Cybersecurity Fortification Initiative 2.0

Our Ref.: B1/15C
B9/29C
3 November 2020
The Chief Executive
All Authorized Institutions
Dear Sir/Madam,
Cybersecurity Fortification Initiative 2.0 I am writing to inform authorized institutions (AIs) of the introduction of Cybersecurity Fortification Initiative (CFI) 2.0 and the associated implementation timeline. The Hong Kong Monetary Authority (HKMA) has recently completed a review of the CFI, which was launched in 2016 to raise the cyber resilience of Hong Kong’s banking system. The initiative is underpinned by three pillars: (i) the Cyber Resilience Assessment Framework (C-RAF); (ii) the Professional Development Programme (PDP); and (iii) the Cyber Intelligence Sharing Platform (CISP). CFI 2.0 has been developed after extensive consultation with the banking industry. Many of the industry’s comments received during the consultation have been taken on board. Changes have also been made to reflect the latest developments in overseas cyber practices. Specifically, recent international sound practices on cyber incident response and recovery have been incorporated into the enhanced control principles under C-RAF. As regards the PDP, the certification list has been expanded to include equivalent qualifications in major overseas jurisdictions. The HKMA has also put forward a series of recommendations to the Hong Kong Association of Banks to make the CISP more user-friendly. More details of the enhancements to the CFI can be found in the Annex to this circular. CFI 2.0 will come into effect from 1 January 2021. The HKMA will continue to adopt a phased approach to the implementation of C-RAF 2.01 . Specifically:
(i) AIs will be divided into three groups similar to those adopted for C-RAF
1.0. Group 1 will cover all major retail banks, selected foreign bank
branches and new AIs which have not undertaken the C-RAF assessments before. The rest will be included in Group 2 or 3 depending on their scale of operation and cyber risk profile. The HKMA will inform AIs individually of their assigned grouping. 1 Available on the HKMA’s Supervisory Communication Website.

• 2 -
  (ii) The timeline for completing the C-RAF 2.0 assessments for the 3 groups of AIs is as follows:
  Group 1 Group 2 Group 3
  Inherent Risk Assessment and Maturity Assessment End-September 2021 End-June 2022 End-March 2023 iCAST (applicable to AIs with inherent risk level assessed to be “medium” or “high”) End-June 2022 End-March 2023 End-December 2023 Should you have any questions regarding the implementation schedule of C-RAF 2.0, please contact Ms Connie Tse at 2597 0617 or Mr Jacky Lau at 2878 1578. For questions relating to CFI 2.0, please get into touch with the HKMA’s Fintech Facilitation Office via fintech@hkma.gov.hk. Yours faithfully, Raymond Chan Executive Director (Banking Supervision) Encl.

• 1 -
  Annex
  Cybersecurity Fortification Initiative 2.0 The HKMA has conducted a holistic review of the Cybersecurity Fortification Initiative (CFI) taking into account i) the experience gained in the past few years; ii) feedback of authorized institutions (AIs) obtained via an industry survey and interviews with selected institutions; and iii) overseas developments and new practices. The HKMA then issued a consultation paper in January 2020 putting forward a set of recommendations to enhance the three pillars of the CFI. Two workshops were conducted with members of the Hong Kong Association of Banks (HKAB), one in March and another in June, to discuss the industry feedback received during the consultation. A revised CFI, or CFI 2.0, is subsequently developed, having regard to the findings of the review. The revised framework aims to simplify the assessment process while maintaining effective control standards that are commensurate with latest technology trends. Substantial efforts will be made to expand the talent supply and encourage cyber threat intelligence sharing across the industry. Details of the major enhancements are set out below. C-RAF 2.0 – Risk assessment  Introduction of new and enhanced control principles reflecting recent international sound practices in cyber incident response and recovery, as well as latest technology trends (e.g. cloud technology and virtualisation security);  Introduction of Blue team requirements for iCAST to measure the effectiveness of detection, response and recovery functions of AIs;  Allowing more flexibility for AIs to leverage the results of similar cyber resilience assessments performed by their banking groups or headquarters; PDP –Talent Development  Updating and expanding the list of acceptable cyber professional qualifications for conducting C-RAF assessments, including new iCAST threat intelligence qualifications (see below Table); and CISP – Information Sharing  Recommending the development of a target operating model to improve the user￾friendliness of CISP by outlining the governance, roles and responsibilities of users;  Expanding the CISP membership to on-board members of the DTC Association and other financial sectors.

• 2 -
  List of equivalent qualifications iCAST Role CREST Certification Equivalent Qualifications C-RAF Assessor N/A  ISACA’s Certified Information Systems Auditor (CISA)  (ISC)2’s Certified Information Systems Security Professional (CISSP)  ISACA’s Certified Information Security Manager (CISM)  ISACA’s Certified in Risk and Information Systems Control (CRISC)  ISACA’s Cybersecurity Fundamentals Certificate (CSX-F) and Cybersecurity Nexus Practitioner Certification (CSX-P)  China Information Technology Security Evaluation Centre’s Certified Information Security Professional – Hong Kong (CISP-HK)  EC-Council’s Certified Ethical Hacker (CEH) * iCAST Manager CREST Certified Simulated Attack Manager (CCSAM)  HKIB’s CCASP – Certified Simulated Attack Manager  GIAC Penetration Tester (GPEN) and GIAC Exploit Research and Advanced Penetration Tester (GXPN)  Offensive Security Certified Expert (OSCE) and Offensive Security Exploitation Expert (OSEE) iCAST Threat Intelligence Specialist CREST Certified Threat Intelligence Manager (CCTIM) * CREST Registered Threat Intelligence Analyst (CRTIA) *  HKIB’s CCASP – Certified Simulated Attack Manager  GIAC Penetration Tester (GPEN)  GIAC Exploit Research and Advanced Penetration Tester (GXPN)  OSCE  OSEE  GIAC Cyber Threat Intelligence (GCTI) *  McAfee Institute’s Certified Cyber Intelligence Professional (CCIP) * iCAST Specialist CREST Certified Simulated Attack Specialist (CCSAS)  HKIB’s CCASP – Certified Simulated Attack Specialist  GPEN and GXPN  OSCE and OSEE  eLearnSecurity Certified Penetration Tester eXtreme (eCPTX) *  eLearnSecurity Web Application Penetration Tester eXtreme (eWPTX) *  PentesterAcademy's Certified Red Teaming Expert (CRTE) * iCAST Tester (IT infrastructure testing) CREST Certified Infrastructure Tester (CCT Infra)  HKIB’s CCASP – Certified Infrastructure Tester  GPEN  OSCE  OSCP *  eLearnSecurity Certified Professional Penetration Tester (eCPPT) *  eLearnSecurity Web Application Penetration Tester (eWPT) *  PentesterAcademy’s Certified Red Teaming Professional (CRTP) *  ISACA's CSX Penetration Testing Overview (CPTO) Certificate *

• 3 -
  iCAST Role CREST
  Certification
  Equivalent Qualifications iCAST Tester
  (web application testing)
  CREST
  Certified
  Web
  Applications
  Tester (CCT
  Web App)
   HKIB’s CCASP – Certified Web Applications Tester  GIAC Web Application Penetration Tester (GWAPT)  Offensive Security Web Expert (OSWE)  OSCP *  eLearnSecurity Certified Professional Penetration Tester (eCPPT) *  eLearnSecurity Web Application Penetration Tester (eWPT) *  PentesterAcademy’s Certified Red Teaming Professional (CRTP) *  ISACA's CPTO Certificate * _________________________ Additions to the equivalent qualifications are marked with an asterisk (*).