HKMA Cyber Resilience Assessment Framework Guide: C-RAF 2.0 assessments and iCAST explained

Every authorised institution in Hong Kong is expected to measure its cyber resilience against the HKMA's Cyber Resilience Assessment Framework, and banks rated medium or high inherent risk must also prove it through intelligence-led attack simulation. The Cyber Resilience Assessment Framework (C-RAF) is the assessment pillar of the HKMA's Cybersecurity Fortification Initiative (CFI), now in its 2.0 version. This guide explains who it applies to, the three-step assessment (inherent risk, maturity, iCAST), what CFI 2.0 changed, the implementation timeline and current status, how the HKMA enforces it, how service accounts, machine credentials and AI agents fit into an assessment, and a practical compliance plan. It is for CISOs, technology risk, compliance and internal audit teams at Hong Kong banks, and the assessors and testers who work with them. Sources were checked on 27 October 2026; the full C-RAF 2.0 control text is distributed by the HKMA to institutions and was not available to us, so control-level detail here is limited to what the HKMA has published.

Key takeaways

• Three pillars, one assessment framework. The CFI, launched by the HKMA in 2016, rests on C-RAF, the Professional Development Programme (PDP) and the Cyber Intelligence Sharing Platform (CISP); C-RAF is the part that produces a measured result.
• Inherent risk sets the bar. An inherent risk assessment rates the institution low, medium or high, and that rating sets the expected maturity level (Baseline, Intermediate or Advanced) for the maturity assessment across seven domains.
• iCAST for medium and high risk. Institutions rated medium or high inherent risk must run Intelligence-led Cyber Attack Simulation Testing, which the HKMA describes as extending beyond traditional penetration testing to people and process.
• CFI 2.0 took effect on 1 January 2021. It added control principles for incident response and recovery and for infrastructure protection including virtualisation security, blue team requirements in iCAST, and reliance on group or head office assessments, rolled out in three groups with the last iCAST deadline at the end of December 2023.
• Machine identities are in scope by design. Cloud, virtualisation, third party and protection controls all depend on how service accounts, API credentials and privileged automation are governed, and iCAST scenarios commonly target them.

Scope: who and what is covered

• Who: the CFI 2.0 circular of 3 November 2020 is addressed to the Chief Executives of all authorised institutions (AIs), meaning licensed banks, restricted licence banks and deposit-taking companies supervised by the HKMA.
• Grouping: the HKMA placed AIs into three groups for C-RAF 2.0. Group 1 covers major retail banks, selected foreign bank branches and new AIs that have not done a C-RAF assessment before; the HKMA assigns Groups 2 and 3 individually by scale of operation and cyber risk profile.
• What: the institution's cyber risk across its technology, delivery channels, products and services, organisation and threat history (the inherent risk aspects named in the HKMA's 2016 presentation), and the maturity of its controls across seven domains.
• Branches of overseas banks: CFI 2.0 lets AIs rely more on cyber resilience assessments performed by their banking group or head office, which matters for foreign bank branches.

Other Hong Kong regimes sit alongside C-RAF: the Hong Kong Protection of Critical Infrastructures Ordinance Guide covers the statutory critical infrastructure regime, and the Hong Kong PDPO Guide covers personal data. For a cross-jurisdiction view see the Financial Services Cyber Regulation Map.

Key obligations

The three steps of C-RAF

The HKMA's 2016 presentation describes the gap between expected and actual maturity as the basis for a roadmap for improvement. Deloitte's 2024 summary of C-RAF 2.0 reports two practical points from the framework: a tie-break rule that sets the inherent risk to medium where the count of "low" criteria does not exceed the combined count of "medium" and "high" criteria, and the option to opt in to a high rating and go straight to the maturity assessment and iCAST. Check both against the HKMA's own text.

Maturity levels

The maturity assessment has seven domains. Deloitte's summary names four of them: manage cyber risk of IT environment and assets, IT environment protection and detection, third party risk management, and response and recovery. Use the HKMA's own framework text for the full list and exact wording.

iCAST

• Purpose: simulate the attacks a real adversary would use against the institution, informed by threat intelligence, and test people and processes as well as technology.
• Phases: Deloitte lists five: preparation and scoping, development of tailored threat intelligence, development of testing scenarios, test execution, and closure.
• Blue team: CFI 2.0 introduced blue team requirements to measure detection, response and recovery capability during the test.
• Qualified people: the CFI 2.0 annex maps roles (C-RAF assessor, iCAST manager, threat intelligence specialist and testers for infrastructure and web applications) to CREST certifications and equivalent qualifications.

iCAST belongs to the same family as TIBER-EU, CBEST and other threat-led schemes. See the Threat-Led Penetration Testing Guide and the Red Team Rules of Engagement Template.

The other two pillars

• Professional Development Programme: the list of qualifications accepted for C-RAF assessments and iCAST roles; CFI 2.0 added equivalent qualifications from major overseas jurisdictions and threat intelligence qualifications.
• Cyber Intelligence Sharing Platform: the HKMA recommended changes to the Hong Kong Association of Banks to make it more user-friendly; CFI 2.0 proposed a target operating model and wider membership, including DTC Association members and other financial sectors.

Timeline and current status

As of 27 October 2026 we did not find an HKMA publication replacing C-RAF 2.0 in the sources checked, and Deloitte reported in May 2024 that institutions had generally completed at least one round and were preparing for the next. The HKMA sets later assessment cycles through supervisory communication, so confirm the current cycle and any new circulars with your HKMA case team and the HKMA's Banking Regulatory Document Repository.

Enforcement and penalties

C-RAF is a supervisory framework issued by circular, not a statute with its own penalty schedule. The HKMA uses it within its supervision of authorised institutions under the Banking Ordinance (Cap. 155): assessment results feed the supervisory view of an AI's technology risk management, and shortfalls are followed up through supervisory dialogue, remediation commitments and, where needed, the HKMA's wider supervisory powers. We found no published HKMA fine specifically for C-RAF non-compliance.

In practice the consequences that matter are supervisory: a maturity gap against the expected level becomes a tracked remediation item, iCAST findings become an action plan, and repeated slippage affects the HKMA's risk rating of the institution. Separately, a cyber incident at a bank may engage other obligations, such as incident notification to the HKMA and, for designated operators, the critical infrastructure ordinance.

What it means for AI agents and non-human identities

C-RAF does not use the term non-human identity, but its control areas depend on them. Expect assessors and iCAST teams to test the following.

• Inventory and ownership: the maturity assessment's asset and risk management domain cannot be rated well if service accounts, API keys, certificates and robotic process automation bots are not inventoried with owners. See the Non-Human Identity (NHI) Guide.
• Privileged automation: deployment pipelines, backup tools and monitoring agents often hold domain or cloud administrator rights. Bring them under privileged access management with vaulting and rotation. See the Privileged Access Management Guide.
• Cloud and virtualisation: CFI 2.0 added control principles for infrastructure protection, including virtualisation security (published summaries do not single out cloud, so check the C-RAF 2.0 text your institution received), which in practice means cloud workload identities, access keys and hypervisor management accounts. See the Cloud Security Guide.
• Third party connections: vendor integrations authenticate with tokens and keys that the third party risk domain should cover: scope, expiry, monitoring and revocation on contract exit.
• AI agents: agents used in customer service, fraud operations or IT automation need distinct identities, least privilege, logging and human approval for high-impact actions. Include them in the inherent risk assessment's technology and delivery channel aspects and in iCAST scenarios. See the AI Agents in Financial Services Security Guide.
• iCAST scenarios: stolen service account credentials, leaked API keys and token theft are realistic attack paths; ask the threat intelligence provider to include them and make sure the blue team can detect machine credential misuse.

Compliance steps

1. Confirm your group and cycle: check the HKMA's notification of your group and the current assessment cycle, and record whether you rely on a group or head office assessment.
2. Appoint qualified people: assign a C-RAF assessor and, if iCAST applies, an iCAST manager with PDP-recognised qualifications; for external providers, check the CREST or equivalent qualifications listed in the CFI 2.0 annex.
3. Run the inherent risk assessment: gather evidence for each aspect, apply the rating rules, and have senior management approve the result.
4. Run the maturity assessment: assess each of the seven domains against the expected level, with evidence for every control principle rated as met; include machine identities, cloud and third parties explicitly.
5. Build the roadmap: turn gaps into dated, owned remediation actions and report progress to the board or a board committee.
6. Plan iCAST: scope critical functions, commission tailored threat intelligence, agree rules of engagement, and prepare the blue team measurement; keep a control group informed and the rest of the organisation unaware.
7. Execute and close: run the test, run a replay or purple team session afterwards (see the Purple Teaming Guide), and track findings to closure.
8. Share and learn: participate in CISP and feed shared intelligence into the next inherent risk assessment.

Small and large institutions

A small deposit-taking company with low inherent risk works to Baseline and has no iCAST obligation, so its effort goes into evidencing basic controls and third party oversight. A major retail bank rated high works to Advanced and runs iCAST, which needs a standing threat intelligence capability, a trained blue team and board-level reporting. Foreign bank branches should map head office assessments to C-RAF domains carefully, because reliance only works where the group assessment covers the Hong Kong operation.

Framework mapping

Measuring progress

• Percentage of control principles at or above the expected maturity level.
• Open roadmap actions past their due date.
• iCAST findings closed within the agreed remediation period.
• Blue team detection rate and time to contain in the last iCAST.
• Percentage of privileged service accounts and API keys vaulted, owned and rotated.

Practitioner checklist

• Confirm your HKMA group, current assessment cycle and any reliance on group assessments, in writing.
• Check that assessors and iCAST providers hold PDP-recognised or CREST-equivalent qualifications.
• Document the inherent risk rating with evidence for each aspect and senior management approval.
• Assess all seven maturity domains with evidence, including cloud, virtualisation and third parties.
• Include service accounts, API keys, certificates, bots and AI agents in inventory and privileged access controls.
• Ask the iCAST threat intelligence provider for machine credential and token theft scenarios.
• Measure the blue team during iCAST and run a purple team replay afterwards.
• Report roadmap progress to the board and track overdue actions.
• Monitor the HKMA document repository for new CFI or C-RAF circulars.

Standards and references

• HKMA: Cybersecurity Fortification Initiative 2.0 (circular, 3 November 2020)
• HKMA: Cybersecurity Fortification Initiative 2.0 annex
• HKMA: HKMA launches Cybersecurity Fortification Initiative 2.0
• HKMA: Cybersecurity Fortification Initiative presentation (May 2016)
• Deloitte China: Cyber Resilience Assessment Framework 2.0 overview
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Financial Services Cyber Regulation Map · Threat-Led Penetration Testing Guide · Hong Kong Protection of Critical Infrastructures Ordinance Guide · Threat Actors Targeting Financial Services Guide. This guide summarises the HKMA Cyber Resilience Assessment Framework and is not legal advice.