HKMA Cyber Resilience Assessment Framework (C-RAF) 1.2.B: 1.2 Strategy and policies: baseline level

Baseline control principles for strategy and policies (required of every AI (minimum for a low inherent risk)). A cybersecurity strategy integrates technology, policies, procedures and training to mitigate cyber risk, with enterprise-wide coordination of every element of the programme; policies proportionate to the institution's cyber risk and complexity address cyber threat intelligence sharing, incident response and resilience; board-approved cybersecurity policies proportionate to risk and complexity are in place.