Share via

OSPAR (Singapore)

  • Article

OSPAR overview

The Association of Banks in Singapore (ABS) has issued the ABS Guidelines on Control Objectives and Procedures for Outsourced Service Providers (ABS Guidelines). The ABS Guidelines contain information security guidance for service providers who deliver services to financial institutions operating in Singapore. The guidelines specify the baseline organizational controls that service providers must implement in cloud outsourcing arrangements, particularly for workloads with material impact. The Outsourced Service Provider's Audit Report (OSPAR) is the framework that external auditors use to validate the service provider's controls against the criteria specified in the ABS Guidelines.

An independent third-party auditor approved by ABS performed a rigorous audit of the security capabilities of Azure, Dynamics 365, and other Microsoft online services to assess their compliance with the ABS Guidelines. The auditor attested that Microsoft cloud services security controls were suitably designed to meet the applicable ABS controls criteria and that these controls operated effectively during the year-long testing period.

Achieving the ABS OSPAR attestation demonstrates that the security controls for Microsoft in-scope services meet the ABS Guidelines, putting these services on the official list of OSPAR audited outsourced service providers that can be downloaded from the ABS outsourcing landing page. OSPAR attestation for Azure, Dynamics 365, and other Microsoft online services provides assurance to financial services customers with facilities in Singapore that Microsoft meets the high ABS requirements for deploying compliant financial services solutions.

Applicability

  • Azure

Services in scope

For a list of Microsoft cloud services in audit scope, see the Azure + Dynamics 365 OSPAR report or Cloud services in audit scope:

  • Azure
  • Dynamics 365
  • Microsoft 365
  • Power Platform

Audit reports

The Azure + Dynamics 365 OSPAR report covers Azure, Dynamics 365, Power Platform, and select Microsoft 365 cloud services. You can access the Azure + Dynamics 365 OSPAR report from the Service Trust Portal (STP) Resources for Singapore section. For instructions on how to access audit reports, see Audit documentation. Extra guidance documentation for Singapore financial institutions is available from the same STP location.

Frequently asked questions

What is a material outsourcing arrangement and why is the definition important?
An outsourcing arrangement is material if a service failure or breach:

  • Has the potential to materially affect a financial firm's business operations or ability to manage risk and comply with applicable laws and regulations; or
  • If it involves customer information, and any unauthorized access or disclosure, loss, or theft of customer information, has a material impact on a firm's customers. The definition of customer information expressly excludes securely encrypted information.

This definition is important because certain provisions of the Monetary Authority of Singapore (MAS) Outsourcing Guidelines apply only to 'material outsourcing arrangements'. These provisions include an obligation to perform annual reviews, mandatory contractual clauses addressing audit rights, and ensuring that outsourcing outside of Singapore doesn't affect MAS supervisory efforts.

How can I get the Azure OSPAR audit documentation?
For links to audit documentation, see Audit reports.

Resources