Hong Kong Monetary Authority (HKMA)

Context For technology and risk professionals working within Hong Kong’s banking sector, the C-RAF is the inevitable baseline for cyber compliance. Understanding its structure is not just a regulatory requirement for the institution, but a core competency for those managing governance or operational risk. This note outlines the framework’s architecture and the regulator’s expectations. The Cyber Resilience Assessment Framework (C-RAF) is the mechanism by which the Hong Kong Monetary Authority (HKMA) measures the cyber maturity of Authorised Institutions (AIs). ...

The OR-2 module sets out the HKMA’s supervisory expectations for authorised institutions to maintain operational resilience in the event of a disruption. Further reading OR-2 SPM Module | HKMA (PDF) Operational Resilience: A new SPM module from HKMA | Deloitte Operational Resilience | KPMG The HKMA proposes new standards for operational resilience | Herbert Smith Freehills Fostering operational resilience | PwC Hong Kong SFC issues operational resilience standards and recommended techniques and procedures in the age of remote working | Herbert Smith Freehills Operational resilience and remote working | SFC Circular Related pages Operational Resilience (wiki) SPM TM-G-1 General Principles for Technology Risk Management SPM TM-G-2 Business Continuity Planning OR-1 Operational Risk Management SA-2 Outsourcing Cyber Resilience Assessment Framework 2.0