HKMA Cyber Resilience Assessment Framework (C-RAF) 1.3.B: 1.3 Cyber risk management: baseline level

Baseline control principles for cyber risk management (required of every AI (minimum for a low inherent risk)). A cybersecurity and business continuity risk management function exists; the risk management programme covers identification, measurement, mitigation, monitoring and reporting of cyber risk; management uses audit results to improve cybersecurity policies, procedures and controls and tracks moderate and high residual risks from the cyber risk assessment until they are resolved; a social media policy tells staff not to post sensitive work information. C-RAF 2.0 adds defined key cybersecurity management roles for enterprise governance and coordination (the level is not stated in the held sources).