What is the primary objective of AS9110C?

AS9110C's primary objective is to enable aviation maintenance organizations to consistently provide products and services meeting customer and statutory/regulatory requirements while enhancing customer satisfaction through effective QMS application and continual improvement. It incorporates ISO 9001:2015's Annex SL structure across Clauses 4–10, adding maintenance-specific controls like configuration management, counterfeit parts prevention, product safety, traceability, and preservation to ensure continuing airworthiness in repair stations and MRO providers.

Who is legally or professionally required to comply with AS9110C?

AS9110C applies to organizations providing aviation maintenance, repair, overhaul (MRO), or continuing airworthiness services, regardless of size. Targeted at repair stations, independent MROs, airline maintenance departments, engine shops, and OEMs with autonomous MRO operations (civil/military), certification is often contractually required by OEMs, airlines, and regulators for OASIS listing and supply-chain access, though not legally mandated independently.

Does AS9110C require an external audit or third-party certification?

Yes, AS9110C requires third-party certification via accredited bodies following a two-stage audit process. Stage 1 reviews documentation and readiness; Stage 2 verifies implementation effectiveness. The QMS must operate for at least three months, including a full internal audit cycle and management review, before initial certification, with surveillance audits annually and recertification every three years.

How often should an assessment for AS9110C be performed?

Internal audits for AS9110C must be performed at planned intervals based on process risk, status, and results, with at least one full cycle before certification. Management reviews occur regularly (e.g., semi-annually), using performance data. External surveillance audits happen annually post-certification, with full recertification every three years via accredited registrars.

What are the consequences of non-compliance with AS9110C?

Non-compliance with AS9110C risks loss of contracts, regulatory approvals, and OASIS listing, potentially causing revenue exclusion from OEMs and airlines. Operationally, it leads to weak controls in configuration, traceability, and counterfeit prevention, increasing safety incidents, rework, AOG events, fines under aviation regulations (e.g., FAA/EASA Part 145), litigation, and reputational damage.

Can AS9110C be mapped to other international frameworks?

Yes, AS9110C's Annex SL high-level structure enables direct mapping to ISO 9001:2015 as its baseline. It aligns with aviation regulations like FAA/EASA Part 145 via correlation matrices, supporting integrated management systems while customer/regulatory requirements override where conflicts arise; justifications are required for any non-applied requirements within scope.

What is the first step to begin implementing AS9110C?

The first step is to define the QMS scope, determine internal/external issues (Clause 4), and conduct a gap analysis against Clauses 4–10. Secure executive sponsorship, map regulatory approvals (e.g., Part 145), identify interested parties, and produce a prioritized gap register using IAQG checklists to justify scope boundaries and non-applicable requirements.

What is the primary objective of MAS TRM?

MAS TRM’s primary objective is to establish sound technology risk governance and cyber resilience through defence-in-depth controls preserving confidentiality, integrity, and availability (CIA) of data and systems. Per the January 2021 Guidelines (Preface 1.4), it promotes practices for financial institutions (FIs) commensurate with risk profile, covering governance (Section 3), risk frameworks (Section 4), secure development (Sections 5-6), operations (Section 7), resilience (Section 8), cyber defence (Sections 9-13), and audit (Section 15).

Who is legally or professionally required to comply with MAS TRM?

MAS TRM applies to all financial institutions supervised by MAS, including banks, insurers, capital market intermediaries, payment service providers, and fintech sandbox participants. Implementation is proportionate to risk and complexity (Section 2.2); boards and senior management bear accountability for oversight and execution (Section 3.1).

Does MAS TRM require an external audit or third-party certification?

MAS TRM mandates an independent internal audit function to assess controls, governance, and risk management effectiveness (Sections 3.1.7, 15), but does not require external audits or third-party certification. FIs may incorporate industry standards for assurance (Section 3.2.1); MAS considers observance of Guidelines’ spirit in supervision (Section 2.2).

How often should an assessment for MAS TRM be performed?

TRM assessments must occur regularly, commensurate with system criticality: annual penetration testing for Internet-facing systems (Section 13.2.4), periodic vulnerability assessments (Section 13.1.1), annual DR plan reviews (Section 8.2.2), and continuous risk monitoring via registers (Section 4.5). Policies require regular updates for evolving threats (Section 3.2.1).

What are the consequences of non-compliance with MAS TRM?

Non-compliance risks supervisory actions including fines, license conditions, revocations, and executive prohibitions, as MAS evaluates Guidelines observance in supervision (Section 2.2). Examples: Imposition of additional supervisory capital requirements for severe digital service outages; regulatory reprimands and license restrictions for governance failures.

Can MAS TRM be mapped to other international frameworks?

Yes, MAS TRM aligns with frameworks like NIST CSF 2.0 (Govern-Identify-Protect-Detect-Respond-Recover) and ISO 27001 (ISMS controls), supporting integration via risk registers and defence-in-depth (Sections 3.2.1, 4). FIs incorporate best practices while maintaining proportionality (Section 2.3).

What is the first step to begin implementing MAS TRM?

The first step is board approval of a technology risk appetite/tolerance statement and establishment of governance structures, including CIO/CISO appointments and an independent TRM function (Sections 3.1.3, 3.1.7). Develop an information asset inventory for proportionality (Section 3.3).

Standards Comparison

AS9110C vs MAS TRM

AS9110C

Mandatory

2016

Aerospace QMS standard for aviation maintenance organizations

MAS TRM

Mandatory

2021

Singapore guidelines for financial technology risk management

Quick Verdict

AS9110C provides QMS certification for aviation maintenance safety worldwide, while MAS TRM enforces tech risk governance for Singapore FIs via supervisory oversight. Organizations adopt AS9110C for global supply chain access; MAS TRM to avoid fines and ensure resilience.

Quality Management

AS9110C

AS9110C:2016 Quality Management Systems for Aviation Maintenance

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Tailored QMS for aviation maintenance organizations
Mandates configuration management and traceability
Prevents counterfeit parts and ensures safety
Integrates risk-based thinking in operations
Addresses human factors and ethical behavior

Technology Risk Management

MAS TRM

Technology Risk Management Guidelines (January 2021)

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Board and senior management accountability
Proportional risk-based implementation
Third-party risk management requirements
Cyber resilience and defence-in-depth
Annual penetration testing for internet-facing systems

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

AS9110C Details

What It Is

AS9110C:2016 is a certification standard for quality management systems (QMS) tailored to aviation maintenance organizations (MROs), repair stations, and continuing airworthiness providers. It builds on ISO 9001:2015's Annex SL structure, adding aerospace-specific requirements via a risk-based, PDCA approach focused on safety and regulatory alignment.

Key Components

Core clauses 4–10 cover context, leadership, planning, support, operation, evaluation, improvement.
Aviation additions: configuration management, counterfeit prevention, product safety, human factors, traceability, external provider controls.
Emphasizes documented information, no exclusions without justification, leadership roles like Accountable Manager.
Certification via IAQG OASIS listing after audits.

Why Organizations Use It

Meets customer/OEM contracts, enables market access.
Mitigates safety risks, ensures airworthiness compliance (FAA/EASA).
Drives efficiency, on-time delivery, continual improvement.
Builds stakeholder trust, reduces liability.

Implementation Overview

Phased: gap analysis, process design, training, audits (6–12 months).
Applies to all MRO sizes globally.
Requires internal audits, management reviews before Stage 1/2 certification.

MAS TRM Details

What It Is

MAS Technology Risk Management (TRM) Guidelines (revised January 2021) are supervisory guidelines from Singapore's Monetary Authority (MAS) for financial institutions (FIs). They provide principles-based guidance on managing technology and cyber risks, emphasizing proportionality based on risk profile, complexity, and criticality to ensure CIA (confidentiality, integrity, availability).

Key Components

15 sections covering governance, risk frameworks, secure development, operations, resilience, access controls, cryptography, cyber defense, assessments, and audit.
Synthesised into 12 core principles like board accountability, asset management, third-party oversight.
No fixed controls; focuses on outcomes via defence-in-depth and continuous improvement.
Compliance via supervisory review, not formal certification.

Why Organizations Use It

Meets MAS supervisory expectations to avoid fines/enforcement.
Enhances resilience, reduces cyber/incident risks.
Builds trust with regulators, customers, stakeholders.
Enables secure digital transformation.

Implementation Overview

Risk-based: inventory assets, assess risks, implement controls, test, monitor.
Applies to all MAS-supervised FIs; scalable by size/complexity.
Involves governance setup, training, third-party due diligence; audited internally.

Key Differences

Aspect	AS9110C	MAS TRM
Scope	Aerospace MRO QMS with safety, traceability	Financial tech risk governance, cyber resilience
Industry	Aviation maintenance organizations globally	Singapore financial institutions only
Nature	Voluntary certification standard	Supervisory guidelines with enforcement
Testing	Internal audits, management reviews	Annual pen tests, vulnerability assessments
Penalties	Loss of certification	Fines, license revocation

Scope

AS9110C

Aerospace MRO QMS with safety, traceability

MAS TRM

Financial tech risk governance, cyber resilience

Industry

AS9110C

Aviation maintenance organizations globally

MAS TRM

Singapore financial institutions only

Nature

AS9110C

Voluntary certification standard

MAS TRM

Supervisory guidelines with enforcement

Testing

AS9110C

Internal audits, management reviews

MAS TRM

Annual pen tests, vulnerability assessments

Penalties

AS9110C

Loss of certification

MAS TRM

Fines, license revocation

Frequently Asked Questions

Common questions about AS9110C and MAS TRM

AS9110C FAQ

MAS TRM FAQ

You Might also be Interested in These Articles...

Thailand PDPA Enforcement Trends 2025: Analyzing 1,048 Complaints, Breach Volumes, and Hidden Lessons for Proactive Compliance

Decode PDPC Thailand's 1,048 complaints & 610 breaches. Uncover consent/security violations, project 2025 enforcement. Risk heatmap, self-assessment & playbook

Measuring CIS Controls v8.1 in the Real World: KPIs, Dashboards, and Automated Evidence for Continuous Assurance

Master CIS Controls v8.1 measurement with essential KPIs, executive-ready dashboards, and automated evidence collection for continuous assurance. Make complianc

The Tool Landscape for Reaching and Maintaining ISO 27001 Compliance

Discover top ISO 27001 compliance tools, their pros/cons, implementation steps, costs, and benefits. Streamline your path to certification and ongoing complianc

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how AS9110C and MAS TRM compare against other standards

Other AS9110C Comparisons

Other MAS TRM Comparisons

What It Is

Key Components

Core clauses 4–10 cover context, leadership, planning, support, operation, evaluation, improvement.

Aviation additions: configuration management, counterfeit prevention, product safety, human factors, traceability, external provider controls.

Emphasizes documented information, no exclusions without justification, leadership roles like Accountable Manager.

Certification via IAQG OASIS listing after audits.

What It Is

Key Components

15 sections covering governance, risk frameworks, secure development, operations, resilience, access controls, cryptography, cyber defense, assessments, and audit.

Synthesised into 12 core principles like board accountability, asset management, third-party oversight.

No fixed controls; focuses on outcomes via defence-in-depth and continuous improvement.

Compliance via supervisory review, not formal certification.

Aspect

AS9110C

MAS TRM

Scope

Aerospace MRO QMS with safety, traceability

Financial tech risk governance, cyber resilience

Industry

Aviation maintenance organizations globally

Singapore financial institutions only

Nature

Voluntary certification standard

Supervisory guidelines with enforcement

Testing

Internal audits, management reviews

Annual pen tests, vulnerability assessments

Penalties

Loss of certification

Fines, license revocation