How Employee Security Behavior Supports MAS TRM Compliance

Did you know that around three-quarters (75%) of banks in Singapore are experiencing fraud losses? A recent survey of over 100 compliance leaders highlights the growing fraud risks faced by Singapore’s financial sector. This is not surprising, as financial institutions are often attractive targets due to the sensitive information and monetary value they manage. 

As financial institutions remain vulnerable, they require more than just implementing security technologies. In response to this, the Monetary Authority of Singapore (MAS) introduced the Technology Risk Management (TRM) Guidelines. They were first released in 2013, with a revised version issued in 2021. The MAS TRM guidelines provide financial institutions with expectations for managing technology risks sustainably. They have also supported security standard improvement, vendor accountability and introduced stricter regulatory penalties for non-compliance.

While the MAS TRM guidelines provide strong direction, mere compliance alone cannot make an organization immune to threats.

Building cyber resilience starts with people. Employees play a critical role in determining how effectively security practices are applied in daily operations. A single risky action can become an entry point for a serious security incident or data breach.

Why Every Employee Has a Role to Play in a Financial Institution’s MAS TRM Compliance

Employees represent an organization through their day-to-day interactions. This is especially important in financial institutions, where employees are not only responsible for engaging with customers but also for customer asset safety, handling sensitive information responsibly and following established procedures.

While organizational leaders establish the direction by introducing policies and implementing security controls, effective MAS TRM compliance depends on how these requirements translate into everyday activities.

Every security-related decision an employee makes influences the organization's overall risk posture. Decisions such as verifying unexpected requests, using approved systems etc. all count. This is why MAS TRM compliance should not be viewed only as a regulatory checkbox. It is also a reflection of how employees understand and practice secure behaviors.

Employee Security Behaviors That Support MAS TRM Compliance

• Accountability

Accountability forms the foundation of strong employee security behavior. They should recognize that protecting customer information and organizational assets is a shared responsibility. Without staff involvement, security controls alone are rarely effective.

For example, if an employee shares their credentials with a potential threat actor for personal gain, it creates a security risk. The consequences may impact not only the organization but also the employee and customers.

Employees should therefore understand that they are accountable for every piece of sensitive information entrusted to them.

• Risk Awareness

Employees must understand the potential consequences of not following cyber hygiene. Security requirements such as MFA should not be viewed as an additional burden but as a protective measure. When employees understand the reason behind security controls, they are more likely to make informed decisions.

A risk-aware employee is also more likely to identify and report suspicious activities or potential incidents early. Prompt reporting can help organizations prevent minor issues from snowballing into larger incidents.

• Responsible Use

Any data, system access or sensitive information provided to employees comes with a level of responsibility and trust from the organization. They should understand why access has been granted and how their actions can impact both the customer and organization.

For example, an employee who downloads sensitive information to an unauthorized personal device may unknowingly expose the data, even if there was no malicious intent. 

Responsible use requires employees to carefully consider their actions involving organizational or customer data and ensure that their decisions align with established security expectations.

• Zero Trust

Employees in financial institutions make several decisions involving systems, customer data and access on a daily basis. Therefore, adopting a zero trust mindset is essential. They should avoid automatically trusting requests, individuals, links or activities unless they are properly verified. Anything appearing unusual should be treated with caution before proceeding.

For example, an employee receiving an urgent request from someone claiming to be a senior executive should verify the request before performing any action.

Threat actors often exploit human trust and assumptions through techniques like phishing and impersonation. By applying a zero trust approach, employees can reduce the likelihood of falling victim to these attacks.

• Proactiveness

Being proactive means employees continuously take steps to improve their security awareness and prepare themselves for potential risks. This includes understanding emerging threats, recognizing how risky actions can affect the organization and knowing how to prevent incidents before they occur.

It also involves participating in awareness programmes, completing required training, reporting incidents promptly and following organizational policies. When people actively engage with security practices, they become a stronger line of defense against threats.

Turning MAS TRM Compliance into Employee Security Behavior Change

• Implement Role-Based Awareness Training Program

Security awareness training is most effective when employees can relate it to their everyday responsibilities. This is why it shouldn't be a one-size-fits-all approach. Training should address relevant risk scenarios and expected employee actions based on their specific roles.

Key areas can include identifying suspicious activities, understanding applicable security risks and knowing how to detect and respond to potential security incidents.

Organizations can deliver this training through various methods like workshops, micro learning modules, awareness posters, newsletters and nudges. These approaches help reinforce secure behaviors.

• Recognize and Appreciate Positive Behavior

Recognition and appreciation can play an important role in encouraging employees to adopt secure behaviors. When employees demonstrate positive security practices, such as flagging suspicious activities , organizations can acknowledge these actions through appreciation emails, recognition programs or reward systems.

For example, organizations can introduce security behavior recognition initiatives where employees receive points for good security practices.

• Restrict Risky Behaviors

Organizations can reduce risky behaviors by implementing controls that make unsafe actions difficult to perform. For example, restricting the use of unauthorized software and tools within corporate networks.

When risky actions require additional effort, employees are more likely to adopt safer alternatives. The goal is not only to prevent mistakes but also to create an environment where secure choices become the natural option.

• Make Security Behaviors Easy to Adopt

Providing training alone and expecting employees to remember every security practice always may not be effective. It needs to become a part of everyday work.

This can be achieved through continuous reinforcement, such as displaying security reminders on employee devices, sharing awareness messages through internal communication channels, placing security posters in common workplace areas etc.

Small but consistent efforts can help create a workplace where employees feel motivated to make secure decisions.

• Adopt Behavior Modeling

Employees are more likely to adopt secure behaviors when they see leaders and managers demonstrating those same behaviors. Organizational leaders should hence actively participate in security initiatives, follow procedures and visibly commit to security practices. This can include attending security awareness sessions, following access control requirements and promoting responsible information handling.

Building a Strong Security Culture Beyond MAS TRM Guidelines

Employee security behavior is often overlooked when organizations mainly focus on technical controls and meeting regulatory requirements. While having the right security measures in place is essential, unsafe decisions by employees can still create incident opportunities.

For example, an employee retaining access to a restricted file even after changing roles, may appear to be a minor mistake. However, such actions can create opportunities for threat actors. This is why cyber criminals often target human behavior. They look for gaps created by lapses in judgement.

Security awareness programs can help employees understand potential risks and the right actions to take. However, awareness alone does not translate into secure behavior. Employees may understand security concepts but fail to apply them in real-life situations.

This is where human risk management becomes important. By analyzing how people interact with processes, organizations can move beyond awareness completion and focus on measurable improvements in security behavior.

MAS TRM compliance should therefore be viewed as more than fulfilling regulatory expectations. A strong security culture is built when organizations can evidence measurable improvements in employee security behavior. They should be able to show how these behaviors reduce risks and provide evidence that security practices are being consistently applied in real operational environments.