As a SaaS provider, we would like to be compliant to the requirements of our Singapore based prospective clients. And the Monetary Authority of Singapore mandates a TVRA (Threat and Vulnerability Risk Assessment) to be performed annually on data-centers hosting and handling the data of Singapore based Financial Institutions.

  • To conduct the TVRA, is it necessary to physically visit the datacenter or can we send our colocation center a questionnaire about the physical security controls employed at the DC and review their answers and evidences? What is the general industry-standard practice?

2 Answers 2


As ever so often: it depends.

What does it depend on? Your level of trust and your level of risk appetite. Do you trust the operator of the DC to answer a questionnaire honestly and what risks are you willing to take in that regard? You can start by sending out the questionnaire, as you had already planned. Some business partners see questions like this as indecent, so handle this with care.

The operator's answers might lead to a breach of contract, so the questions have to be formulated well. Get in touch with your legal department and/or take look at the contract that you have with the operator.

There are several reactions that might lead you to build more trust or lose trust in your contractor. Make expectations clear internally for different scenarios and set goals, like you would in every other project. If all answers sound too good to be true, book a flight. If everything sounds terrible, don't book one - and think about terminating the contract.


Any kind of TVRA or RA for that matter should be done by going to the site. Additionally, I feel a study of existing policies, processes or procedures for Physical Security, Cyber Security, Disaster Recovery, Business Continuity, Emergency Response, etc needs to be looked at as well to see how well control measures are in place to mitigate identified threats / vulnerabilities / risks / impacts.

Sure the DC can provide manuals or SOPs that cover the above areas as a precursor to the actual site visit to evaluate / conduct the TVRA, but one needs to see these in play at site to gauge the effectiveness and I may even go so far as to say that an effective and comprehensive TVRA should also incorporate a Red Team scenario where threats or rather threat scenarios are carried out to see if the adequate control measures are triggered.

With a study of existing policies, procedures, processes and a Red Team exercise followed by an in depth TVRA and the needful control measures instituted, we can this say an effective TVRA is conducted which must involve site evaluation.

  • Welcome to Information Security Stack Exchange! Would you also know what, at a minimum, is required by the Monetary Authority of Singapore ? If yes, then please edit it into your answer. Ideally with links to authorative sources, for reference.
    – S.L. Barth
    Oct 12, 2018 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.