HKMA Cyber Resilience Assessment Framework (C-RAF) 2.2.B: 2.2 Cyber risk identification, assessment, treatment and monitoring: baseline level

Baseline control principles for cyber risk identification, assessment, treatment and monitoring (required of every AI (minimum for a low inherent risk)). The cyber risk assessment identifies critical systems and high-risk transactions that need extra controls; an assessment focused on protecting customer information identifies reasonable and foreseeable threats, their likelihood and potential damage, and whether policies, procedures and customer information systems are sufficient; the assessment is updated regularly for the deployment risk of new technologies, products, services and connections. C-RAF 2.0 adds a structured framework for treating and monitoring cyber risk, with risk owners accountable for treatment (the level is not stated in the held sources).