Which of the following statements is NOT true of the Notice on Technology Risk Management [FSM-N23]?
FSM-N23 requires the licensee itself to put in place a framework and process to identify its critical systems; MAS does not pre-designate them. The 4-hour downtime cap, the 1-hour incident notification, and the 14-day root-cause report are all correctly stated.
The firm identifies its own critical systems — MAS does not label them; the numeric thresholds in the other options are accurate.
Practise more RES5 Technology Risk & Digital Advisory questions
Exam-style questions with worked answers, then full timed mocks. Free to start.
Build a daily practice habit — a few exam-style questions a day, with worked answers. Free to start.
Start practising →Original study material mapped to the public CMFAS RES5 syllabus. Unofficial, not endorsed by MAS or SCI. Verify figures and rules against current guidance before relying on them.