HKMA TM-G-1
HKMA Supervisory Policy Manual TM-G-1 General Principles for Technology Risk Management plus TM-E-1, TM-G-2, OR-2, C-RAF 2.0.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
C-RAF 2.0
| Code | Title |
|---|---|
| CRAF-2.0.1 | Inherent Risk Assessment under C-RAF 2.0 |
| CRAF-2.0.2 | Maturity Assessment under C-RAF 2.0 |
| CRAF-2.0.3 | Intelligence-led Cyber Attack Simulation Testing (iCAST) |
OR-2
| Code | Title |
|---|---|
| OR-2.2.1 | Operational Resilience Framework |
| OR-2.3.1 | Severe but Plausible Scenario Testing |
| OR-2.4.1 | Third Party and Concentration Risk for Resilience |
TM-E-1
| Code | Title |
|---|---|
| TM-E-1.2.1 | Governance of E-banking |
| TM-E-1.3.1 | Customer Authentication for E-banking |
| TM-E-1.3.2 | Transaction Monitoring and Fraud Detection |
| TM-E-1.3.3 | Customer Protection and Awareness |
| TM-E-1.4.1 | Application Security for E-banking |
TM-G-1
| Code | Title |
|---|---|
| TM-G-1.2.1 | Board and Senior Management Oversight of Technology Risk |
| TM-G-1.2.2 | Technology Risk Management Framework |
| TM-G-1.2.3 | Roles and Responsibilities |
| TM-G-1.3.1 | IT Strategy and Planning |
| TM-G-1.3.2 | IT Policies, Standards and Procedures |
| TM-G-1.3.3 | Technology Risk Assessment |
| TM-G-1.4.1 | Project and Programme Management |
| TM-G-1.4.2 | System Development and Acquisition |
| TM-G-1.4.3 | Change Management |
| TM-G-1.5.1 | IT Operations Management |
| TM-G-1.5.2 | Capacity and Performance Management |
| TM-G-1.5.3 | Problem and Incident Management |
| TM-G-1.6.1 | Information Security Programme |
| TM-G-1.6.2 | Access Control and Identity Management |
| TM-G-1.6.3 | Privileged Access Management |
| TM-G-1.6.4 | Network Security |
| TM-G-1.6.5 | Cryptographic Controls |
| TM-G-1.6.6 | Data Loss Prevention and Data Protection |
| TM-G-1.6.7 | Vulnerability and Patch Management |
| TM-G-1.6.8 | Endpoint and Mobile Security |
| TM-G-1.7.1 | Security Monitoring and SIEM |
| TM-G-1.7.2 | Cyber Threat Intelligence |
| TM-G-1.7.3 | Cyber Incident Response |
| TM-G-1.8.1 | Independent Audit of Technology Risk |
| TM-G-1.9.1 | Outsourcing and Third Party Risk |
| TM-G-1.9.2 | Cloud Computing Risk Management |
TM-G-2
| Code | Title |
|---|---|
| TM-G-2.2.1 | Business Continuity Governance |
| TM-G-2.3.1 | Business Impact Analysis |
| TM-G-2.3.2 | Recovery Strategy and Plans |
| TM-G-2.3.3 | Backup and Restoration |
| TM-G-2.4.1 | BCP Testing and Exercising |
Frequently Asked Questions
What is HKMA TM-G-1?
HKMA TM-G-1 is a compliance framework from Hong Kong with 5 domains and 42 controls. HKMA Supervisory Policy Manual TM-G-1 General Principles for Technology Risk Management plus TM-E-1, TM-G-2, OR-2, C-RAF 2.0. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
How many controls does HKMA TM-G-1 have?
HKMA TM-G-1 has 42 controls organised across 5 domains. The largest domains are TM-G-1 (26 controls), TM-E-1 (5 controls), TM-G-2 (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
What frameworks does HKMA TM-G-1 map to?
HKMA TM-G-1 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I get started with HKMA TM-G-1 compliance?
Start your HKMA TM-G-1 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about HKMA TM-G-1 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 42 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 769 frameworks.
Get Started Free →Free forever — no credit card required