HKMA Cyber Resilience Assessment Framework (C-RAF) 7.2.I: 7.2 Third-party management: intermediate level

Intermediate control principles for third-party management (required, with baseline, of an AI whose inherent risk is medium). Contracts or service-level agreements document the third party's responsibility to notify cybersecurity incidents and vulnerabilities.