HKMA Cyber Resilience Assessment Framework (C-RAF)
Domain 7: Third-party risk management – HKMA Cyber Resilience Assessment Framework (C-RAF)

HKMA Cyber Resilience Assessment Framework (C-RAF) 7.3.B: 7.3 Ongoing monitoring of third-party risk: baseline level

Baseline control principles for ongoing monitoring of third-party risk (required of every AI (minimum for a low inherent risk)). Their cybersecurity assessments are updated and reviewed regularly; monitoring includes reviewing their cyber resilience plans; a formal programme assigns responsibility for ongoing oversight of their access.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in Domain 7: Third-party risk management – HKMA Cyber Resilience Assessment Framework (C-RAF)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll HKMA Cyber Resilience Assessment Framework (C-RAF) controls