HKMA Cyber Resilience Assessment Framework (C-RAF) 5.3.I: 5.3 Cyber forensics: intermediate level

Intermediate control principles for cyber forensics (required, with baseline, of an AI whose inherent risk is medium). Security investigations, forensic analysis and remediation are done by qualified staff or third parties; generally accepted forensic procedures, including chain of custody, gather and present evidence to support legal action; in 2.0 root cause analysis with business impact analysis quantifies impact and identifies the source or perpetrator, and a risk-based choice is made between live response and offline media analysis.