HKMA Cyber Resilience Assessment Framework (C-RAF) 4.2.I: 4.2 Anomalies activity detection: intermediate level

Intermediate control principles for anomalies activity detection (required, with baseline, of an AI whose inherent risk is medium). Audit logs are backed up to a central log server or media so they cannot be altered (in 2.0 with security logs of key systems and endpoints kept available for incident investigation with adequate retention); tools detect unauthorised data mining; tools monitor security logs for anomalies and alert within set parameters; processes monitor unusual insider activity that could lead to data theft or destruction; automated alerts fire when customer logins come from physically distant IP locations within a short time.