Source Document
MAS TRM Guidelines
MAS.TRM.2021.Sec13.2.3.p45.OBL1
13 Cyber Security Assessment > 13.2 Penetration Testing > 13.2.3
Obligation Summary
To obtain a more accurate assessment of the robustness of the FI's security measures, penetration testing should be conducted on the production environment.
To obtain a more accurate assessment of the robustness of the FI's security measures, PT should be conducted on the production environment.
MAS TRM Guidelines, Section 13.2.3, p. 45 (2021) · Technology Risk Management Guidelines · p. 45
13.2.2 A bug bounty programme is another means by which an FI could discover vulnerabilities in their IT systems by inviting and incentivising ethical or "white hat" hackers to conduct PT on their systems. The FI may consider conducting a bug bounty programme to test the security of its IT infrastructure to complement its PT.
13.2.3 To obtain a more accurate assessment of the robustness of the FI's security measures, PT should be conducted on the production environment. Proper safeguards should be implemented when PT is conducted on the production environment.
13.2.4 The frequency of PT should be determined based on factors such as system criticality and the system's exposure to cyber risks. For systems that are directly accessible
What This Requires.
ProfytAI Regulatory Intelligence
Type: implementation stepPenetration testing should be conducted on the production environment so the robustness of the FI's security measures is assessed accurately.
Relationship
Refines the penetration testing expected under subsection 13.2 by specifying the environment in which it should be performed; the companion sentence in the same paragraph requires safeguards when doing so.
Why This Exists
Test environments rarely mirror production exactly, so MAS expects testing to run where the real controls and configurations operate.
Implementation Considerations
Typically scoping PT against live systems with scheduling, change control and rollback arrangements agreed in advance.
Interpretation Note · The stated rationale is assessment accuracy, and the provision should be read together with the same paragraph's safeguard expectation for production testing. TRM is guidance; SHOULD signals a MAS expectation.
This explanation is generated regulatory intelligence, traceable to the citation above.
The byte-exact verbatim text remains the authority you cite.
The captured source page, with this duty highlighted and stamped with its obligation ID, section, and page.
