HKMA C-RAF — Cyber Resilience Assessment Framework

Why does it matter?

The HKMA tells AIs to run the C-RAF regularly and then reviews the results. TM-C-1 lists reviews of AIs' C-RAF assessment results next to on-site examinations and other off-site reviews (section 3.6.1), and it expects AIs to report significant cyber incidents to the HKMA promptly (section 2.4). A weak assessment is therefore a supervisory matter, not only an internal one.

Key benefits include:

• Required maturity follows risk

The inherent risk rating of low, medium or high is mapped to a required maturity level, so a bank is benchmarked against its own exposure (HKMA circular of 24 May 2016, Annex).

• Gaps become plans

Where the maturity assessment finds material gaps, the AI is expected to plan to raise its maturity (circular of 21 December 2016). The HKMA expects the board and senior management to be kept informed of progress (circular of 12 June 2018).

• Testing uses real threat intelligence

iCAST replicates real-life attacks from specific, current threat intelligence and applies on top of traditional penetration testing.

• Supervisors see the sector

The results give the HKMA a view of the preparedness of individual AIs and of the whole banking sector.

• Qualified people do the work

Assessments must be performed by qualified professionals, with a Professional Development Program certification or an equivalent qualification as the benchmark.

How does it work?

The inherent risk assessment looks at risk factors such as the AI's business size, operational characteristics, and technology profile and usage (TM-C-1, section 3.5.1(a)). The 2016 circular adds delivery channels, products and services, and the AI's track record in defending against cyber attacks. The result is a rating of low, medium or high.

The maturity assessment determines the AI's actual maturity level and compares it with the required level that follows from the risk rating. Any gap is identified so that the actual level is brought up to at least the required one. AIs rated medium or high then run iCAST, which tests resilience by simulating attacks (TM-C-1, section 3.5.1(c)).

The HKMA rolled the C-RAF out in phases. The first phase began in December 2016 with about 30 AIs, including all major retail banks, due by end-September 2017 for the assessments and end-June 2018 for iCAST. The 2018 circular added a second phase of 60 AIs and a third of about 90. C-RAF 2.0 then used three groups, as set out in the 3 November 2020 circular.

Key Elements

• Inherent risk assessment

Rates the AI's cyber risk as low, medium or high from factors such as business size, operational characteristics and technology profile. The rating sets the required maturity level.

• Maturity assessment

Measures the actual maturity of the AI's cybersecurity controls against the required level and identifies gaps for improvement.

• iCAST

Intelligence-led Cyber Attack Simulation Testing, expected of AIs with a medium or high inherent risk rating. Scenarios replicate real attacks based on specific and up-to-date threat intelligence.

• Professional Development Program

A localized certification and training scheme built by the HKMA with the Hong Kong Institute of Bankers and the Hong Kong Applied Science and Technology Research Institute. Roles include the C-RAF Assessor and the iCAST Manager.

• Cyber Intelligence Sharing Platform

The CFI's third pillar, an infrastructure for AIs to exchange cyber intelligence. TM-C-1 notes that the HKMA works with the Hong Kong Association of Banks to improve it (section 5).

• CFI 2.0 changes

Effective 1 January 2021, CFI 2.0 added recent international sound practices on incident response and recovery to the C-RAF control principles and widened the list of equivalent overseas qualifications.

What does it cover?

The C-RAF applies to all authorized institutions (TM-C-1, Application). Under CFI 2.0, Group 1 covered all major retail banks, selected foreign bank branches and new AIs that had not done C-RAF assessments, and the rest were placed in Group 2 or 3 by scale of operation and cyber risk profile. The HKMA informs each AI of its group. The C-RAF 2.0 assessment document itself is available to AIs through the HKMA's Supervisory Communication Website, so this page draws on the HKMA circulars and TM-C-1.

What are its objectives?

TM-C-1 states the policy objective in section 2.1.

Enhance the cyber resilience of the Hong Kong banking sector by guiding AIs in managing cyber risks.

Let each AI assess its cyber risk profile and benchmark the defense and resilience it needs.

Raise cyber defense maturity to a level commensurate with the assessed risk exposure (section 3.5.2).

Test resilience by simulating real-life attacks for AIs with medium or high inherent risk (section 3.5.1(c)).

Prepare AIs to respond to and recover from severe but plausible cyber incidents (section 2.3).

Framework in Context

TM-C-1 replaced the HKMA circular of 15 September 2015 on cybersecurity risk management and sits beside TM-G-1, TM-E-1, OR-2 and SA-2 in the Supervisory Policy Manual (section 3.4.1). The Manual says statutory guidelines do not themselves have the force of law, and that failing to follow any guideline may call into question whether an AI still meets the minimum criteria for authorization (Introduction, section 3.3). TM-C-1 also promotes Secure Tertiary Data Backup for recovery from destructive attacks such as ransomware (section 4.3).

Common Framework Mappings

The C-RAF is a Hong Kong supervisory tool, and the frameworks below are ones institutions commonly relate it to when they reuse control evidence. They are not part of the C-RAF.

Mapped frameworks include:

EU DORA

FFIEC CAT

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2

SWIFT CSCF