HKMA Cyber Resilience Assessment Framework (C-RAF) 1.5.B: 1.5 Staffing and training: baseline level

Baseline control principles for staffing and training (required of every AI (minimum for a low inherent risk)). Cybersecurity roles and responsibilities are identified and defined; formal processes identify the extra expertise, resources and tools needed to strengthen defences; staff with cyber responsibilities hold the qualifications their positions require; annual training covers incident response, current threats such as phishing, spear phishing and social engineering, and emerging issues; staff receive threat intelligence regularly and when visible events or regulatory alerts prompt it; a continuing training and skills programme exists for cyber staff; relevant staff receive training suited to their jobs; privileged account holders get extra training proportionate to their responsibilities; business units receive training on their own business risks.