Framework overlap

Does SSAE 18 cover Monetary Authority of Singapore Technology Risk Management Guidelines?

You hold SSAE 18 and have been told to do Monetary Authority of Singapore Technology Risk Management Guidelines. Here is how much overlaps, control by control.

75% of Monetary Authority of Singapore Technology Risk Management Guidelines you already have

SSAE 18 already covers about 75% of Monetary Authority of Singapore Technology Risk Management Guidelines, leaving 2 of 8 controls as genuinely new work.

Already covered 0 Likely covered 6 New work 2

No control in SSAE 18 maps directly to one in Monetary Authority of Singapore Technology Risk Management Guidelines. Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in SSAE 18 reaches these. This is the list to scope.

MAS-TRM-Online-Authentication-Payment-Card-Chapters-12-13-2FA-Strong-Customer-Authentication-PCI-DSS
MAS TRM Online Authentication + Payment Card + Chapters 12-13 + 2FA + Strong Customer Authentication + PCI DSS
MAS-TRM-Scope-Authority-2021-Edition-Notice-644-655-Banks-Insurance-Capital-Markets-Payment-Services
MAS TRM Scope + 2021 Edition + Notice 644 + Notice 655 + Banks + Insurance + Capital Markets + Payment Services
Show the 6 you already have
MAS-TRM-Access-Cryptography-Network-Security-Chapters-9-10-MFA-PKI-Encryption-Network-Segmentation
MAS TRM Access Control + Cryptography + Network + Chapters 9-10 + MFA + PKI + Encryption + Network Segmentation
MAS-TRM-Cyber-Resilience-Chapter-11-Threat-Intelligence-Penetration-Testing-Incident-Response-1-Hour-Notification
MAS TRM Cyber Resilience + Chapter 11 + Threat Intelligence + Penetration Testing + Incident Response + 1-Hour Notification
MAS-TRM-Governance-Chapters-2-3-Board-Senior-Management-Risk-Framework-Information-Asset-Management
MAS TRM Governance + Chapters 2-3 + Board + Senior Management + Risk Framework + Information Asset Management
MAS-TRM-Project-SDLC-Service-Management-Chapters-4-5-6-IT-Project-Software-Lifecycle-Change-ITIL
MAS TRM Project + SDLC + Service Management + Chapters 4-6 + IT Project + Software Lifecycle + ITIL
MAS-TRM-Reliability-Data-Centre-Chapters-7-8-RTO-RPO-BCP-DR-System-Availability-4-Hours-12-Months
MAS TRM Reliability + Data Centre + Chapters 7-8 + RTO + RPO + BCP + DR + System Availability 4 Hours 12 Months
MAS-TRM-Third-Party-IT-Audit-Chapters-14-15-Outsourcing-Notice-658-Concentration-Risk-Exit-Strategy
MAS TRM Third Party + IT Audit + Chapters 14-15 + Outsourcing + Notice 658 + Concentration Risk + Exit Strategy

How this is calculated

Already covered means a mapping runs from a control in SSAE 18 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition