HKMA Cyber Resilience Assessment Framework (C-RAF) 4.2.B: 4.2 Anomalies activity detection: baseline level

Baseline control principles for anomalies activity detection (required of every AI (minimum for a low inherent risk)). Logs of physical and logical access are reviewed after events; third-party access to critical systems and privileged ID activity are monitored; production time is synchronised to a central secure source such as NTP; anomalous authentication behaviour by customers, staff and third parties is detected; audit and security event logs are reviewed regularly on a risk basis and retained securely, with individual traceability of all system access; logging practice and thresholds are reviewed periodically; a process detects anomalous activity across the environment, with thresholds that decide which log activity needs a management response; alerts on anomalous customer transactions are reviewed and online transactions are monitored for anomalies.