Back to Frameworks
HKMA Cyber Resilience Assessment Framework (C-RAF)
Hong Kong SAR (authorized institutions supervised by the HKMA)
v2.0 (CFI 2.0, in effect from 1 January 2021); C-RAF 1.0 of December 2016
8 domains
96 controls
The HKMA's framework for Hong Kong banks to rate their inherent cyber risk, prove the matching maturity against control principles in 26 components across seven domains (baseline for low, intermediate for medium, advanced for high inherent risk) and, at medium or high risk, run intelligence-led attack simulation testing with red and blue teams. The 2.0 matrix itself is issued to banks privately.
Verified
HKMA Cyber Resilience Assessment Framework (C-RAF) is a compliance framework from Hong Kong SAR (authorized institutions supervised by the HKMA) with 8 domains and 96 controls that map to 94 other frameworks. The largest domains are Conducting the assessment: inherent risk, maturity and iCAST – HKMA Cyber Resilience Assessment Framework (C-RAF) (18 controls), Domain 3: Protection – HKMA Cyber Resilience Assessment Framework (C-RAF) (18 controls), Domain 1: Governance – HKMA Cyber Resilience Assessment Framework (C-RAF) (15 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
Conducting the assessment: inherent risk, maturity and iCAST – HKMA Cyber Resilience Assessment Framework (C-RAF)
18 controls
| Code | Title |
|---|---|
| hkma-cyber-resilience-assessment-framework-c-raf::GEN.1 | Regular C-RAF assessment by every authorized institution |
| hkma-cyber-resilience-assessment-framework-c-raf::GEN.2 | Assessment scope: systems supporting the Hong Kong business |
| hkma-cyber-resilience-assessment-framework-c-raf::GEN.3 | Qualified and competent assessors and testers |
| hkma-cyber-resilience-assessment-framework-c-raf::GEN.4 | Documentary evidence retained and open to HKMA validation |
| hkma-cyber-resilience-assessment-framework-c-raf::GEN.5 | Sign-off by the Chief Executive and the assessor |
| hkma-cyber-resilience-assessment-framework-c-raf::GEN.6 | Improvement plan and closure of gaps |
| hkma-cyber-resilience-assessment-framework-c-raf::ICAST.1 | iCAST for medium and high inherent risk institutions |
| hkma-cyber-resilience-assessment-framework-c-raf::ICAST.2 | iCAST control group |
| hkma-cyber-resilience-assessment-framework-c-raf::ICAST.3 | iCAST scoping: key functions, critical systems and test goals |
| hkma-cyber-resilience-assessment-framework-c-raf::ICAST.4 | iCAST threat intelligence report |
| hkma-cyber-resilience-assessment-framework-c-raf::ICAST.5 | iCAST testing scenarios |
| hkma-cyber-resilience-assessment-framework-c-raf::ICAST.6 | iCAST testing and progress communication |
| hkma-cyber-resilience-assessment-framework-c-raf::ICAST.7 | iCAST reporting and management endorsement |
| hkma-cyber-resilience-assessment-framework-c-raf::ICAST.8 | Blue team requirements in iCAST 2.0 |
| hkma-cyber-resilience-assessment-framework-c-raf::IRA.1 | Inherent risk profile across the five categories |
| hkma-cyber-resilience-assessment-framework-c-raf::IRA.2 | Overall inherent risk level and the minimum required maturity |
| hkma-cyber-resilience-assessment-framework-c-raf::MA.1 | Maturity assessment against the applicable control principles |
| hkma-cyber-resilience-assessment-framework-c-raf::MA.2 | Maturity attainment summary and gap identification |
Domain 1: Governance – HKMA Cyber Resilience Assessment Framework (C-RAF)
15 controls
Domain 2: Identification – HKMA Cyber Resilience Assessment Framework (C-RAF)
6 controls
| Code | Title |
|---|---|
| hkma-cyber-resilience-assessment-framework-c-raf::2.1.A | 2.1 IT asset management: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::2.1.B | 2.1 IT asset management: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::2.1.I | 2.1 IT asset management: intermediate level |
| hkma-cyber-resilience-assessment-framework-c-raf::2.2.A | 2.2 Cyber risk identification, assessment, treatment and monitoring: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::2.2.B | 2.2 Cyber risk identification, assessment, treatment and monitoring: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::2.2.I | 2.2 Cyber risk identification, assessment, treatment and monitoring: intermediate level |
Domain 3: Protection – HKMA Cyber Resilience Assessment Framework (C-RAF)
18 controls
Domain 4: Detection – HKMA Cyber Resilience Assessment Framework (C-RAF)
12 controls
| Code | Title |
|---|---|
| hkma-cyber-resilience-assessment-framework-c-raf::4.1.A | 4.1 Vulnerability detection: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::4.1.B | 4.1 Vulnerability detection: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::4.1.I | 4.1 Vulnerability detection: intermediate level |
| hkma-cyber-resilience-assessment-framework-c-raf::4.2.A | 4.2 Anomalies activity detection: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::4.2.B | 4.2 Anomalies activity detection: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::4.2.I | 4.2 Anomalies activity detection: intermediate level |
| hkma-cyber-resilience-assessment-framework-c-raf::4.3.A | 4.3 Cyber incident detection: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::4.3.B | 4.3 Cyber incident detection: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::4.3.I | 4.3 Cyber incident detection: intermediate level |
| hkma-cyber-resilience-assessment-framework-c-raf::4.4.A | 4.4 Threat monitoring and analysis: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::4.4.B | 4.4 Threat monitoring and analysis: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::4.4.I | 4.4 Threat monitoring and analysis: intermediate level |
Domain 5: Response and recovery – HKMA Cyber Resilience Assessment Framework (C-RAF)
12 controls
| Code | Title |
|---|---|
| hkma-cyber-resilience-assessment-framework-c-raf::5.1.A | 5.1 Governance and preparation of incident response and recovery: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::5.1.B | 5.1 Governance and preparation of incident response and recovery: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::5.1.I | 5.1 Governance and preparation of incident response and recovery: intermediate level |
| hkma-cyber-resilience-assessment-framework-c-raf::5.2.A | 5.2 Analysis, mitigation and restoration: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::5.2.B | 5.2 Analysis, mitigation and restoration: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::5.2.I | 5.2 Analysis, mitigation and restoration: intermediate level |
| hkma-cyber-resilience-assessment-framework-c-raf::5.3.A | 5.3 Cyber forensics: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::5.3.B | 5.3 Cyber forensics: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::5.3.I | 5.3 Cyber forensics: intermediate level |
| hkma-cyber-resilience-assessment-framework-c-raf::5.4.A | 5.4 Communication and improvement: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::5.4.B | 5.4 Communication and improvement: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::5.4.I | 5.4 Communication and improvement: intermediate level |
Domain 6: Situational awareness – HKMA Cyber Resilience Assessment Framework (C-RAF)
6 controls
| Code | Title |
|---|---|
| hkma-cyber-resilience-assessment-framework-c-raf::6.1.A | 6.1 Threat intelligence: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::6.1.B | 6.1 Threat intelligence: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::6.1.I | 6.1 Threat intelligence: intermediate level |
| hkma-cyber-resilience-assessment-framework-c-raf::6.2.A | 6.2 Threat intelligence sharing: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::6.2.B | 6.2 Threat intelligence sharing: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::6.2.I | 6.2 Threat intelligence sharing: intermediate level |
Domain 7: Third-party risk management – HKMA Cyber Resilience Assessment Framework (C-RAF)
9 controls
| Code | Title |
|---|---|
| hkma-cyber-resilience-assessment-framework-c-raf::7.1.A | 7.1 External connections: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::7.1.B | 7.1 External connections: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::7.1.I | 7.1 External connections: intermediate level |
| hkma-cyber-resilience-assessment-framework-c-raf::7.2.A | 7.2 Third-party management: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::7.2.B | 7.2 Third-party management: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::7.2.I | 7.2 Third-party management: intermediate level |
| hkma-cyber-resilience-assessment-framework-c-raf::7.3.A | 7.3 Ongoing monitoring of third-party risk: advanced level |
| hkma-cyber-resilience-assessment-framework-c-raf::7.3.B | 7.3 Ongoing monitoring of third-party risk: baseline level |
| hkma-cyber-resilience-assessment-framework-c-raf::7.3.I | 7.3 Ongoing monitoring of third-party risk: intermediate level |
Your Compliance Coverage
If you comply with HKMA Cyber Resilience Assessment Framework (C-RAF), you already cover:
Ghana Cybersecurity Act
3%
3 controls mapped
Compare →US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule
3%
3 controls mapped
Compare →TEFCA - Trusted Exchange Framework and Common Agreement
3%
3 controls mapped
Compare →+ 91 more: Privacy Act 1988 (Australia) (3%), OWASP ASVS (3%)
See all 94 mapped frameworks ↓Maps to 94 other frameworks
107 total controls
Ghana Cybersecurity Act
3 source controls mapped|6 target controls covered
3%
US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule
3 source controls mapped|3 target controls covered
3%
TEFCA - Trusted Exchange Framework and Common Agreement
3 source controls mapped|1 target controls covered
3%
Privacy Act 1988 (Australia)
3 source controls mapped|3 target controls covered
3%
OWASP ASVS
3 source controls mapped|7 target controls covered
3%
NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems
3 source controls mapped|4 target controls covered
3%
GLBA
3 source controls mapped|4 target controls covered
3%
ISO/IEC 27011:2024
3 source controls mapped|9 target controls covered
3%
FISMA
3 source controls mapped|3 target controls covered
3%
ISO/IEC 30111:2019
3 source controls mapped|5 target controls covered
3%
FTC GLBA Safeguards Rule (16 CFR Part 314)
3 source controls mapped|6 target controls covered
3%
FFIEC Cybersecurity Assessment Tool (CAT)
3 source controls mapped|12 target controls covered
3%
Bahrain PDPL
3 source controls mapped|6 target controls covered
3%
BSI IT-Grundschutz
3 source controls mapped|15 target controls covered
3%
API 1164
3 source controls mapped|11 target controls covered
3%
FedRAMP Rev 5
3 source controls mapped|5 target controls covered
3%
ISO/IEC 27400:2022
3 source controls mapped|6 target controls covered
3%
Family Educational Rights and Privacy Act (FERPA)
3 source controls mapped|1 target controls covered
3%
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
3 source controls mapped|6 target controls covered
3%
APRA CPS 234
3 source controls mapped|6 target controls covered
3%
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
3 source controls mapped|5 target controls covered
3%
APRA CPS 230 Operational Risk Management
3 source controls mapped|5 target controls covered
3%
GAMP 5 - Good Automated Manufacturing Practice
3 source controls mapped|3 target controls covered
3%
BS 65000:2014 - Guidance on Organizational Resilience
3 source controls mapped|3 target controls covered
3%
IEC 62351 - Power Systems Communication Security
3 source controls mapped|5 target controls covered
3%
Vietnam Law on Cybersecurity (No. 116/2025/QH15)
2 source controls mapped|2 target controls covered
2%
US NRC 10 CFR 73.54 - Cyber Security for Nuclear Power Plants
2 source controls mapped|1 target controls covered
2%
OWASP Top 10:2025
2 source controls mapped|5 target controls covered
2%
NATO AQAP 2110 - Quality Assurance Requirements for Design, Development, and Production
2 source controls mapped|3 target controls covered
2%
ISO/IEC 27010:2015
2 source controls mapped|4 target controls covered
2%
ISO/IEC 27031:2011
2 source controls mapped|6 target controls covered
2%
ASIS SPC.1-2009 - Organizational Resilience Standard
2 source controls mapped|6 target controls covered
2%
ISO/IEC 27007:2020
2 source controls mapped|2 target controls covered
2%
HITECH Act
2 source controls mapped|2 target controls covered
2%
APPI
2 source controls mapped|5 target controls covered
2%
Canada ITSG-33 - IT Security Risk Management
2 source controls mapped|1 target controls covered
2%
ASD Strategies to Mitigate Cyber Security Incidents
2 source controls mapped|13 target controls covered
2%
Barbados Data Protection Act 2019
2 source controls mapped|2 target controls covered
2%
COBIT 2019
2 source controls mapped|2 target controls covered
2%
FIRST CSIRT Services Framework and Standards
2 source controls mapped|2 target controls covered
2%
UK Defence Standard 05-138 - Cyber Security for Defence Suppliers
2 source controls mapped|1 target controls covered
2%
ICAO Annex 17 - Aviation Security (AVSEC)
2 source controls mapped|2 target controls covered
2%
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
2 source controls mapped|8 target controls covered
2%
FBI CJIS Security Policy
2 source controls mapped|6 target controls covered
2%
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)
2 source controls mapped|8 target controls covered
2%
FDA 21 CFR Part 11
2 source controls mapped|4 target controls covered
2%
AML/CTF Act 2006 (Australia)
2 source controls mapped|2 target controls covered
2%
ISO/IEC 29147:2018
2 source controls mapped|5 target controls covered
2%
Singapore AI Governance Framework
2 source controls mapped|1 target controls covered
2%
IEC 60601-1 - Medical Electrical Equipment Safety
2 source controls mapped|4 target controls covered
2%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
2 source controls mapped|8 target controls covered
2%
AS9100D - Aerospace Quality Management System
2 source controls mapped|1 target controls covered
2%
ISO/IEC 23837:2023
2 source controls mapped|4 target controls covered
2%
US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties
2 source controls mapped|2 target controls covered
2%
GLI-33 - Gaming Laboratories International Event Wagering Systems
2 source controls mapped|1 target controls covered
2%
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)
2 source controls mapped|3 target controls covered
2%
ISO/IEC 29134:2023
2 source controls mapped|4 target controls covered
2%
Aged Care Quality Standards 2019 (repealed edition)
2 source controls mapped|1 target controls covered
2%
Florida Digital Bill of Rights (FDBR)
2 source controls mapped|3 target controls covered
2%
FedRAMP High
2 source controls mapped|2 target controls covered
2%
FedRAMP Moderate
2 source controls mapped|2 target controls covered
2%
German Supply Chain Due Diligence Act (LkSG)
2 source controls mapped|2 target controls covered
2%
ISO/IEC 29115:2013 - Entity Authentication Assurance Framework
2 source controls mapped|2 target controls covered
2%
South Korea Cloud Security Assurance Program (CSAP)
1 source controls mapped|1 target controls covered
1%
US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements
1 source controls mapped|1 target controls covered
1%
COSO Internal Control - Integrated Framework (2013)
1 source controls mapped|1 target controls covered
1%
UAE Virtual Asset Regulatory Authority (VARA) Regulations
1 source controls mapped|1 target controls covered
1%
OWASP API Security Top 10 - 2023
1 source controls mapped|2 target controls covered
1%
ISO/IEC 27006-1:2024
1 source controls mapped|1 target controls covered
1%
FIDO2 / WebAuthn
1 source controls mapped|1 target controls covered
1%
ISO/IEC 29100:2024
1 source controls mapped|3 target controls covered
1%
Vermont Data Privacy and Online Surveillance Act
1 source controls mapped|1 target controls covered
1%
USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement)
1 source controls mapped|1 target controls covered
1%
SWIFT CSCF
1 source controls mapped|1 target controls covered
1%
PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR)
1 source controls mapped|4 target controls covered
1%
South Korea PIPA
1 source controls mapped|1 target controls covered
1%
Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018)
1 source controls mapped|1 target controls covered
1%
India Account Aggregator Framework (RBI)
1 source controls mapped|1 target controls covered
1%
Illinois Biometric Information Privacy Act (BIPA)
1 source controls mapped|1 target controls covered
1%
ISO/IEC 27014:2020
1 source controls mapped|2 target controls covered
1%
Albania Law No. 124/2024 on Personal Data Protection
1 source controls mapped|2 target controls covered
1%
Science Based Targets Initiative (SBTi) - Net-Zero Standard
1 source controls mapped|2 target controls covered
1%
French Sapin II Law (Law No. 2016-1691)
1 source controls mapped|3 target controls covered
1%
FATF Recommendation 16 - Payment Transparency (Travel Rule)
1 source controls mapped|1 target controls covered
1%
DFARS 252.204-7012 - Safeguarding Covered Defense Information
1 source controls mapped|1 target controls covered
1%
PCI DSS 4.0
1 source controls mapped|1 target controls covered
1%
US Foreign Corrupt Practices Act (FCPA)
1 source controls mapped|1 target controls covered
1%
ISO/IEC 27004:2016
1 source controls mapped|3 target controls covered
1%
FSSC 22000 - Food Safety System Certification
1 source controls mapped|1 target controls covered
1%
SQF Code Edition 9 - Safe Quality Food
1 source controls mapped|2 target controls covered
1%
ISO/IEC 27050-1:2019
1 source controls mapped|1 target controls covered
1%
Azerbaijan Law on Personal Data (2010)
1 source controls mapped|1 target controls covered
1%
GLOBALG.A.P. Integrated Farm Assurance (IFA) Standard v6
1 source controls mapped|1 target controls covered
1%
FDA Quality Management System Regulation (QMSR)
1 source controls mapped|1 target controls covered
1%
Coverage is not the same as your position
This page shows what HKMA Cyber Resilience Assessment Framework (C-RAF) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is HKMA Cyber Resilience Assessment Framework (C-RAF) and who does it apply to?
HKMA Cyber Resilience Assessment Framework (C-RAF) is a compliance framework from Hong Kong SAR (authorized institutions supervised by the HKMA) with 8 domains and 96 controls. The HKMA's framework for Hong Kong banks to rate their inherent cyber risk, prove the matching maturity against control principles in 26 components across seven domains (baseline for low, intermediate for medium, advanced for high inherent risk) and, at medium or high risk, run intelligence-led attack simulation testing with red and blue teams. The 2.0 matrix itself is issued to banks privately. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does HKMA Cyber Resilience Assessment Framework (C-RAF) actually require?
HKMA Cyber Resilience Assessment Framework (C-RAF) has 96 controls organised across 8 domains. The largest domains are Conducting the assessment: inherent risk, maturity and iCAST – HKMA Cyber Resilience Assessment Framework (C-RAF) (18 controls), Domain 3: Protection – HKMA Cyber Resilience Assessment Framework (C-RAF) (18 controls), Domain 1: Governance – HKMA Cyber Resilience Assessment Framework (C-RAF) (15 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of HKMA Cyber Resilience Assessment Framework (C-RAF) do I already cover?
HKMA Cyber Resilience Assessment Framework (C-RAF) maps to 94 other compliance frameworks. The top mapping partners are Ghana Cybersecurity Act (3% coverage), US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule (3% coverage), TEFCA - Trusted Exchange Framework and Common Agreement (3% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement HKMA Cyber Resilience Assessment Framework (C-RAF)?
Start your HKMA Cyber Resilience Assessment Framework (C-RAF) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about HKMA Cyber Resilience Assessment Framework (C-RAF) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 96 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required