HKMA Cyber Resilience Assessment Framework (C-RAF) 5.1.I: 5.1 Governance and preparation of incident response and recovery: intermediate level

Intermediate control principles for governance and preparation of incident response and recovery (required, with baseline, of an AI whose inherent risk is medium). Due diligence is done on the technical sources, consultants and forensic firms that could be called on, and direct cooperative or contractual agreements (retainers) exist with incident response providers; plans exist to re-route or substitute critical functions or services hit by a successful attack; management formally approves changes to the processes, systems, applications or access entitlements needed for incident management before they are made; lessons from real incidents improve risk mitigation and the response plan; the incident response team coordinates and communicates with internal and external stakeholders during and after an attack.