Be aware of scammers impersonating as IMDA officers and report any suspicious calls to the police. Please note that IMDA officers will never call you nor request for your personal information. For scam-related advice, please call the ScamShield Helpline at 1799 or go to www.ScamShield.gov.sg.

  1. Architects of SG's Digital Future
  2. Regulations and Licensing Listing
  3. ICT Standards and Quality of Service
  4. IT Standards and Frameworks
  5. Compliance and Certification

Compliance and Certification

Overview

Compliance with standards, including IMDA regulations, can be exhibited in several ways. The level of assurance differs in objectivity and continuity in time scale while at the same time, the level of visibility, and transparency may also vary.

  1. Self-assessment is a process where organisations indicate their standard compliance status after carrying out an internal check and verification, while cloud security certification typically involves a third-party assessment.
  2. Certification by 3rd party is usually undertaken by an independent auditing company also known as a certification body. Upon successful completion, a certificate is usually issued valid for a period of time (commonly 3 years) with requirements of a periodic check, known as a surveillance audit, normally done annually to ensure continual compliance.
  3. Compliance through continuous monitoring where automated tools are deployed to continuously monitor, near real-time, its fulfilment of compliance to standards. This is the highest level of achievable compliance to standards though it is difficult to comprehensively cover such near real-time monitor on all aspect of the requirements.

Other forms of demonstration of compliance to standards such as attestation by 3rd or 2nd party (e.g. consumers/buyers audit their service providers/suppliers) are also possible. Such demonstration of compliance may be exhibited by posting online its self-disclosure statement, certificate of compliance or summary display of real-time compliance status.

MTCS Certification Scheme

In conjunction with the Singapore Standard SS 584: 2020 Specification for multi-tiered cloud computing security, the MTCS Certification Scheme is developed to

  • encourage adoption of sound risk management and security practices by CSPs through MTCS certification; and
  • promote the adoption of MTCS standard.

Here are the key steps for CSPs to participate in the scheme.

  • CSPs shall source and identify suitable ACCREDITED Certification Bodies (CBs) to undertake the certification (see enclosed list of participating CBs).
  • CSPs shall work with the identified ACCREDITED CBs to prepare the following documents after having decided on the scope of certification:
  • CSPs proceed to work with ACCREDITED CBs on the certification.

Upon successful certification, CSP may email a copy of ACCREDITED MTCS certificate and a duly completed disclosure form to nitsc@imda.gov.sg for listing on the IMDA website. Only ACCREDITED MTCS certificates will be listed.

Certification will be valid for 3 years with a yearly surveillance audit to be conducted.

MTCS Certified Cloud Services

Enquiries

All enquiries regarding MTCS Certification can also be addressed to nitsc@imda.gov.sg.

Related Links

LAST UPDATED: 16 OCT 2024

Explore more

Latest news

Factsheet

General Election 2025: Party Political Broadcasts

The General Election will be held on 3rd May 2025. The Infocomm Media Development Authority (IMDA) has allocated airtime on...
Press Release

Celebrating 60 years of ‘Singaporean-ness’

Commemorate the 60th year of Singapore’s independence, the local media industry will be coming together to feature a series of...
Press Release

Advisory Guidelines for Cloud Services and Data Centres

The AGs recommend measures that CSPs and DC operators in Singapore are encouraged to adopt to enhance the resilience and security...
View all news