Be aware of scammers impersonating as IMDA officers. Government officials will NEVER call you to transfer money, disclose bank log-in details or request for your personal information. For scam-related advice, please call the ScamShield Helpline at 1799 or go to www.ScamShield.gov.sg.

  1. Architects of SG's Digital Future
  2. Regulations and Licensing Listing
  3. ICT Standards and Quality of Service
  4. IT Standards and Frameworks
  5. Compliance and Certification

Compliance and Certification

Overview

Compliance with standards, including IMDA regulations, can be exhibited in several ways. The level of assurance differs in objectivity and continuity in time scale while at the same time, the level of visibility, and transparency may also vary.

  1. Self-assessment is a process where organisations indicate their standard compliance status after carrying out an internal check and verification, while cloud security certification typically involves a third-party assessment.
  2. Certification by 3rd party is usually undertaken by an independent auditing company also known as a certification body. Upon successful completion, a certificate is usually issued valid for a period of time (commonly 3 years) with requirements of a periodic check, known as a surveillance audit, normally done annually to ensure continual compliance.
  3. Compliance through continuous monitoring where automated tools are deployed to continuously monitor, near real-time, its fulfilment of compliance to standards. This is the highest level of achievable compliance to standards though it is difficult to comprehensively cover such near real-time monitor on all aspect of the requirements.

Other forms of demonstration of compliance to standards such as attestation by 3rd or 2nd party (e.g. consumers/buyers audit their service providers/suppliers) are also possible. Such demonstration of compliance may be exhibited by posting online its self-disclosure statement, certificate of compliance or summary display of real-time compliance status.

MTCS Certification Scheme

In conjunction with the Singapore Standard SS 584: 2020 Specification for multi-tiered cloud computing security, the MTCS Certification Scheme is developed to

  • encourage adoption of sound risk management and security practices by CSPs through MTCS certification; and
  • promote the adoption of MTCS standard.

Here are the key steps for CSPs to participate in the scheme.

  • CSPs shall source and identify suitable ACCREDITED Certification Bodies (CBs) to undertake the certification (see enclosed list of participating CBs).
  • CSPs shall work with the identified ACCREDITED CBs to prepare the following documents after having decided on the scope of certification:
  • CSPs proceed to work with ACCREDITED CBs on the certification.

Upon successful certification, CSP may email a copy of ACCREDITED MTCS certificate and a duly completed disclosure form to nitsc@imda.gov.sg for listing on the IMDA website. Only ACCREDITED MTCS certificates will be listed.

Certification will be valid for 3 years with a yearly surveillance audit to be conducted.

MTCS Certified Cloud Services

Enquiries

All enquiries regarding MTCS Certification can also be addressed to nitsc@imda.gov.sg.

Related Links

LAST UPDATED: 03 JUL 2025

Explore more

Latest news

Press Release

Singapore launches new tools to help businesses protect data and deploy AI in a trusted ecosystem

Singapore introduced two new initiatives – the expanded Global AI Assurance Sandbox and the Singapore Standard for Data Protection...
Press Release

IMDA and STB partner with Max and Universal Studio Group on HACKS season four finale

The Infocomm Media Development Authority (IMDA) Singapore and Singapore Tourism Board (STB) have partnered with Max and Universal...
Press Release

SG Unveils Insights from World’s First Technical Testing of Real World Applications of GenAI

Singapore unveiled key insights from its Global AI Assurance Pilot, an initiative to catalyse emerging norms and best practices...
View all news