HKMA Cyber Resilience Assessment Framework (C-RAF): every control, and what you already have

11 controls 101 frameworks share controls with it Hong Kong verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
API 1164	3	measure it →
APRA CPS 230 Operational Risk Management	3	measure it →
APRA CPS 234	3	measure it →
Bahrain PDPL	3	measure it →
BS 65000:2014	3	measure it →
BSI IT-Grundschutz	3	measure it →
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)	3	measure it →
FedRAMP Rev 5	3	measure it →
Family Educational Rights and Privacy Act (FERPA)	3	measure it →
FFIEC Cybersecurity Assessment Tool (CAT)	3	measure it →
FISMA	3	measure it →
FTC GLBA Safeguards Rule (16 CFR Part 314)	3	measure it →

Every control

Code	Control	Also in
`HKMA-CRAF-2024-2025-AI-Quantum-Cloud-Ransomware-DORA`	HKMA C-RAF 2024-2025 Pipeline - AI, Quantum-Resistant Cryptography, Cloud Security, Ransomware, EU DORA Coordination	0
`HKMA-CRAF-CFI-3Pillars-Scope-Mandatory`	HKMA CFI 3 Pillars (C-RAF + PDP + CISP), Mandatory Scope and Supervisory Framework	0
`HKMA-CRAF-Coord-SPM-TM-G-1-Singapore-UK-Sectoral`	HKMA C-RAF Coordination with HKMA SPM TM-G-1, Singapore MAS TRMG, UK FCA Operational Resilience and Sectoral Cybersecurity	0
`HKMA-CRAF-Crosswalk-NIST-CSF-ISO27001-FFIEC-CBEST-TIBER`	HKMA C-RAF Crosswalk to NIST CSF, ISO 27001, FFIEC CAT, CBEST, TIBER-EU and Sectoral Frameworks	0
`HKMA-CRAF-Domain1-2-Governance-Identification`	HKMA C-RAF Domain 1 (Governance) + Domain 2 (Identification) - Cyber Strategy, Risk Management, Asset Management, Threat Assessment	85
`HKMA-CRAF-Domain3-4-Protection-Detection`	HKMA C-RAF Domain 3 (Protection) + Domain 4 (Detection) - Access, Data, Infrastructure, Application, Monitoring, Testing, Threat Intel	65
`HKMA-CRAF-Domain5-6-Response-Recovery-SitAwareness`	HKMA C-RAF Domain 5 (Response and Recovery) + Domain 6 (Situational Awareness) - Incident Response, Recovery, Threat Landscape, Information Sharing	44
`HKMA-CRAF-IRA-Maturity-TargetLevel-Cycle`	HKMA C-RAF Inherent Risk Assessment (IRA), Cyber Maturity Assessment (MA), Target Maturity Level, Assessment Cycle	0
`HKMA-CRAF-Implementation-Roles-Tooling-Assurance`	HKMA C-RAF Implementation Roadmap, Organizational Roles, Tooling and Assurance	0
`HKMA-CRAF-Status-Industry-Adoption-FutureRoadmap`	HKMA C-RAF Status, Industry Adoption, Hong Kong Banking Sector and Future Roadmap	0
`HKMA-CRAF-iCAST-RedTeam-PurpleTeam-IntelLed`	HKMA C-RAF iCAST (Intelligence-Led Cyber Attack Simulation Testing) for HIGH Inherent Risk AIs	0

Tell me when HKMA Cyber Resilience Assessment Framework (C-RAF) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Role inventory + RACI
Metrics + management review
Annual cycle documentation
Role inventory + RACI + DPO designation
Operational controls + tooling investment
Reporting process + content index
Pipeline tracking + impact assessment
Pipeline-tracking + implementation plan per rule
SEC Reg S-P readiness 2025-2026
Section 1033 readiness 2026-2030

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Tooling fragmented named by 11 frameworks
Pipeline not tracked named by 8 frameworks
Multi-framework alignment ad-hoc named by 7 frameworks
Scope unclear named by 5 frameworks
Roadmap not tracked named by 3 frameworks
Supervisory engagement weak named by 3 frameworks

What this page is

A control-level reference for HKMA Cyber Resilience Assessment Framework (C-RAF), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition