The inherent risk and maturity assessments are conducted by qualified, competent assessors (an external consultant, or an internal function such as internal audit or technology risk management with the expertise and qualification needed), and iCAST by qualified testers in the roles of iCAST manager, specialist (threat intelligence and scenario design) and tester; the Professional Development Programme certifications, or the equivalent qualifications the HKMA lists (for assessors, for example CISA, CISSP, CISM, CRISC, CEH; for iCAST roles, CREST and HKIB CCASP certifications and listed equivalents, extended in CFI 2.0 with threat intelligence qualifications), meet the requirement. Where a professional lacks a listed qualification but is experienced, the institution may appoint them after a careful, documented assessment of their expertise.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.