HKMA Cyber Resilience Assessment Framework (C-RAF) 7.1.B: 7.1 External connections: baseline level

Baseline control principles for external connections (required of every AI (minimum for a low inherent risk)). Policies cover external connections and network-connected third parties (excluding government and public utilities); critical business processes that depend on them are identified; network and data flow diagrams of those connections are documented, authorised, updated after change and reviewed annually; information about them is confidential and access-controlled; audit assesses whether their monitoring, escalation and resolution procedures are established and working.