HKMA Cyber Resilience Assessment Framework (C-RAF) 5.2.I: 5.2 Analysis, mitigation and restoration: intermediate level

Intermediate control principles for analysis, mitigation and restoration (required, with baseline, of an AI whose inherent risk is medium). Security incidents are analysed early in an intrusion to limit impact on critical processes; separate containment strategies exist for each major attack type, with decision criteria documented, and eradication plans can be executed promptly; restored IT assets are reconfigured and tested thoroughly before reuse; incident escalations and resolutions are tracked with regular updates to management during restoration; attack scenarios are analysed for impact on critical business processes; resilience testing uses realistic and highly likely new and emerging threats; critical online systems and processes are tested to withstand stress for extended periods; results of cyber exercises improve the response plan and automated triggers.