What is the ABS Cloud Computing Implementation Guide 2.0?
The ABS Cloud Computing Implementation Guide 2.0 is an industry playbook that helps financial institutions (FIs) in Singapore enter into and manage cloud outsourcing arrangements safely. Specifically, the Association of Banks in Singapore (ABS) developed it to translate regulatory expectations from the MAS Outsourcing Guidelines and MAS TRM Guidelines into practical controls for cloud-specific risks. Moreover, it targets two risks that standard IT frameworks often underaddress: multi-tenancy (sharing infrastructure with other customers) and data commingling (customer data stored alongside data from other tenants).
In practice, the ABS Cloud Computing Implementation Guide provides best practice recommendations rather than mandatory requirements. As a result, FIs apply it proportionately, based on their own risk appetite and the materiality of the workload moving to the cloud.
What is the guiding security principle of the ABS Cloud Computing Implementation Guide?
Cloud controls must be at least as strong as the equivalent controls an FI would have applied in-house. Specifically, this single principle anchors the entire guide. Moving to a Cloud Service Provider (CSP) cannot become a route to weaker security, governance, or resilience. Moreover, every control recommendation in the guide, from encryption and access management to incident response and disaster recovery, is evaluated against this in-house equivalence test.
How does the ABS guide classify cloud workloads?
The ABS Cloud Computing Implementation Guide classifies workloads as material or non-material, based on the FI’s risk appetite and MAS regulatory guidance. Moreover, this classification determines how deep the due diligence goes and which controls must be deployed. In practice, getting the classification right is the most consequential decision in the cloud adoption process.
Specifically, the two categories work as follows:
- Material workloads: a service failure or security breach could significantly affect business operations, reputation, profitability, or customers. Examples include core banking systems, payment processing, and customer data platforms. As a result, material arrangements require the most rigorous due diligence, contractual protections, and ongoing monitoring
- Non-material workloads: such as internal collaboration tools or marketing analytics, warrant lighter but still appropriate controls. However, FIs should document the materiality assessment and revisit it whenever the workload, data scope, or CSP arrangement changes
What due diligence must FIs perform before engaging a Cloud Service Provider (CSP)?
Before signing with a CSP, FIs must establish a formal cloud risk management framework and conduct structured due diligence on the provider. Specifically, the ABS Cloud Computing Implementation Guide expects FIs to assess, at a minimum:
- The CSP’s financial strength and long-term viability
- Physical and environmental security of its data centres
- Corporate governance, compliance posture, and audit rights
- Data residency, sub-contracting arrangements, and chain of custody
- Incident notification and breach handling procedures
How does the ABS Cloud Computing Implementation Guide structure its recommended controls?
The ABS Cloud Computing Implementation Guide organizes its recommended controls around three phases of the cloud lifecycle. Specifically, treating these as a continuous cycle rather than a one-off checklist is what keeps cloud risk under control as the environment evolves. Moreover, each phase targets a different set of stakeholders, from governance teams to architects to operations staff.
In practice, the three phases are:
- Govern the Cloud: covers account setup, the ongoing cloud operating model, control assessments, and billing and cost management
- Design and Secure the Cloud: covers reference architecture, encryption in transit and at rest, identity and access management, network segmentation, and data loss prevention, all addressed before workloads go live
- Run the Cloud: covers the operational disciplines once workloads are in production, including change management, incident and problem management, capacity management, patching, and disaster recovery testing
