Compliance and Certification

Compliance with standards, including IMDA regulations, can be exhibited in several ways. The level of assurance differs in objectivity and continuity in time scale while at the same time, the level of visibility, and transparency may also vary.

1. Self-assessment is a process where organisations indicate their standard compliance status after carrying out an internal check and verification, while cloud security certification typically involves a third-party assessment.
2. Certification by 3rd party is usually undertaken by an independent auditing company also known as a certification body. Upon successful completion, a certificate is usually issued valid for a period of time (commonly 3 years) with requirements of a periodic check, known as a surveillance audit, normally done annually to ensure continual compliance.
3. Compliance through continuous monitoring where automated tools are deployed to continuously monitor, near real-time, its fulfilment of compliance to standards. This is the highest level of achievable compliance to standards though it is difficult to comprehensively cover such near real-time monitor on all aspect of the requirements.

Other forms of demonstration of compliance to standards such as attestation by 3rd or 2nd party (e.g. consumers/buyers audit their service providers/suppliers) are also possible. Such demonstration of compliance may be exhibited by posting online its self-disclosure statement, certificate of compliance or summary display of real-time compliance status.

In conjunction with the Singapore Standard SS 584: 2020 Specification for multi-tiered cloud computing security, the MTCS Certification Scheme is developed to

• encourage adoption of sound risk management and security practices by CSPs through MTCS certification; and
• promote the adoption of MTCS standard.

Here are the key steps for CSPs to participate in the scheme.

• CSPs shall source and identify suitable ACCREDITED Certification Bodies (CBs) to undertake the certification (see enclosed list of participating CBs).
• CSPs shall work with the identified ACCREDITED CBs to prepare the following documents after having decided on the scope of certification:
  • Statement on Applicability and Compensating Controls; and
  • MTCS CSP Self-Disclosure (185.10KB).
• CSPs proceed to work with ACCREDITED CBs on the certification.

Upon successful certification, CSP may email a copy of ACCREDITED MTCS certificate and a duly completed disclosure form to nitsc@imda.gov.sg for listing on the IMDA website. Only ACCREDITED MTCS certificates will be listed.

Certification will be valid for 3 years with a yearly surveillance audit to be conducted.

• CSPs who provide MTCS-certified services and wish to have them listed here can submit e-copies of the following documents to nitsc@imda.gov.sg:

1. Accredited MTCS Certificate
2. CSP disclosure form (185.10KB) (duly completed and signed)

• MTCS Certified IaaS/PaaS

• MTCS Certified SaaS

All enquiries regarding MTCS Certification can also be addressed to nitsc@imda.gov.sg.

• MTCS Singapore Standard (Singapore Standards eShop)
• Download MTCS Self-Disclosure Form (185.10KB)
• Accredited MTCS Certification Bodies