Technical Note on Cross-Sectoral Cyber Mapping Exercise

1 Annex Technical Note on Cross-Sectoral Cyber Mapping Exercise Purpose of Note • This Technical Note sets out how the Authorities developed the inaugural Cyber Map, including the underlying data collection methodology, and approach adopted to visualise the data in dashboard format. Developing the inaugural Cyber Map Exercise methodology • The Cyber Mapping exercise had two key objectives, namely to: (i) help the Authorities better understand potential cyber risk concentration and interdependencies within the financial system in Hong Kong; and (ii) enable more targeted supervision and incident response by unlocking more precise mapping of third-party dependencies and potential spillover pathways. • To achieve these dual objectives, the Authorities needed to design a unique data collection methodology that could map/track the inter-relationships between participating FIs’ business and technological connections. Only through such a structure could the Authorities examine how a cyber incident could affect a FI’s critical operations, spread across connected entities, and ultimately impact business service delivery at a more systemic scale. After establishing this baseline methodology, the Authorities also needed to determine the specific data fields that could adequately capture and represent these business and technological connections. This required careful balancing to ensure that the Authorities collected all information reasonably necessary to construct a useful Cyber Map, while not subjecting participating FIs to excessive reporting requirements. • To ensure the exercise was well designed, the Authorities consulted with experts from the IMF and peer financial regulators, and also conducted a pilot run with selected FIs to reaffirm the reasonableness of the methodology and proposed data fields. Based on the constructive feedback provided by the industry and relevant experts, a three-layered structure that mapped financial services, critical operations and supporting applications, and the underlying IT infrastructure components was developed, as illustrated in Diagram 1.

2 Diagram 1: Cyber Map’s three-layered data collection methodology Constructing the inaugural Cyber Map • Based on the finalised data collection methodology, the Authorities started collecting data from around 50 participating FIs in late 2025. To ensure the resulting Cyber Map would be reasonably representative and insightful, these FIs were selected from across the banking, retail payment, securities and capital markets, mandatory provident fund, and insurance sectors, taking into account factors including their market presence, systemic importance, cyber risk profile, as well as perceived interconnectedness. The data collection process was highly collaborative and involved extensive engagement with each FI, as well as iterative data cleansing. Ultimately, some 2,900 dependencies were captured in the inaugural Cyber Map, and used to develop the first visual representation of how FIs in Hong Kong are connected at both the business and technology levels.

• The Cyber Map was “charted” leveraging a dashboard-based, network visualisation solution. To facilitate intuitive analysis, the map design and associated legend were carefully constructed. Specifically, based on the relationship data collected from participating FIs, the map depicts each entity as a “node” and illustrates the relationships between different entities using lines of varying thickness, direction and colour.

3 • Where one entity (e.g. entity A) relies on another (e.g. entity B), the line would point from entity A to entity B, and also be thicker or thinner subject to the materiality of the dependency assessed (e.g. from a data transmission, system hosting perspective). Nodes are also colour-coded by entity type, e.g. participating FI, ICT service provider, etc. Finally, the size of a “node” indicates the degree to which the entity is relied on by others (Diagram 2). The Authorities further incorporated customised filtering options to allow quick categorisation of the full data set and targeted analysis based on the scenario under review. Diagram 2: Illustrative example of how network relationships are represented in the Cyber Map The Hong Kong Monetary Authority The Securities and Futures Commission The Insurance Authority The Mandatory Provident Fund Schemes Authority 29 July 2026