(ii) Capacity monitoring: Adequacy of system capacity is monitored on an ongoing basis. Alerts and events are generated when capacity thresholds are breached. Capacity metrics are established and trend analysis is performed to predict growth. (iii) Capacity upgrade: Once the system capacity reaches or is predicted to reach the pre- set threshold, capacity upgrade will be considered and planned in order to eliminate the potential impact on services.
17.5	An FMI should have comprehensive physical and information security policies that address all potential vulnerabilities and threats.
Data Centre Physical Security In the course of selecting data centre vendors in Singapore, APEX Clear infrastructure team conducted site visits and a thorough design assessment over the data centres from four vendors. Outsourced Service Provider Audit Report (OSPAR) and Threat, Vulnerability and Risk Assessment (TVRA) reports of the data centres were obtained and assessed. Both primary and Disaster Recovery data centres are Tier 3 and Tier 4 level, equipped with mandatory facilities in place, such as access controls, real-time monitoring, and redundant power supply and network connections provided by different ISPs. Other than the access controls implemented by the data centre vendors, stringent access control policies and procedures of APEX Clear are also enforced. Any entry to our data centre space shall be logged. Non data centre staff must obtain permissions before access is granted. Visitors shall be accompanied by authorised staff during their onsite visit. Information Security Policies and Procedures APEX Clear has established IT security policies mitigating IT risks and providing feasible measures to prevent or detect these risks, including: (i) Cyber security: Connectivity between business applications of APEX Clear and members/customers are via dedicated lease lines. Cyber security devices and systems such as firewalls and Intrusion Prevention System are in place to detect and manage malicious activities and network traffic. There is also network segregation for critical and non-critical systems to minimize the impact in the event of cyber-attacks. (ii) Security Information and Event Management system is established to monitor the security events in APEX Clear. (iii) Anti-virus: APEX Clear adopts anti-virus software products to prevent, detect, and eliminate computer viruses. (iv) Patch Management: Security patches are assessed, tested and applied on a timely basis to remediate vulnerabilities. (v) Accounts and privileges: System and role-based user access accounts are reviewed periodically to ensure that the accounts are valid and appropriate user access is granted. We adhere to the “least-privilege” principle in accounts and privilege creation. User accounts that are no longer in use will be disabled or removed. (vi) Data classifications and handling: APEX Clear data are classified and protected based on the Data Classification and Handling Guidelines.
17.6	An FMI should have a business continuity plan that addresses events posing a significant risk of disrupting operations, including events that could cause a wide-scale or major disruption. The plan should incorporate the use of a secondary site and should be designed to ensure that critical information technology (IT) systems can resume operations within two hours following disruptive events. The plan should be designed to enable the FMI to complete