Good practices for addressing vulnerabilities related to operational resilience (2026-04-01)

Circulars Email: HKMA E-mail Alert of 02 April 2026 (05:00 p.m. HKT)

Back to Summaries PDF Original Document
Document Information

Title: Good practices for addressing vulnerabilities related to operational resilience (2026-04-01)

Type: Circulars

URL: https://brdr.hkma.gov.hk/eng/doc-ldg/current/20260401-1-EN

Email Received: 2026-04-02 19:34

Summary Created: 2026-04-02 14:00

English Summary (4367 chars)
Quick section switch
Management Summary
  • Purpose / Background: The HKMA is issuing this circular to share observed good practices for addressing residual operational resilience vulnerabilities. This follows the industry-wide implementation of the Supervisory Policy Manual (SPM) module OR-2 and serves as a guide for AIs during the final stage of their resilience journey.
  • One-line conclusion: AIs must review and integrate the HKMA’s identified "good practices" into their operational resilience frameworks to ensure robust risk management and full compliance by 31 May 2026.
  • Key Changes:
  • Shift in focus from initial mapping and testing to "last mile" vulnerability assessment and remediation.
  • Adoption of a "resilience-first" and "resilience by design" mindset in ICT and cyber strategies.
  • Enhanced integration of operational resilience into Third-Party Risk Management Frameworks (TPRMF).
  • Refinement of Business Continuity Planning (BCP) and incident management to shrink recovery time objectives (RTOs) under extreme disruption scenarios.
  • Key Dates / Deadlines: 31 May 2026 (Deadline for securing full operational resilience).
  • Applicability / Impact scope: All Authorized Institutions (AIs).
  • Recommended management actions:
  • Perform a gap analysis comparing current frameworks against the "good practices" highlighted in the Annex.
  • Evaluate residual risks and vulnerabilities identified in prior testing/mapping exercises.
  • Update ICT, cyber, and third-party risk policies to reflect "resilience by design" principles.
  • Enhance BCP and incident management programs to meet tighter tolerance levels for extreme disruptions.
  • Engage internal stakeholders to finalize "last mile" improvements before the 31 May 2026 deadline.
Detailed Summary
  1. Document overview
    This circular provides guidance on operational resilience, building upon the requirements of SPM module OR-2. It aims to assist AIs in identifying and mitigating residual vulnerabilities through industry-tested good practices.
  1. Main requirements
    AIs are expected to align their frameworks with the following four pillars:
  • ICT Risk Management: Eliminate single points of failure, enhance asset recovery, and adopt "resilience by design."
  • Cyber Security: Strengthen the full lifecycle of cyber risk management through individual capability uplift and ecosystem collaboration.
  • Third-Party Dependency: Integrate resilience into the TPRMF, covering governance, contracts, risk monitoring, and exit strategies.
  • BCP & Incident Management: Optimize recovery timelines to ensure the institution remains within established disruption tolerances during extreme events.
  1. Key changes
    The regulatory focus has evolved from foundational framework implementation to the "last mile" of operational stability—specifically addressing the outcomes of previous simulations and testing to eliminate identified residual vulnerabilities.
  1. Important dates & transition
  • 31 May 2026: Final deadline for AIs to secure and demonstrate full operational resilience.
  • Post-May 2026: The HKMA will shift supervisory focus toward long-term sustenance and continuous improvement of resilience postures.
  1. Impact and risks
  • Operational: Potential requirement to redesign ICT architecture to remove single points of failure.
  • Compliance: AIs failing to address residual risks by the deadline may face heightened supervisory scrutiny.
  • Third-Party: Existing vendor contracts and monitoring frameworks may require renegotiation or adjustment to meet new resilience standards.
  1. Compliance action checklist
  • Review internal assessment results against the four pillars mentioned above.
  • Conduct a stress test or simulation specifically targeting identified "residual vulnerabilities."
  • Update vendor exit strategies and contractual resilience clauses.
  • Prepare documentation for HKMA supervisory review to demonstrate progress ahead of the May 2026 deadline.
  1. Appendices/attachments summary
  • Annex (Good Industry Practices): Provides technical details on implementing the four pillars (ICT, Cyber, Third-Party, and BCP). It serves as a practical blueprint for AIs to refine their risk management frameworks and ensure operational continuity during extreme stress.
中文摘要 (1633 chars)
快速切換摘要區塊
管理層摘要
  • 目的/背景： HKMA 總結近期監管觀察及業界交流（如 WISE 2025），旨在協助認可機構（AIs）在落實 SPM OR-2 營運韌性架構的最後階段，針對潛在風險進行優化，確保如期達到營運韌性要求。
  • 一句話結論： 機構須審視並採納 HKMA 提供的四項核心風險管理良好慣例，於 2026 年 5 月 31 日前完成並鞏固其營運韌性架構。
  • 關鍵變更：
  1. 從單純的「流程映射與情境測試」轉向「最後一哩路」的風險強化。
  2. 強調技術與營運的深度整合，導入「Resilience-by-Design」思維。
  3. 將營運韌性考慮因素全面融入第三方風險管理架構（TPRMF）。
  4. 強化恢復時效（Recovery Timelines）以應對更極端的中斷事件。
  • 重要日期 / 截止日： 2026 年 5 月 31 日（全面落實營運韌性要求的最後期限）。
  • 適用對象 / 影響範圍： 全體認可機構（AIs）。
  • 管理層建議行動：
  1. 對照附件中的良好慣例，立即進行差距分析（Gap Analysis）。
  2. 審查現有 ICT 環境，消除單點故障，提升核心資產的韌性。
  3. 優化第三方合約與風險監控，特別是針對關鍵外判服務的退場機制。
  4. 調整業務持續計畫（BCP）與測試程序，確保在極端中斷下仍符合預設的容忍限度。
  5. 確保 5 月底前完成內部自評與相應風險管理強化。
詳細摘要

1) 文檔概述
本函件由 HKMA 發出，旨在分享提升營運韌性的實務操作建議。這並非全新法規，而是基於 SPM OR-2 模組的補充指引，要求機構在 2026 年 5 月 31 日的合規截止日前，識別並處理餘留的漏洞。

2) 主要要求
HKMA 要求機構在四個關鍵範疇進行風險升級：

  • ICT 風險管理： 導入「韌性優先」思維，消除技術環境中的單點故障，提升關鍵資產的恢復力。
  • 網絡安全： 在整個生命週期中強化風險管理能力，並鼓勵跨生態系統合作。
  • 第三方依賴管理： 將營運韌性納入第三方風險框架（TPRMF），涵蓋治理、合約、風險監控及退場管理。
  • BCP 及事故管理： 優化測試程序，縮短復原時間，確保在極端干擾下仍能維持在可接受的中斷容忍度內。

3) 關鍵變更
從早期側重於「測試與映射」（Mapping & Testing）的執行，轉向對「測試結果的評估與落實」，要求機構不僅要證明系統能運作，還要確保具備應對極端情境的防禦邊際。

4) 重要日期與過渡安排

  • 實施截止日： 2026 年 5 月 31 日。
  • 過渡安排： 截止日前 HKMA 將持續提供監督支援；之後監管重點將轉為「持續提升與維持」韌性水平。

5) 對機構的影響與風險
機構需重新檢視技術架構與合約條款。若未能妥善整合韌性框架，將面臨關鍵業務中斷、外判服務失靈或監管違規的風險。

6) 合規動作清單（Checklist）

  • [ ] 完成對附件中「良好慣例」的差距分析。
  • [ ] 執行 ICT 關鍵資產的韌性重檢。
  • [ ] 審查並更新第三方合約（特別是退場條款）。
  • [ ] 進行壓力測試，確認復原時間是否符合內部設定的韌性目標。
  • [ ] 確保在 2026 年 5 月 31 日前完成所有強化行動。

7) 附件/附錄摘要

  • Annex (良好慣例內容)： 該附件詳細列舉了 ICT、網絡安全、第三方依賴及 BCP 的具體實踐要求，為機構提供執行細節，是本次合規升級的核心參考依據，內容緊扣營運韌性框架的深化與優化。