HKMA Cyber Resilience Assessment Framework (C-RAF) 5.2.B: 5.2 Analysis, mitigation and restoration: baseline level

Baseline control principles for analysis, mitigation and restoration (required of every AI (minimum for a low inherent risk)). Incidents are classified by an established severity framework and triage; a process contains and controls incidents to stop further unauthorised access to customer information and restore operations with minimal disruption, with containment and mitigation strategies for multiple incident types (for example DDoS and malware); third parties that can provide mitigation are identified; damaged IT assets are quarantined, removed, disposed of or replaced; the response programme triggers when an incident occurs at a third party; widely reported events and scenarios such as loss of production and backup systems and sites, mass destruction or alteration of data, or corruption of current and backup copies are used to improve detection and response; system and data integrity and recoverability from multiple backup copies are tested regularly; business continuity and data recovery testing happens at least annually with critical third parties.