Cybersecurity (also known as Information Technology Security) isn’t just about preventing hacks — it’s about keeping critical business operations running smoothly and ensuring sensitive data stays protected.
For finance professionals, asset managers, and IT teams, cybersecurity goes far beyond compliance. It’s a daily responsibility. The systems that run your business, the devices you rely on, and the data you store — all need clear, ongoing protection.
At Outsourced Information Technology (OIT), we approach cybersecurity as something you control, not just react to. Instead of waiting for threats to appear, we help teams create secure environments that are practical to run and audit-ready when it matters.
This page is a growing collection of insights grounded in ISO 27001:2022 — the international standard for information security management. Each post breaks down complex ideas into real-world steps.
Why Cybersecurity Matters
Cybersecurity is not a one-time fix. It’s an ongoing process.
One of our team members recently completed the ISO/IEC 27001:2022 Internal Auditor Course with TÜV SÜD. The course sharpened our understanding of how internal audits reveal hidden gaps in security and compliance — especially in fast-moving environments like finance and IT.
For example, vulnerability assessments and penetration testing — often mentioned in IT plans — are actually licensable activities under Singapore’s Cybersecurity Act. Any business offering or engaging these services must ensure the provider holds the right license.
Another overlooked area is managed Security Operations Centre (SOC) monitoring.
This is defined as a service that monitors another company’s systems by scanning data that is processed, stored, or transmitted — with the aim of identifying cybersecurity threats. SOC monitoring is also a licensable activity under the Cybersecurity Act.
While OIT has yet to offer SOC monitoring as a company, one of our team members holds a personal license (CS/SOC/I-202507-001) to provide this service in his individual capacity.
That hands-on experience allows us to understand the regulatory expectations before applying at the entity level.
These aren’t abstract rules. They’re reminders that cybersecurity must be built into daily operations — with awareness, structure, and intent.
What This Guide Covers
While this series is a work in progress, the focus will expand into key cybersecurity areas, including:
Building a Cybersecurity Culture
Security starts with people, not just technology.
Even in well-equipped offices, the human element introduces risk.
Understanding how data in use becomes vulnerable in day-to-day work helps teams set better boundaries.
Risk Management
Identifying and addressing potential threats before they escalate.
A proactive mindset is essential, especially when managing risks tied to data at rest inside servers, NAS devices, and storage systems.
Access Control & Identity Management
Ensuring the right people have access to the right data at the right time.
This principle underpins secure systems, particularly when thinking about data in transit.
Incident Response & Business Continuity
Preparation is everything. Strengthening operational resilience often starts with smaller choices—like controlling what you can to protect against scams, long before a breach occurs.
Compliance & Regulations
Make security policies work in practice.
Whether you’re working with PDPA, MAS TRM guidelines, or global benchmarks like ISO 27001:2022, aligning compliance with your daily processes improves clarity and accountability.
Our Information Security category continues to expand with insights designed to meet these evolving expectations.
As this series grows, more articles will be added to cover the full spectrum of cybersecurity, with a focus on practical, real-world applications.
Want to stay updated?
Check back soon for new insights into securing your IT environment.
Data in Transit: How to Keep Your Information Safe
What is Data in Transit? Imagine you’re sending a secret message to a friend. If you write it on a postcard, anyone who gets their hands on it can read it. But if you put it in a locked box and only your friend has the key, your message stays private. That’s what...
Data at Rest: Why Your NAS or Server Needs Volume Encryption
When you buy a safe, you expect it to have a lock. The same should apply when buying a NAS file server (a shared storage box for your serviced office) or an enterprise server (a specialised computer that stores company data). If it doesn’t support encryption for data...