HKMA Cyber Resilience Assessment Framework (C-RAF) 3.3.B: 3.3 Data protection: baseline level

Baseline control principles for data protection (required of every AI (minimum for a low inherent risk)). Removable media use is restricted to authorised staff and unauthorised copying of confidential data to it is prevented; antivirus and anti-malware run on end points without sandboxing; mobile devices with institution data are centrally managed for antivirus and patches and wiped remotely if lost or stolen; data on hardware and media is destroyed or wiped when no longer needed; confidential data is encrypted over public or untrusted networks and on mobile devices and removable media; customer data used outside production is masked or removed as law, regulation and policy require; policies dispose of data within expected time frames.