ISO 27017
International code for cloud security controls and guidance
MAS TRM
Singapore guidelines for financial technology risk management
Quick Verdict
ISO 27017 provides cloud-specific security guidance for global ISMS, while MAS TRM mandates comprehensive technology risk management for Singapore FIs. Organizations adopt ISO 27017 for cloud assurance in audits; MAS TRM to meet supervisory expectations and avoid enforcement.
ISO 27017
ISO/IEC 27017:2015 Code of practice for cloud security controls
Key Features
- Clarifies shared responsibilities between CSPs and CSCs
- Introduces seven cloud-specific security controls
- Provides guidance for 37 ISO 27002 controls in cloud
- Addresses multi-tenancy segregation and VM hardening
- Integrates into ISO 27001 ISMS audits seamlessly
MAS TRM
MAS Technology Risk Management Guidelines 2021
Key Features
- Board and senior management accountability
- Proportional risk-based implementation
- End-to-end TRM framework lifecycle
- Third-party risk management integration
- Annual pen testing for internet systems
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
ISO 27017 Details
What It Is
ISO/IEC 27017:2015 is a code of practice extending ISO/IEC 27002 with cloud-specific information security controls. It provides implementation guidance for cloud service providers (CSPs) and customers (CSCs) within a risk-based ISO 27001 ISMS, focusing on shared responsibilities and cloud risks like multi-tenancy.
Key Components
- Cloud-adapted guidance for 37 ISO 27002 controls.
- Seven additional CLD controls (e.g., segregation, VM hardening, asset removal, monitoring).
- Built on ISO 27001/27002 framework.
- No standalone certification; integrated into ISO 27001 audits.
Why Organizations Use It
Drives cloud risk reduction, clarifies shared duties, meets procurement and regulatory needs (GDPR, CCPA), enhances trust, and differentiates CSPs in competitive markets.
Implementation Overview
Integrate via risk assessment, control mapping, and cloud configurations. Applies to CSPs/CSCs of all sizes/industries globally. Assessed during ISO 27001 audits (9-12 months joint timeline).
MAS TRM Details
What It Is
MAS Technology Risk Management (TRM) Guidelines, issued by the Monetary Authority of Singapore (MAS) in January 2021, are supervisory guidance for financial institutions. Primary purpose: promote sound practices for technology and cyber risk governance, controls, and resilience. Employs principles-based, risk-proportional approach across CIA triad.
Key Components
- Governance (board oversight, CIO/CISO roles, risk appetite)
- TRM framework (identify-assess-treat-monitor-report)
- Controls in **15 sectionsSDLC, operations, access, crypto, cyber ops, resilience, third-party risk
- Synthesised 12 core principles; no fixed controls, continuous improvement
- Compliance via MAS supervision, independent audit
Why Organizations Use It
- Avoid enforcement (fines, license actions)
- Build cyber resilience amid digital threats
- Manage third-party/supply chain risks
- Enhance trust, enable secure innovation
Implementation Overview
- Phased: govern, inventory assets, deploy controls, test, monitor
- For MAS-supervised FIs; proportional to risk/complexity
- No certification; evidence via metrics, audits, board reports (179 words)
Key Differences
| Aspect | ISO 27017 | MAS TRM |
|---|---|---|
| Scope | Cloud-specific security controls in ISMS | Comprehensive technology risk for financial institutions |
| Industry | All industries, global cloud users | Singapore financial institutions only |
| Nature | Voluntary code of practice, no standalone certification | Supervisory guidelines with enforcement consideration |
| Testing | Integrated into ISO 27001 audits | Annual PT for internet systems, regular VA/DR tests |
| Penalties | Loss of ISO 27001 certification | Fines, license revocation, executive prohibitions |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about ISO 27017 and MAS TRM
ISO 27017 FAQ
MAS TRM FAQ
You Might also be Interested in These Articles...
Decoding Tomorrow's Regulations: How Advanced Compliance Tools Predict and Prepare for Future Shifts
Advanced compliance tools use AI, analytics & real-time monitoring to predict regulatory shifts, cut non-compliance costs 3x, and ensure audit readiness. Stay p
CMMC Level 3 Implementation Guide: Integrating NIST SP 800-172 Enhanced Controls for APT Defense
Step-by-step CMMC Level 3 guide for DIB contractors. Implement 24 NIST SP 800-172 controls on Level 2. Prep for DIBCAC, C3PAO scoping & 180-day POA&Ms. Boost cy
The Human-AI Synergy: How Modern Compliance Tools Amplify Your Team's Strategic Impact
Unlock human-AI synergy with modern compliance tools. Automate monitoring, cut non-compliance risks 3x, and boost strategic decision-making. Elevate your team's
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
GMP vs Basel III
GMP vs Basel III: Compare pharma manufacturing quality controls with banking capital & liquidity rules. Key differences, compliance strategies & executive insights.
ITIL vs ISO 28000
ITIL vs ISO 28000: ITSM best practices meet supply chain security stds. Align IT services w/ resilience, cut risks & boost compliance. Discover key diffs now!
ISO 31000 vs ISO 27018
ISO 31000 vs ISO 27018: Broad risk mgmt guidelines meet cloud PII privacy controls. Compare principles, implementation & compliance for resilient strategy. Dive in!