HKMA Cyber Resilience Assessment Framework (C-RAF) 2.2.I: 2.2 Cyber risk identification, assessment, treatment and monitoring: intermediate level

Intermediate control principles for cyber risk identification, assessment, treatment and monitoring (required, with baseline, of an AI whose inherent risk is medium). Cyber risk assessments cover the risks from new products, services and relationships; the assessment's scope extends beyond customer information to all information assets, including internal information, and considers the risk of end-of-life software and hardware.