Managing cyber risk associated with third-party service providers

Our Ref.: B1/15C
B9/29C
21 December 2023
The Chief Executive
All Authorized Institutions
Dear Sir/Madam,
Managing cyber risk associated with third-party service providers I am writing to share with the industry a set of sound practices for managing cyber risk associated with the use of third-party service providers. As digitalisation of banking services advances, authorized institutions (AIs) are increasingly leveraging technology and third-party services to drive business growth and enhance operational efficiency. Meanwhile, greater reliance on third-party services has heightened AIs’ exposure to cyber risk as threat actors target the weakest link in the supply chain of digital banking services. In fact, there was a rise in both the number and sophistication of supply chain attacks that impacted a multitude of global institutions over the past year. Against this backdrop, the HKMA has undertaken a round of thematic examinations focused on AIs’ management of cyber risk associated with the use of third party services, and would like to share with the industry the sound practices observed. Sound practices As stated in various Supervisory Policy Manual modules of the HKMA (including “TM-G-1 General Principles for Technology Risk Management” and “OR-2 Operational Resilience”), AIs are required to put in place effective cyber defence covering their own operations as well as linkages with third-party service providers. The below sound practices, identified from the thematic examinations, provide guidance on how AIs may comply with this requirement.

• Ensure sufficient emphasis on cyber risk associated with third-parties in risk
  governance framework – The board of directors and senior management of AIs should ensure that their institution’s governance framework for third-party risk management and cybersecurity place sufficient emphasis on cyber risk associated with the use of third-party services and products. The governance framework should enable the AI to effectively identify, assess and manage cyber risk associated with different types of third-party relationships under a range of possible scenarios (e.g. data breaches or operational disruptions at the service providers, or security compromise of third-party services or products).

• 2 -

• Holistically identify, assess and mitigate cyber risk throughout the third-party
  management lifecycle – As part of their third-party risk management processes, AIs should holistically identify, assess and mitigate cyber risk associated with third￾parties before onboarding, and conduct regular reviews thereafter. This should include identifying cyber risk resulting from the actual operational set-up (e.g. third￾parties’ access to AIs’ internal systems, data exchange and network connection with AIs), assessing the cyber resilience of third-parties and ensuring adequate security measures are in place to mitigate the relevant risks. These security measures should be supported by proper contractual agreements, with effectiveness evaluated periodically throughout the third-party management lifecycle.

• Assess supply chain risks associated with third-parties supporting critical
  operations – In light of the emerging threat of supply chain attacks, AIs should critically assess the supply chain risks arising from third-parties supporting critical operations by conducting additional due diligence in areas such as dependencies on fourth-parties and end-to-end data processing. AIs are advised to understand the service providers’ secure software development practices and consider conducting additional security assurance reviews for higher-risk software acquisitions.

• Expand cyber threat intelligence monitoring to cover key third-parties and
  actively share intelligence with peer institutions – In addition to monitoring cyber threats intelligence related to their own environment, AIs should stay vigilant to cyber threats that target key technologies and third-party services used by them to enable timely impact assessment and the taking of containment actions. AIs should also actively exchange intelligence via the Cyber Intelligence Sharing Platform (CISP) with peer institutions in a bid to strengthen the industry’s collective preparedness against supply chain attacks.

• Strengthen the preparedness for supply chain attacks with scenario-based
  response strategies and regular drills – Since supply chain attacks are difficult to prevent in advance, AIs should formulate scenario-based incident response strategies taking into account common risk scenarios and lessons learnt from previous supply chain incidents. AIs should also establish effective response protocols with third-parties supporting critical operations and conduct regular drills to validate and refine the established protocols.

• Continuously enhance cyber defence capabilities through adopting the latest
  international standards, practices and technologies – In light of the growing complexity of third-party relationships and evolving cyber threat landscape, AIs should regularly review and enhance their layers of cyber defence with reference to latest international standards and sound practices. In particular, AIs are encouraged to adopt regulatory technologies to refine, automate and streamline third-party risk management controls and uplift their cyber defence capabilities. Reference may be made to the HKMA’s Regtech adoption guidance.

• 3 -
  More details of the above best practices can be found in the Annex. AIs are expected to review their existing controls to manage cyber risk associated with third-parties against the above guidance. Where gaps are identified, AIs should seriously consider applying the sound practices in a manner commensurate with their cyber risk exposures and the level of reliance on third-parties. The HKMA will continue to keep abreast of the international and industry developments in third-party cyber risk management, and provide further guidance to the industry as appropriate. Should your institution have any questions about this circular, please feel free to contact Mr Edmund To on 2878 1105 or Ms Angel Tse on 2597 0433. Yours faithfully, Raymond Chan Executive Director (Banking Supervision) Encl.

---

Annex - Managing cyber risk associated with third-party service providers

Annex
Managing cyber risk associated with third-party service providers The HKMA completed in 2023 a round of thematic examinations focused on AIs’ third-party cyber risk management. This note shares the sound practices identified from the thematic examinations with a view to assisting authorized institutions (AIs) in strengthening their overall cyber resilience.

1. Ensure sufficient emphasis on cyber risk associated with third-parties in risk
   governance framework
   The board of directors and senior management of AIs should ensure that their institution’s governance framework for third-party risk management and cybersecurity place sufficient emphasis on cyber risk associated with the use of third-party services and products. The governance framework should set out structured and cohesive processes to identify, assess and manage cyber risk associated with different types of third-party relationships, including outsourcing and non-outsourcing arrangements as well as IT asset acquisitions. Well-defined risk parameters, such as the sensitivity and volume of data involved, the interconnectivity with other systems, and the complexity of the supply chain, should be developed. This would enable AIs to systematically assess and address the cyber risk implications of each third-party relationship under different scenarios (e.g. data breaches, operational disruptions, potential spill over damage in case of security compromise of third-party services or products).
2. Holistically identify, assess and mitigate cyber risk throughout the third-party
   management lifecycle
   As part of their third-party risk management processes, AIs should holistically identify, assess and mitigate cyber risk associated with third-parties before onboarding, and conduct regular reviews thereafter. This should include identifying cyber risk resulting from the actual operational set-up (such as sensitive data generation, exchange and storage, and access to and interaction with AIs’ internal systems and/or systems of fourth-parties), assessing the cyber resilience of their third-party service providers, and ensuring adequate security measures (e.g. data encryption, access controls, network and service interface monitoring) are in place to mitigate the relevant risks. When conducting these reviews, AIs should follow a risk-based approach and should not rely solely on the general IT and security controls of the third-parties or external audit assurance reports. AIs should ensure that these control measures are properly implemented and proportionate to the underlying risks throughout the third￾party management lifecycle. Where appropriate, these control measures should be set out in contractual agreements, with their effectiveness monitored through regular service meetings and periodic re-assessments.
3. Assess supply chain risks associated with third-parties supporting critical
   operations
   In light of the emerging threat of supply chain attacks, it is important for AIs to conduct additional assessments of supply chain risks arising from third-parties which support AIs’ critical operations or which can cause a higher security risk if the third-party

Annex
service or product is compromised. This would normally involve obtaining a better understanding of the third-parties’ supply chains and conducting additional due diligence on areas such as dependencies on fourth-parties, use of open-source software and codes, end-to-end data processing and storage arrangements. The outcome of these reviews would enable AIs to assess third-party cyber risks more precisely and comprehensively, so as to determine the right level of ongoing monitoring required and facilitate effective responses to supply chain attacks targeting or affecting these third-parties. Further, to address the tactic of supply chain attacks through vulnerable commercial software, AIs should understand the secure software development practices of the software provider prior to acquiring mission critical system components. For cases assessed to be of high risk, AIs should consider conducting additional security assurance reviews (e.g. application security architecture review and penetration testing) prior to deploying the software in the production environment.
4. Expand cyber threat intelligence monitoring to cover key third-parties and
actively share intelligence with peer institutions Since supply chain attacks often involve exploiting zero-day vulnerabilities and can happen to any part of a supply chain, AIs should expand their cyber threat intelligence monitoring to include cyber threats that target key technologies and third-party services used by them. Through monitoring and responding to cyber threats relevant to their own environment and key third-parties, AIs would be able to enhance their capability in detecting potential supply chain attacks, thereby making timely impact assessments, incident response and the taking of containment actions possible. Furthermore, AIs should actively share supply chain threat intelligence with peer institutions via the Cyber Intelligence Sharing Platform (CISP) to strengthen the industry’s collective preparedness against suspected or active supply chain attacks that may impact multiple institutions.
5. Strengthen the preparedness for supply chain attacks with scenario-based
response strategies and regular drills
Given supply chain attacks are difficult to prevent in advance, it is important for AIs to strengthen their preparedness by developing scenario-based incident response strategies, taking into account common risk scenarios and lessons learnt from previous supply chain incidents. Moreover, AIs’ incident response strategies should reflect the need to continuously assess the impact of a supply chain attack and revisit the appropriateness of their containment actions as the investigation progresses. Triggering criteria for more severe actions (e.g. fully disconnecting and isolating the affected systems) should be properly defined so as to contain the damages when remedial measures are not immediately available or feasible. In addition, AIs should establish effective protocols with third-parties supporting critical operations for vulnerability disclosure and cyber incident notification, and conduct regular cyber incident response drills involving these third-parties to validate and refine the established protocols.
6. Continuously enhance cyber defence capabilities through adopting the latest
international standards, practices and technologies

Annex
In light of the growing complexity of third-party relationships and the evolving cyber threat landscape, AIs should regularly review and enhance their layers of cyber defence with reference to the latest international standards and sound practices such as micro-segmentation, behavioural-based abnormality detection and zero-trust architecture. Further, AIs are encouraged to adopt technologies to refine, automate and streamline their third-party risk management and cybersecurity controls. For example, AIs may leverage Regtech to develop a central repository, mapping their third-parties to their critical banking services and operations for third-party management and risk monitoring purposes. With the help of Regtech, AIs may also automate their security operations in areas such as configuration and patch management to ensure the identified security vulnerabilities are promptly mitigated. AIs may visit the HKMA’s Regtech Knowledge Hub (to be upgraded to a Fintech Knowledge Hub) for the latest supervisory guidance.