HKMA Cyber Resilience Assessment Framework (C-RAF) 5.1.B: 5.1 Governance and preparation of incident response and recovery: baseline level

Baseline control principles for governance and preparation of incident response and recovery (required of every AI (minimum for a low inherent risk)). A CIRR framework defines objectives and the roles of business and IT parties, who know their roles in an incident, with board and senior management oversight; a policy and process set out how to respond to cyber incidents, prioritise them for rapid response and data recovery, and control digital forensics; business impact analysis, business continuity, disaster recovery, crisis management plans and data backup programmes recover operations after an incident, with alternative processes to continue critical activity in a reasonable time; the incident response team has the relevant expertise and clear roles. In 2.0 plans and playbooks cover different cyber scenarios, including severe but plausible ones, with activation criteria, and recovery objectives (RTO, RPO), restoration priorities and metrics are defined.