Singapore Government Instruction Manual on ICT&SS Management (IM8): every control, and what you already have

44 controls 292 frameworks share controls with it Singapore (GovTech) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
MTCS (Singapore)	13	measure it →
NIST Privacy Framework	11	measure it →
SOC for Cybersecurity	11	measure it →
ASD Strategies to Mitigate Cyber Security Incidents	10	measure it →
FFIEC IT Examination Handbook	10	measure it →
ISMAP (Japan)	10	measure it →
ISO 27017	10	measure it →
ISO 27018	10	measure it →
Monetary Authority of Singapore Technology Risk Management Guidelines	10	measure it →
Nebraska Data Privacy Act	10	measure it →
Nigeria Data Protection Act 2023 (NDPA)	10	measure it →
NIS2 Directive Implementing Acts	10	measure it →

Every control

Code	Control	Also in
`IM8-AWR`	Security Awareness and Training	0
`IM8-BCM`	Business Continuity and Disaster Recovery	0
`IM8-CLD`	Use of Cloud Services and Government-on-Commercial-Cloud	0
`IM8-CLD.1`	Cloud Adoption Governance	0
`IM8-CLD.2`	Cloud Security Controls	117
`IM8-CLD.3`	Cloud Service Provider Assessment	0
`IM8-CLD.4`	Cloud Data Sovereignty	51
`IM8-CLF`	Data Classification and Handling	0
`IM8-CON`	Contractor Compliance and Flow-Down	0
`IM8-DAT.1`	Data Classification	43
`IM8-DAT.2`	Data Protection	129
`IM8-DAT.3`	Data Sharing and Transfer	56
`IM8-DAT.4`	Data Retention and Disposal	92
`IM8-DEC`	Decommissioning and Data Disposal	0
`IM8-DEV`	Secure Software Development for Government Systems	0
`IM8-DLP`	Protection of Government Data Across Channels	0
`IM8-DPP`	Data Protection and Privacy by Design for Government Services	0
`IM8-DSS.1`	User-Centric Design	0
`IM8-DSS.2`	Service Reliability Standards	45
`IM8-DSS.3`	Secure Development Practices	53
`IM8-IAM`	Identity, Authentication, and Privileged Access	0
`IM8-IR`	Cyber Incident Response and Reporting to GovTech	0
`IM8-LOG`	Logging, Monitoring, and Audit Trail	0
`IM8-PATCH`	Patching and Vulnerability Remediation	0
`IM8-RA`	Risk Assessment for ICT and SS Initiatives	0
`IM8-RES.1`	Business Continuity Planning	27
`IM8-RES.2`	Disaster Recovery	166
`IM8-RES.3`	Incident Response	112
`IM8-RES.4`	Resilience Testing	100
`IM8-SCM`	Supply Chain and Vendor Management	0
`IM8-SEC.1`	Security Architecture Design	0
`IM8-SEC.2`	Access Control	126
`IM8-SEC.3`	Network Security	76
`IM8-SEC.4`	Vulnerability Management	158
`IM8-TPM.1`	Vendor Security Assessment	0
`IM8-TPM.2`	Contractual Security Requirements	0
`IM8-TPM.3`	Third-Party Monitoring	0
`IM8-TPM.4`	Supply Chain Risk Management	107
`IM8-VAPT`	Vulnerability Assessment and Penetration Testing	0
`SGIMEIGHT-1`	Governance, Audit, Independent Assurance	0
`SGIMEIGHT-2`	Information Security, Classification, Access	0
`SGIMEIGHT-3`	AI and Algorithmic System Governance	0
`SGIMEIGHT-4`	Cloud, Data, Procurement, Outsourcing	0
`SGIMEIGHT-5`	Incident Response and Continuity	0

Tell me when Singapore Government Instruction Manual on ICT&SS Management (IM8) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Records retention schedule
Retention schedule
Retention schedule and disposal records
Records inventory
Document management platform export
Evidence repository index
TPSP register
AOC collection log
contractual responsibility matrix
monitoring cadence

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

No retention schedule named by 10 frameworks
no ongoing monitoring named by 9 frameworks

What this page is

A control-level reference for Singapore Government Instruction Manual on ICT&SS Management (IM8), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition