HKMA SPM TM-G-1: TM-G-1 General Principles for Technology Risk Management

Gives the general principles for managing technology risk: IT governance (control policies, oversight and organisation of IT, a technology risk management function, technology audits, staff competence, IT support from overseas offices); security management (information classification and protection, authentication and access control, security administration and monitoring, system security, end-user and mobile computing, physical and personnel security); system development and change management (project management, life cycle, change management); information processing (IT operations, performance and capacity, facilities and equipment, disaster recovery planning); communications networks (network management, security and certification, wireless LANs); and management of technology service providers and outsourcing. The Seventh Schedule obligations on adequate systems of control apply. Classification: a non-statutory guideline issued as a guidance note; version V.1, 24.06.03; applies to all AIs.