Source Document
MAS TRM Guidelines
MAS.TRM.2021.Sec8.2.3.p29.OBL3
8 IT Resilience > 8.2 System Recoverability > 8.2.3
Obligation Summary
In exceptional circumstances where untested recovery measures need to be used, the FI should perform a risk assessment, ensure adequate controls are in place, and obtain approval from senior management.
In exceptional circumstances where untested recovery measures need to be used, the FI should perform a risk assessment and ensure adequate controls are in place, as well as obtain approval from senior management.
MAS TRM Guidelines, Section 8.2.3, p. 29 (2021) · Technology Risk Management Guidelines · p. 29
annually and updated when there are material changes to business operations, information assets or environmental factors.
8.2.3 During the recovery process, the FI should follow the established disaster recovery plan that has been tested and approved by management. The FI should avoid deviating from the plan as untested recovery measures could exacerbate the incident and prolong the recovery process. In exceptional circumstances where untested recovery measures need to be used, the FI should perform a risk assessment and ensure adequate controls are in place, as well as obtain approval from senior management.
8.2.4 The FI should endeavour to operate from its recovery, secondary or alternate site periodically so as to have the assurance that its infrastructure and systems at these sites are able to support business needs for an extended period of time when production systems failover from the primary or production site.
What This Requires.
ProfytAI Regulatory Intelligence
Type: conditionIn exceptional circumstances where untested recovery measures need to be used, the FI should perform a risk assessment, ensure adequate controls are in place, and obtain approval from senior management.
Relationship
Third sentence of paragraph 8.2.3; it defines the controlled exception to the plan-adherence expectations in the first two sentences.
Why This Exists
When the plan cannot cover reality, the fallback is deliberate risk-taking with authority, not silent improvisation by responders.
Implementation Considerations
An emergency decision protocol within incident command enabling rapid risk assessment and documented senior management approval before unplanned measures execute.
Interpretation Note · All three safeguards, risk assessment, adequate controls and approval, attach to the exceptional path, and the approval sits at senior management level. The clause applies only in exceptional circumstances, it does not authorise routine deviation. SHOULD reflects TRM guidance force.
This explanation is generated regulatory intelligence, traceable to the citation above.
The byte-exact verbatim text remains the authority you cite.
The captured source page, with this duty highlighted and stamped with its obligation ID, section, and page.
