin storage and primary processing to agreed Singapore or named regions? What happens on failover or support break-glass from overseas?	Contractual residency schedule; technical config screenshots/IaC excerpts; support access SOP; overseas subprocessor list with legal basis notes
4	Access control & privileged access	Access control / PAM / remote access (TRM §9); least privilege for service-provider staff (Notice expectations + TRM §9.1.8)	How do your admins access our tenant? Is MFA mandatory? Are standing privileged accounts forbidden in favour of just-in-time?	Admin access architecture; MFA policy; PAM/JIT evidence; sample access logs (redacted); joiner-mover-leaver SLA for vendor staff
5	Encryption & key custody	Cryptography & key management (TRM §10); protection of customer information (Notice 658 §8)	Who holds keys for data at rest? Can we bring customer-managed keys? How are keys rotated and escrowed?	KMS design; CMK/HYOK options; key lifecycle SOP; HSM attestation if claimed; encryption standards table
6	Logging, monitoring, incident response	Cyber event monitoring & incident response (TRM §§12.2–12.3); incident management (TRM §7.7); FI notification duties under TRM Notices (entity-specific)	Which logs can we export to our SIEM? What is your incident classification and customer-notification timeline?	Log catalogue + retention; sample alert runbook; incident RACI; tabletop summary (redacted); breach notification clause mapping to our policy
7	Resilience & recoverability	IT resilience, RTO/RPO, DR testing with providers (TRM §8); continuity measures for material ORS (Notice 658 §4)	What RTO/RPO do you commit for our critical tier? When did you last run a joint recovery test with a customer like us?	DR plan excerpt; last test report date/scope; dependency map; backup encryption/offline controls; failover decision tree
8	Secure SDLC / change for custom software	Security-by-design, secure coding, DevSecOps, change & release (TRM §§5–7)	How are SAST/DAST/dependency scans gated before production? Who approves emergency changes that touch our data?	SDLC policy; pipeline screenshots; vulnerability SLA; CAB/emergency change SOP; recent release evidence for a comparable system
9	Audit & regulatory access rights	Agreement terms allowing bank/MAS/auditor access (Notice 658 §7.1); independent audit ≥ every 3 years for material ongoing ORS (§9); IT audit (TRM §15)	Will you contractually allow us, our auditors, and MAS (where applicable) to obtain records/systems access needed to assess the service?	Draft MSA/DPA clauses matching Notice themes; audit logistics playbook; prior customer audit attestation (redacted)
10	Exit, deletion, portability	Termination & data deletion/destruction (Notice 658 §§7.1(f), 10); information asset & backup lifecycle (TRM §§3.3, 8.4)	On exit, how fast can you export our data in usable formats and delete or render unusable residual copies—including backups and subprocessors?	Exit runbook with timelines; sample export formats; deletion certificate template; subprocessor cascade obligations; escrow (if custom code critical)
11	Subcontracting / fourth parties	Sub-contractor rules & customer consent themes (Notice 658 §6); third-party ongoing assurance (TRM §3.4)	Which subprocessors touch our data or admin path? Can you add new ones without notice? How do you cascade confidentiality?	Current subprocessor list; change-notification SLA; flow-down confidentiality clauses; concentration-risk note for critical cloud regions
12	PDPA & confidentiality hygiene	Customer-info protection (Notice 658 §8); data confidentiality (TRM); PDPA roles	Are you a data intermediary/processor for our use case? How do you handle access, correction, and breach cooperation?	Draft DPA; ROPA inputs; breach cooperation SLA; staff confidentiality undertakings; training cadence statement

How to run the questionnaire in a Singapore buy (worked path)

Step 1 — Classify the arrangement. Banks and merchant banks: decide whether the service is an outsourced relevant service under Notice 658/1121 (public cloud is listed in Annex C). Non-bank FIs: apply the outsourcing guidelines applicable to your licence class plus TRM third-party expectations. Government buyers: classify data and system risk under agency IM8 practice before you shortlist CSPs or systems integrators.

Step 2 — Send the matrix early. Issue rows 1–12 as a scored annex (Compliant / Partial / Non-compliant / N/A) with a hard evidence column. Partial without artefacts scores as Non-compliant for material services. Keep commercial scoring separate so security theatre cannot buy the deal—same discipline as our vendor scorecard.

Step 3 — Diligence workshop. Walk data flows, admin access, log export, DR evidence, and exit. Gaps become conditions precedent—not “phase 2 hope.” Custom builds need TRM §§5–6 security-by-design artefacts before UAT.

Step 4 — Paper the agreement. For material ongoing ORS, Notice 658 §7.1 expects contractual effects for confidentiality, purpose limitation, MAS/auditor access, information provision, deletion on exit, and termination triggers (including MAS direction). “Good faith cooperation” is not a substitute. Align PDPA schedules with PDPC roles.

Step 5 — Operate. Re-diligence on Notice cadence (initial re-check no later than 24 months for material ongoing ORS, then board-approved frequency); independent audits per §9; incidents into TRM response processes.

Worked example (illustrative — not a regulatory determination)

A Singapore digital bank shortlists a SaaS case platform plus a custom integrator layer on public cloud. The 12-row matrix surfaces: overseas support break-glass (rows 1/3), standing shared admin passwords (row 4—blocker until PAM/JIT), MSA missing MAS/auditor access effects (row 9), and exit without backup deletion timelines (row 10). Award waits until Partials become Compliant with artefacts—board pack lists open conditions, not a fake compliance percentage. Budget in SGD via the custom software cost guide; delivery partners can include WC1 cloud and custom software Singapore services when you want controls designed in.

Mistakes and traps

• Naming theatre — treating “IM8 certified vendor” or outdated “IM Notice” labels as substitutes for Notice 658/1121 mapping and TRM evidence.
• Certificate collecting — accepting an ISO/SOC logo without reading scope boundaries for your tenant and regions.
• Residency folklore — marketing “Singapore data” while backups, logs, or support tooling replicate overseas without disclosure.
• Audit rights deleted in redlines — vendors striking MAS/bank auditor access on material ORS contracts.
• Exit as a slide — no tested export format, no deletion certificate path, no subprocessor cascade.
• Build vs buy blindness — strong CSP diligence but weak SDLC questions for the custom layer that actually holds business logic.
• Skipping PDPA roles — assuming a cloud contract alone settles intermediary/processor duties.

Decision framework: five yes/no gates

• Have you named the correct regime for your entity? (IM8 agency path vs Notice 658/1121 vs other FI outsourcing guidelines + TRM.) If no, stop and correct the RFP language.
• Is every material cloud/software dependency in the register with a data-flow map? If no, you cannot score rows 1–3 honestly.
• Do contract drafts achieve Notice-aligned effects for confidentiality, audit/access, deletion, and termination triggers where they apply? If no, do not sign.
• Can you export logs and recover within agreed RTO/RPO with joint-test evidence? If no, treat resilience as open risk.
• Is exit runnable in writing—with formats, timelines, and subprocessor deletion? If no, you are buying lock-in dressed as transformation.

All five must be yes before production data moves. Speed without gates is how “cloud first” becomes a supervisory finding.

FAQs

What to do next

Paste the 12-row matrix into your next cloud or software RFP, assign owners, and refuse Partial-without-artefacts on material rows. Related tools: fintech MAS TRM questions and GeBIZ checklist. For control-aware delivery see custom software, cloud infrastructure, and AI automation Singapore pages—or contact WC1 with workload class and applicable regime (no invented approval claims).