HKMA Cyber Resilience Assessment Framework (C-RAF) 1.5.I: 1.5 Staffing and training: intermediate level

Intermediate control principles for staffing and training (required, with baseline, of an AI whose inherent risk is medium). Leaders of the cybersecurity effort have the right knowledge and experience; cyber staff renew their qualifications periodically; candidates, contractors and third parties are background-checked in proportion to the data they reach, business need and acceptable risk; audits or management reviews identify gaps in security capability and expertise; management makes sure cyber resilience awareness reaches all staff levels (for example social engineering and phishing awareness) and that lessons from social engineering and phishing exercises feed the awareness programme; retail and commercial customers receive cybersecurity awareness information regularly; business units receive training on their particular business risks.