HKMA TM-G-1 IT Strategy + Policies + Risk + Development + Change. (1) IT STRATEGY AND PLANNING (TM-G-1.3.1) - documented + Board-approved IT strategy aligned with business strategy + risk appetite + technology innovation + customer experience + investment planning + multi-year roadmap + portfolio prioritization + KPIs + budget; (2) IT POLICIES STANDARDS AND PROCEDURES (TM-G-1.3.2) - comprehensive IT policy framework + standards + procedures + technical baselines + compliance with regulatory + sectoral expectations + periodic review + version control + workforce communication + training; (3) TECHNOLOGY RISK ASSESSMENT (TM-G-1.3.3) - risk identification + assessment + impact + likelihood + risk-treatment + residual-risk acceptance + alignment with TRM Framework + business + change-driven + new technology + cyber threat landscape + supply chain + 3rd party + cloud; ongoing + periodic review + scenarios; (4) PROJECT AND PROGRAMME MANAGEMENT (TM-G-1.4.1) - sound IT project + programme governance + planning + cost + schedule + scope + risk + benefits realization + Board oversight + steering committees + PMO + waterfall + agile + hybrid + portfolio management; (5) SYSTEM DEVELOPMENT AND ACQUISITION (TM-G-1.4.2) - secure SDLC + DevSecOps + requirements + design + development + testing + UAT + go-live + post-production + open-source + SBOM + third-party application security + SAST + DAST + SCA + container + cloud-native security + API + open banking + AI/ML model lifecycle; (6) CHANGE MANAGEMENT (TM-G-1.4.3) - documented change management process + approval + risk assessment + segregation of duties + rollback + post-implementation review + emergency change + standard change + CAB + impact assessment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.