HKMA Cyber Resilience Assessment Framework (C-RAF) 1.3.A: 1.3 Cyber risk management: advanced level

Advanced control principles for cyber risk management (required, with baseline and intermediate, of an AI whose inherent risk is high). Risk management staff report to management and the board or a board committee any significant gaps between business units' own assessments of cyber risk and theirs; cybersecurity metrics drive strategic decisions and funding; cyber risk management monitors cyber risk limits set for business units; cyber risk data aggregation and real-time reporting meet ongoing needs, especially during incidents; a cyber insurance programme is evaluated to reduce institutional exposure.