Sets the HKMA's policy on cyber risk supervision and the roles of AIs: the supervisory processes (a risk-based approach, assessing the cyber risks of individual AIs and systemic cyber risks, supervisory guidance, the Cyber Resilience Assessment Framework to strengthen defence maturity, supervisory reviews), strengthening the sector's incident response and recovery capabilities, information-sharing infrastructure, industry engagement, and domestic and international cooperation. The C-RAF itself is modelled as a separate framework in the graph. Classification: a statutory guideline issued by the Monetary Authority under the Banking Ordinance §7(3); version V.1, 29.11.24; applies to all AIs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.