HKMA Cyber Resilience Assessment Framework (C-RAF) 2.2.A: 2.2 Cyber risk identification, assessment, treatment and monitoring: advanced level

Advanced control principles for cyber risk identification, assessment, treatment and monitoring (required, with baseline and intermediate, of an AI whose inherent risk is high). An enterprise-wide risk management function brings cyber threat analysis and specific exposures into the enterprise risk assessment; the assessment adapts to widely known and emerging risks and risk management practices; in 2.0 risk metrics highlight the assets with the highest exposure and test whether mitigating controls work, with threat modelling (for example STRIDE or PASTA) to justify compensating controls.