HKMA Cyber Resilience Assessment Framework (C-RAF) HKMA-CRAF-IRA-Maturity-TargetLevel-Cycle: HKMA C-RAF Inherent Risk Assessment (IRA), Cyber Maturity Assessment (MA), Target Maturity Level, Assessment Cycle

HKMA C-RAF Inherent Risk Assessment (IRA) + Maturity Assessment (MA) methodology + assessment cycle. INHERENT RISK ASSESSMENT (IRA): scoring AI inherent cyber risk based on multiple factors including (a) TECHNOLOGY FOOTPRINT - on-premise + cloud + hybrid + complexity + interconnectivity; (b) ONLINE SERVICES - internet banking + mobile + API + open banking + customer-facing channels; (c) DATA + TRANSACTIONS - volumes + sensitivity + PII + financial + cross-border; (d) THIRD-PARTY DEPENDENCIES - service providers + cloud + outsourcing + sub-processors + interconnectedness; (e) SCALE + DEPOSITS - asset size + customer base + transaction volume + balance sheet size; (f) CYBERSECURITY THREAT-ENVIRONMENT - geopolitical + sectoral + historical incidents + targeted-attack history; (g) SECTORAL ROLE - systemically important + cross-border + interconnection with other AIs. IRA RESULT: LOW + MEDIUM + HIGH inherent risk tier; HIGH tier triggers mandatory iCAST + stricter remediation timelines + more frequent supervisory dialogue. CYBER MATURITY ASSESSMENT (MA): each of the 7 C-RAF domains scored on 5-LEVEL MATURITY SCALE - (1) BASELINE - basic + reactive + minimal documentation; (2) EVOLVING - some defined + documented + standardised processes; (3) INTERMEDIATE - largely mature + defined + measured + managed; (4) ADVANCED - sophisticated + integrated + predictive + automated where appropriate; (5) INNOVATIVE - leading-edge + adaptive + sectoral influence + research + innovation. TARGET MATURITY LEVEL ALIGNMENT: each AI must achieve TARGET MATURITY LEVEL matched to its inherent risk tier - HIGH tier expects Intermediate-to-Advanced (Level 3-4) + iCAST; MEDIUM tier expects Intermediate (Level 3); LOW tier expects Evolving-to-Intermediate (Level 2-3); AI compares CURRENT maturity vs TARGET + identifies gaps + develops REMEDIATION ROADMAP. ASSESSMENT CYCLE: (a) ANNUAL SELF-ASSESSMENT by AI + submission to HKMA + supervisory dialogue; (b) 3-YEAR INDEPENDENT REVIEW by HKMA-recognized External Assessor or accredited firms; (c) ONGOING MONITORING + ad-hoc engagement during incidents + supervisory escalations; (d) REMEDIATION ROADMAP submission + tracking + closure + HKMA validation. INDEPENDENT MATURITY REVIEW: scope + methodology + qualifications + objectivity + reporting; HKMA may extend or accelerate review cycle based on supervisory judgment.