HKMA Cyber Resilience Assessment Framework (C-RAF) 1.2.A: 1.2 Strategy and policies: advanced level

Advanced control principles for strategy and policies (required, with baseline and intermediate, of an AI whose inherent risk is high). Management reviews the strategy periodically against evolving threats and changes to the inherent risk profile; the strategy sits within the enterprise-wide risk management strategy; strategic cyber objectives are linked to tactical goals; the strategy sets out the future state of cybersecurity over short and long horizons; a comprehensive policy set addresses threat intelligence; a formal process cross-references and updates all cyber-related policies across business lines promptly.