Requirement · MAS · Consultation readiness
MAS P012-2026: Check Your Technology Risk Readiness
The proposed amendments are not yet final, but gaps in your technology records and controls may already be visible.
Test what works today and assign owners to the gaps you find.
Key takeaway
Trace one critical service through its assets, dependencies, controls and recovery evidence. Prepare for the final Notices with a documented gap list and clear decision owners.
A Practical Readiness Check for the Proposed TRM Amendments
01 · Status and purpose
What is proposed, and what can be checked now?
MAS P012-2026 is a closed consultation on proposed amendments to eleven Technology Risk Management Notices. The paper covers IT asset management, IT risk assessment and monitoring, capacity, change controls, continuous monitoring, backup, incident management and the recording of partial or intermittent disruption. The wording and the proposed 12-month period after publication of finalised Notices were still subject to feedback at the status check on 24 September 2026.
A useful preparation exercise is to test an existing critical service end to end. Choose a service, name its critical systems and ask control owners to show the records and evidence that link them. This makes gaps visible without guessing what the final Notices will say.
Keep the status clear: this is a readiness method suggested by Centvra. The consultation does not prescribe a single platform or this checklist. Read the official MAS consultation before relying on the proposed wording.
02 · Internal readiness check
Follow one critical service through the controls
Ask for a real record or recent example at each stop. Note the source system, owner, date and any missing relationship. The proposed areas below come from the MAS paper; the test questions are Centvra's interpretation.
Assets and dependencies
Can owners identify hardware, software, cryptographic assets and relevant third-party components? Do the records connect the service to critical systems and the systems they depend on?
Risk and capacity
Is a material IT risk linked to its owner, mitigation and indicator? Do capacity assessments include supporting systems, growth and potential surges in demand?
Changes and monitoring
Does a recent change show upstream and downstream impact, testing and recovery measures? Can an alert be traced from its threshold to the response and remedial action?
Backup and incidents
Which crucial data are protected, and can owners show restoration evidence? Can an incident record preserve the investigation, communications and any partial or intermittent downtime?
One sample will not establish institution-wide readiness. Extend the check to other critical systems and owners where the first pass reveals shared dependencies or inconsistent practice.
03 · Record the gaps
Classify the work before deciding on technology
For each finding, record the proposed area, current evidence, owner, next action and whether the final Notice could change the decision. More than one class can apply to the same finding.
Existing capability
Control and evidence already operate; confirm coverage and ownership.
Configuration
A current tool or process needs agreed rules, thresholds or workflow.
Data repair
Missing owners, identifiers, records or relationships obstruct the control.
Integration
Evidence exists in separate systems but cannot be reliably linked or retrieved.
Potential technology gap
An operating need remains after existing capabilities and processes are assessed.
Final wording needed
Keep a decision provisional where MAS expressly sought feedback.
04 · Prepare the decision
Give each gap an owner and a next step
Assign work that is useful regardless of the final wording, such as correcting records, mapping dependencies and testing restoration or alert response. Set aside choices that depend on MAS's response to consultation questions. Identify who will compare the final Notices with the readiness record, update the delivery plan and approve any later technology evaluation.
The proposed 12 months would run from publication of finalised Notices. It is not a confirmed deadline or a suggested split between procurement and implementation. Data repair, control design, integration, testing and operational handover may all consume time after a final decision.
Centvra's view
The most useful result now is a credible gap record with named owners, evidence and decisions that can be revisited. If that work later reveals a genuine technology need, the institution will be able to define it from the control outcome rather than the consultation headline.
Planning reference: Use this check to prepare internal decisions. Which requirements apply will depend on the final Notices and your institution's circumstances.
Five Readiness Gaps Worth Testing Now
01 · An Inventory Without Reliable RelationshipsAsset data
An asset list can look complete while versions, owners, criticality, third-party components or dependencies are missing. A count of records does not show whether the institution can understand the impact of a change or incident.
Check the recordCan you trace one critical system to its supporting components, dependencies and the owners who can correct those records?
02 · Risk Indicators Without an Action PathRisk ownership
An indicator can be reported regularly without changing any decision. The record should connect a material technology risk to its owner and mitigation, then show what happens when a threshold is breached. Any P012-specific indicator remains provisional while MAS considers feedback.
Trace the actionFor one breached indicator, who reviewed it, what action followed and where is that decision recorded?
03 · Capacity and Changes Assessed in IsolationDependencies
Capacity may look sufficient at the critical system while shared infrastructure or an upstream service is constrained. A change assessment can miss the same relationship, including what must be recovered if implementation fails.
Test the dependencyDid the last capacity review and material change assessment use the same upstream and downstream system relationships?
04 · Monitoring That Stops at the AlertResponse
A dashboard can show that a threshold was crossed without showing whether anyone responded effectively. Partial or intermittent disruption may also disappear between monitoring, incident records and downtime calculations.
Follow the alertCan one recent alert be followed through ownership, response, incident evidence and the classification of any service disruption?
05 · Backup Records Without a Recovery TestRecovery
A successful backup job does not demonstrate that crucial data can be restored to support the service. MAS is still consulting on whether an immutable backup, an offline backup or both should be required, and on backup frequency.
Verify recoveryCan the owner show a restoration test for the crucial data, including the result and any unresolved failure?
Fit-based software matching
Find software that fits how your organisation operates
Tell us what the software must support, how your teams work and which delivery constraints matter. Centvra uses those inputs to build a focused supplier shortlist.
Your operating brief
Fit-based shortlist
Common questions
- Is MAS P012-2026 already in force?
No. As at 24 September 2026, the official MAS page identified P012-2026 as a closed consultation. The supplied paper contains proposed amendments, not finalised amended Notices.
Check MAS's latest publications before relying on any proposed wording as a current requirement.
- When would the proposed amendments take effect?
The proposed period is 12 months after publication of the finalised Notices. MAS also asked for feedback on whether that period is sufficient.
No finalised publication date was identified in the official source review on 24 September 2026, so there is no confirmed effective date in this page.
- What can an institution check before MAS finalises the Notices?
Start with one critical service and ask owners to show evidence across three areas:
- Its supporting assets, software components, dependencies and owners.
- The related IT risk entry, capacity assessment and a recent change or monitoring alert.
- Incident, backup, restoration and downtime records where relevant.
Record who can repair any missing data or weak process. This sampling method is Centvra's suggested readiness exercise, not a MAS-prescribed checklist.
- Does the consultation require an institution to buy new software?
No specific product is prescribed in the consultation paper. First test what existing systems and processes already support.
A gap may call for clearer ownership, better data, configuration, integration or a change to the control process. Assess a new product only if a defined operating need cannot reasonably be met by the current environment.
- How should we treat the proposed 12-month period in planning?
Treat the 12-month period as a proposal, not a confirmed deadline or a procurement schedule. It would be measured from publication of the finalised Notices if adopted.
Map the work that could consume an implementation period: data repair, approvals, integration, testing and operating transition. Revisit that plan when MAS confirms the final wording and effective date.
- Are both immutable and offline backups required under P012-2026?
That is not settled. The paper proposes an immutable or offline backup for data crucial to relevant business services. MAS asked whether both forms should be required, whether either would suffice and whether to prescribe backup frequency.
Confirm the final wording before setting a P012-specific rule. The institution can still review its current backup and restoration evidence now.