Risk ManagementHong Kong
HKMA Cyber Resilience Assessment Framework (C-RAF)
HKMA Cyber Resilience Assessment Framework (C-RAF) is the Hong Kong Monetary Authority (HKMA) MANDATORY cybersecurity assessment + supervisory framework for all Authorised Institutions (AIs) in Hong Kong + part of the broader HKMA CYBERSECURITY FORTIFICATION INITIATIVE (CFI) launched 2016. KEY HISTORY: (a) CFI announced May 2016; (b) C-RAF v1.0 issued December 2016; (c) C-RAF v2.0 issued 6 May 2020 (Circular 20200506e1a1) - major revision incorporating lessons learned + international best practice + iCAST framework; (d) ongoing 2024-2025 enhancements + supervisory communications + threat-landscape evolution.
Domains
HKMA C-RAF Domain 5-6: Response & Recovery + Situational Awareness (IR, Recovery, Threat Intel, Info Sharing)
HKMA C-RAF Domain 3-4: Protection + Detection (Access, Data, Infrastructure, Application, Monitoring, Testing)
HKMA C-RAF: Coordination with HKMA SPM TM-G-1, Sectoral Coordination, 2024-2025 Pipeline
HKMA C-RAF: Cybersecurity Fortification Initiative (CFI), 3 Pillars (C-RAF + PDP + CISP), Mandatory Scope
HKMA C-RAF Domain 1-2: Governance + Identification (Cyber Strategy, Risk Mgmt, Asset Mgmt, Threat Assessment)
Compare HKMA Cyber Resilience Assessment Framework (C-RAF)
HKMA Cyber Resilience Assessment Framework (C-RAF) vs ISO 27001:2022View comparison →HKMA Cyber Resilience Assessment Framework (C-RAF) vs SOC 2View comparison →HKMA Cyber Resilience Assessment Framework (C-RAF) vs NIST CSF 2.0View comparison →HKMA Cyber Resilience Assessment Framework (C-RAF) vs GDPRView comparison →HKMA Cyber Resilience Assessment Framework (C-RAF) vs HIPAAView comparison →HKMA Cyber Resilience Assessment Framework (C-RAF) vs PCI DSS 4.0View comparison →
HKMA Cyber Resilience Assessment Framework (C-RAF) by Industry
HKMA Cyber Resilience Assessment Framework (C-RAF) for Healthcare→HKMA Cyber Resilience Assessment Framework (C-RAF) for Financial Services→HKMA Cyber Resilience Assessment Framework (C-RAF) for Technology→HKMA Cyber Resilience Assessment Framework (C-RAF) for Government→HKMA Cyber Resilience Assessment Framework (C-RAF) for Manufacturing→HKMA Cyber Resilience Assessment Framework (C-RAF) for Energy→HKMA Cyber Resilience Assessment Framework (C-RAF) for Retail→HKMA Cyber Resilience Assessment Framework (C-RAF) for Education→
HKMA Cyber Resilience Assessment Framework (C-RAF) by Role
HKMA Cyber Resilience Assessment Framework (C-RAF) for CISOs→HKMA Cyber Resilience Assessment Framework (C-RAF) for Compliance Officers→HKMA Cyber Resilience Assessment Framework (C-RAF) for Risk Managers→HKMA Cyber Resilience Assessment Framework (C-RAF) for IT Directors→HKMA Cyber Resilience Assessment Framework (C-RAF) for DPOs→HKMA Cyber Resilience Assessment Framework (C-RAF) for Auditors→
Frequently Asked Questions
What is HKMA Cyber Resilience Assessment Framework?
HKMA Cyber Resilience Assessment Framework (C-RAF) is the Hong Kong Monetary Authority (HKMA) MANDATORY cybersecurity assessment + supervisory framework for all Authorised Institutions (AIs) in Hong Kong + part of the broader HKMA CYBERSECURITY FORTIFICATION INITIATIVE (CFI) launched 2016. KEY HISTORY: (a) CFI announced May 2016; (b) C-RAF v1.0 issued December 2016; (c) C-RAF v2.0 issued 6 May 2020 (Circular 20200506e1a1) - major revision incorporating lessons learned + international best practice + iCAST framework; (d) ongoing 2024-2025 enhancements + supervisory communications + threat-landscape evolution.
How many controls does HKMA Cyber Resilience Assessment Framework have?
HKMA Cyber Resilience Assessment Framework contains 11 controls organized across 7 domains.
Where does HKMA Cyber Resilience Assessment Framework apply?
HKMA Cyber Resilience Assessment Framework is applicable in Hong Kong. Organizations operating in or serving customers in this jurisdiction should evaluate its requirements.
What frameworks does HKMA Cyber Resilience Assessment Framework map to?
HKMA Cyber Resilience Assessment Framework has control-to-control mappings with 105 other compliance frameworks in our database. Use our compliance platform to explore these mappings interactively.
How do I get started with HKMA Cyber Resilience Assessment Framework compliance?
Start by understanding the framework's key controls and domains. Our compliance platform provides AI-powered gap analysis and mapping tools to help you assess your current posture and build a remediation plan.
How ready are you for HKMA Cyber Resilience Assessment Framework (C-RAF)?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.