Source Document
MAS TRM
MAS.TRM.2021.Sec11.1.6.p38.OBL2
Technology Risk Management Guidelines > 11 Data and Infrastructure Security > 11.1 Data Security > 11.1.6
Obligation Summary
Where sensitive production data has to be used in a non-production environment, senior management approval must be obtained first.
In exceptional situations where such data needs to be used in non-production environments, proper approval has to be obtained from senior management.
MAS TRM, Section 11.1.6, p. 38 (2021) · Technology Risk Management Guidelines · p. 38
11.1.5 Security measures should be implemented to prevent and detect the use of unauthorised internet services which allow users to communicate or store confidential data. Examples of such services include social media, cloud storage and file sharing, emails, and messaging applications.
11.1.6 The use of sensitive production data in non-production environments should be restricted. In exceptional situations where such data needs to be used in non-production environments, proper approval has to be obtained from senior management. The FI should ensure appropriate controls are implemented in non-production environments to manage the access and removal of such data to prevent data leakage. Where possible, such data should be masked in the non-production environments.
11.1.7 The FI should ensure confidential data is irrevocably deleted from storage media, systems and endpoint devices before they are disposed of or redeployed.
What This Requires.
ProfytAI Regulatory Intelligence
Type: governanceRelationship
It is the second sentence of 11.1.6 and carries the exception to the restriction stated in the first sentence, with the remaining two sentences adding controls that apply on top.
Why This Exists
Non-production environments are usually built for speed rather than security, with looser access, weaker monitoring and more people able to touch the data. Forcing the decision up to senior management makes the exception visible and accountable instead of a quiet choice made by a project team.
Watchouts
Approval is not a substitute for the other duties in the same paragraph. The access and removal controls and, where possible, masking still apply to data that has been approved. "Senior management" is not defined at this point in the guidance, so the firm has to be able to defend the seniority of whoever signed.
Interpretation Note · The rest of paragraph 11.1.6 is written as "should". This sentence is not. It uses "has to be obtained", which is the strongest phrasing in the provision, and it is the operative condition attached to the exception. Read it as follows. Use of sensitive production data in non-production environments is meant to be restricted, and where it happens anyway it is permitted only on the back of proper senior management approval. Two limits are worth noting. The trigger is sensitive production data, not all production data, and "exceptional situations" qualifies when the exception is available at all, so the approval route is not a general licence. The MAS TRM Guidelines are supervisory guidance rather than a notice, so this is an expectation MAS will hold the firm to rather than a statutory rule, but the internal phrasing signals that MAS treats this particular step as non-negotiable within the guidance.
This explanation is generated regulatory intelligence, traceable to the citation above.
The byte-exact verbatim text remains the authority you cite.
What the duty requires in practice, each with the condition that satisfies it and the evidence an examiner would expect. Derived by ProfytAI, anchored to the verbatim text above.
- 1
Obtain and retain senior management approval for each use of sensitive production data in a non-production environment.
Done When
For each instance where sensitive production data was used in a non-production environment, a dated approval record names the approving senior manager, the data concerned and the environment it was used in.
EvidenceSenior management approval record - 2
Record why each use of sensitive production data in a non-production environment was an exceptional situation.
Done When
Each approval record states the reason the use was exceptional, and no instance is found in a non-production environment without a corresponding approval record.
EvidenceSenior management approval record
The captured source page, with this duty highlighted and stamped with its obligation ID, section, and page.
Reproduced from MAS Notices and Guidelines with permission, retrieved from mas.gov.sg. Refer to the MAS website for the latest available version. Highlighting and the verification stamp were added by ProfytAI. The stamp verifies ProfytAI's extraction only and does not represent approval or endorsement by the Monetary Authority of Singapore.