HKMA Cyber Resilience Assessment Framework (C-RAF) 1.3.I: 1.3 Cyber risk management: intermediate level

Intermediate control principles for cyber risk management (required, with baseline, of an AI whose inherent risk is medium). The cybersecurity function, dedicated or not, has a reporting line free of conflicts of interest; the programme is formal and based on industry standards or benchmarks; it addresses cyber risk beyond technology (financial, strategic, regulatory, compliance); benchmarks or target metrics show improvement or regression in security posture over time; management uses audits and reviews to improve cyber resilience.