HKMA Cyber Resilience Assessment Framework (C-RAF) 7.3.I: 7.3 Ongoing monitoring of third-party risk: intermediate level

Intermediate control principles for ongoing monitoring of third-party risk (required, with baseline, of an AI whose inherent risk is medium). Monitoring is scaled in depth and frequency to each third party's risk; controls identify when third-party information needs to be obtained or analysed.