Authorized institutions are required to carry out regular assessments under the C-RAF to raise their cyber defence maturity to a level commensurate with their assessed risk exposure; the framework comprises an inherent risk assessment on risk factors such as business size, operational characteristics, technology profile and usage, a maturity assessment of whether controls match the inherent risk, and iCAST for institutions rated medium or high (SPM TM-C-1, 3.5.1 and 3.5.2). The HKMA expects assessments generally on a three-year cycle, more often where the threat profile, the inherent risk rating, the business or new technology warrants it, with high inherent risk institutions considering a shorter cycle (2.0 guide). C-RAF 2.0 took effect on 1 January 2021 with three implementation groups (CFI 2.0 circular of 3 November 2020).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.