HKMA Cyber Resilience Assessment Framework (C-RAF) 4.3.B: 4.3 Cyber incident detection: baseline level

Baseline control principles for cyber incident detection (required of every AI (minimum for a low inherent risk)). Processes watch for unauthorised users, devices, connections and software; responsibility for monitoring and reporting suspicious activity is assigned; the physical environment is monitored for unauthorised access; event information from several sources (network, application, firewall) is correlated; mechanisms such as antivirus and log alerts notify the security monitoring function and management of potential attacks; alert parameters trigger mitigating action; system performance reports serve as a risk indicator; tools detect insider anomalies, attack patterns or signatures and trigger the incident response programme.