Skip to main content

Explainers

What Is MTCS? Singapore's Cloud Security Standard Explained

MTCS is Singapore's three-tier cloud security standard, SS 584. Here is how Level 1 to 3 certification maps to the ISO 27001 evidence in vendor trust centres.

Solomon AmosPublished 1 Nov 20269 min read

MTCS stands for Multi-Tier Cloud Security Standard, Singapore's national certification scheme for cloud service providers, published as SS 584 and administered through Singapore's IT Standards Committee under the Infocomm Media Development Authority. If you deal with government agencies, banks or healthcare providers in Singapore, you will meet MTCS sooner or later, usually as a line on a vendor security questionnaire or a badge on a trust centre page. Most explainers stop at the acronym and the three tiers. This one goes further: it looks at which vendors in the CertReports index actually carry MTCS Level 3, which stop at Level 1 or Level 2, and why the ISO 27001 certificate sitting next to the MTCS badge in a vendor's trust centre matters as much as the MTCS badge itself. MTCS does not replace ISO 27001, it builds on it, and a vendor claiming MTCS Level 3 without a current ISO 27001 certificate underneath it is a vendor worth asking more questions.

What MTCS actually is

MTCS SS 584 is a Singapore Standard, not an ISO standard, developed by Singapore's IT Standards Committee and first published in 2013, with later revisions as cloud practice matured. It was built specifically for cloud service providers operating in or selling into Singapore, at a point when the Singapore government wanted a consistent way to assess cloud risk for its own procurement rather than relying on each agency's own checklist. The standard defines a baseline set of security controls, then layers additional controls on top across three tiers. A vendor earns the certificate through an accredited third-party certification body, often the same body that issues the vendor's ISO 27001 certificate, following an audit against the control set for the tier being claimed. The MTCS framework page in this index lists vendors with public MTCS evidence alongside the tier each one holds, so you can see the mix directly rather than taking a vendor's own description of its MTCS status at face value.

The three MTCS tiers

MTCS is structured as three cumulative levels. Each level adds controls rather than replacing the one below it, so a Level 3 certificate implies the organisation also meets Level 1 and Level 2 requirements. The tiers map loosely to data sensitivity and the consequences of a breach, not to company size or revenue.

TierIntended risk profileTypical adoptersRelationship to ISO 27001
Level 1Low-impact data, general business useMainstream SaaS and infrastructure vendors with a Singapore presenceOverlaps with ISO 27001 Annex A baseline controls
Level 2Business-sensitive or regulated dataFintech, healthtech and professional services vendors serving regulated Singapore clientsBuilds on an existing ISO 27001 certificate with sector-specific additions
Level 3Sensitive and mission-critical government or critical-infrastructure dataInfrastructure and platform providers targeting Singapore government procurementRequires a current ISO 27001 certificate as a precondition, plus MTCS-specific controls on top

MTCS tiers are cumulative: Level 3 includes everything required at Level 1 and Level 2.

How MTCS maps onto the ISO 27001 certificate already in the trust centre

This is the part most explainers skip. MTCS was deliberately designed to sit on top of ISO 27001 rather than duplicate it. A vendor pursuing MTCS Level 2 or Level 3 needs a current ISO 27001 certificate in scope for the same systems before the MTCS-specific audit even begins. That matters for two practical reasons. First, if the ISO 27001 certificate underneath has lapsed, the MTCS certificate built on it is questionable too, whatever expiry date is printed on the MTCS document itself. Second, buyers reviewing a trust centre that shows both badges should check the ISO 27001 certificate's edition and scope statement, not just its presence.

Certificates issued against the 2013 edition of ISO 27001 lapsed on 31 October 2025 under IAF MD 26, so an MTCS Level 3 vendor still showing a 2013-edition ISO 27001 badge is showing evidence that has not caught up with the transition. Treat that mismatch the same way you would treat any other stale certificate: ask for the current scope statement and the date of the last surveillance audit before you rely on either badge.

MTCS was developed to complement ISO/IEC 27001, adding cloud-specific and tiered controls on top of the information security management system a certified organisation already operates, rather than replacing it.

Who actually requires MTCS

MTCS matters most if you sell to, or operate inside, the Singapore public sector. Government agencies procuring cloud services in Singapore have historically required MTCS certification at a tier appropriate to the data classification involved, with Level 3 reserved for the most sensitive workloads. Regulated private-sector buyers, particularly in banking and healthcare, sometimes reference MTCS in their own vendor questionnaires even without a formal mandate, because the tier structure gives them something concrete to point to internally.

  • Government agencies buying cloud services for Singapore public-sector workloads
  • Banks and financial institutions regulated by Singapore's financial authorities
  • Healthcare providers handling patient data under Singapore's health data rules
  • Critical-infrastructure operators where Level 3 is the realistic floor, not the ceiling

Outside Singapore, MTCS carries little direct weight. A vendor with no Singapore government or Singapore-regulated customers has limited commercial reason to pursue it, which is one reason the certificate shows up far less often in trust centres than ISO 27001, SOC 2 or even CSA STAR.

What the index shows: Level 3 vendors versus Level 1 and 2

Across the vendors tracked in the CertReports index on 2026-11-01, MTCS appears far less frequently than ISO 27001 or SOC 2, and the vendors that do carry it skew toward Level 3 rather than Level 1 or Level 2. That fits the standard's main use case: government and critical-infrastructure procurement rather than general commercial sales. Vendors publishing MTCS evidence overwhelmingly also publish a current ISO 27001 certificate on the same trust centre page, consistent with the design described above. Where a vendor shows MTCS without a visible ISO 27001 certificate nearby, that gap is worth asking about directly rather than assuming it is an oversight in the trust centre's layout.

3
Tiers defined by SS 584
Level 1, Level 2 and Level 3, cumulative
31 Oct 2025
ISO 27001:2013 lapse date
IAF MD 26 deadline, relevant to any MTCS certificate built on a 2013-edition base
2026-11-01
Index snapshot referenced in this article
MTCS tier mix and overlap with ISO 27001 reflect the CertReports index on this date
Diagram of MTCS Level 1, Level 2 and Level 3 stacked above a shared ISO 27001 base layer
MTCS Level 2 and Level 3 both sit on top of a current ISO 27001 certificate.

Reading a trust centre for MTCS-adjacent evidence

Docebo's trust centre is a useful illustration of how these layers sit together on a real vendor page, even though Docebo's own public evidence does not include MTCS. Its page lists ISO 27001 alongside ISO 27701, ISO 27017 and ISO 27018, plus a FedRAMP entry verified against its assessor and an active DPF listing. When you are checking whether a vendor's MTCS Level 3 claim is credible, this is the layout to look for: an ISO 27001 scope statement, the certification body named on it, and the certificate's edition sitting next to, not instead of, the Singapore-specific badge.

Docebo logo

Docebo · Trust report

Education · Public evidence as of 31 Oct 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 2 verified, 9 vendor-stated.

2 more frameworks on the evidence page

5Documents and agreements

Legal and review documents Docebo publishes or offers, as of 30 Sep 2026.

2Security practices

Public statements from Docebo, shown as statements, not attestations, as of 30 Sep 2026.

  • Penetration testing · annual
  • Data residency · Australia, Canada, EU, India, US

1Subprocessors

Named on Docebo's public subprocessor list, last seen 30 Sep 2026.

Docebo's trust centre stacks several ISO certificates next to its FedRAMP and DPF entries. Every line is a dated public record from the FedRAMP Marketplace, the Data Privacy Framework list and Docebo's trust centre. A framework not shown means no public evidence was found, not that Docebo lacks it.CertReports

How to verify an MTCS certificate yourself

  1. 1

    Find the certificate number

    MTCS certificates carry a unique number issued by the certification body. Ask the vendor for it directly if it is not printed on the trust centre page.

  2. 2

    Check the tier and scope

    Confirm whether the certificate is Level 1, 2 or 3, and read the scope statement to see which products, regions or data centres it actually covers.

  3. 3

    Confirm the certification body's accreditation

    MTCS certificates are only meaningful if issued by a body accredited for the scheme. Cross-check the body against the auditors and certification bodies the index tracks for ISO and related schemes.
  4. 4

    Check the ISO 27001 certificate underneath

    Level 2 and Level 3 require a current ISO 27001 certificate as a precondition. Confirm it cites the 2022 edition and has not lapsed.

  5. 5

    Check the expiry date against the trust centre

    MTCS certificates, like ISO 27001, run on a cycle with surveillance audits. A badge with no visible date is not evidence you can act on, so run it through a bulk vendor security check if you're reviewing more than a handful of vendors.

Common mistakes buyers make with MTCS

MTCS is not a universal badge

Treating MTCS the way some buyers mistakenly treat other frameworks, as a single yes or no checkbox, misses the point of the tier structure. A vendor at Level 1 has met a materially lower bar than a vendor at Level 3, in the same way that describing a vendor as "SOC 2 certified" misstates what a SOC 2 report actually is. Ask which tier, read the scope, and check the ISO 27001 certificate sitting next to it before you rely on an MTCS badge in a vendor questionnaire response.
Flowchart showing an MTCS Level 3 audit building on an existing ISO 27001 certificate plus additional Singapore-specific controls
An MTCS Level 2 or Level 3 audit assumes a current ISO 27001 certificate is already in place.

People also ask

What is MTCS?

MTCS is the Multi-Tier Cloud Security Standard, a Singapore Standard published as SS 584 and administered by Singapore's IT Standards Committee under IMDA. It sets out security controls for cloud service providers across three cumulative tiers, Level 1, Level 2 and Level 3, with higher tiers required for more sensitive or government workloads. It builds on, rather than replaces, a vendor's ISO 27001 certificate.

What is MTCS certification?

MTCS certification is a third-party audit against SS 584, carried out by an accredited certification body, confirming that a cloud provider meets the controls for a specific tier, Level 1, 2 or 3. Certification is tier-specific and time-limited, similar to ISO 27001, with surveillance audits between full reassessments. A vendor's certificate should state the tier, scope and expiry, and sit alongside a current ISO 27001 certificate for Level 2 and Level 3.

What does MTCS stand for?

MTCS stands for Multi-Tier Cloud Security, formally the Multi-Tier Cloud Security Standard, published in Singapore as SS 584. The name describes its structure directly: a single standard split into multiple tiers, so that cloud providers handling different sensitivity levels of data can be assessed against proportionate controls rather than one fixed bar.

What does MTCS mean?

In practice, MTCS means a vendor has been independently audited against Singapore's cloud security standard at a stated tier, Level 1, 2 or 3. It signals relevance to Singapore government or regulated-sector procurement specifically, rather than a general security claim on its own. Buyers outside that context should treat it as a secondary signal and still check the vendor's underlying ISO 27001 certificate and scope.

MTCSSingaporeISO 27001cloud security standardstrust centres
S

Solomon Amos · Founder, CertReports

Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.

Read next on CertReports

You might also like