Management Summary
- Purpose / Background: The HKMA, SFC, IA, and MPFA (the Authorities) have completed the first cross-sectoral "Cyber Mapping" exercise to identify systemic cyber risk concentrations and interdependencies across Hong Kong's financial ecosystem, as recommended by the IMF Financial Sector Assessment Program (FSAP).
- One-line conclusion: The exercise confirms no new "unknown" systemic risks but highlights high interconnectedness with third-party providers; the exercise will become a recurring, long-term supervisory tool.
- Key Changes:
- Established a cross-sectoral "Cyber Map" dashboard to visualize technology and business connections.
- Identified specific focus areas for supervisory attention, particularly regarding recurring specialist vendors in network appliances, security monitoring, and privileged access management.
- Transitioned Cyber Mapping from a pilot initiative to a recurring, permanent supervisory fixture.
- Planned future exploration to provide FIs with access to their own relevant data within the map to aid internal risk management.
- Increased emphasis on third-party risk supervision based on shared adoption patterns of ICT solutions.
- Key Dates / Deadlines:
- First production run completed: March 2026.
- Next iteration expected: 2027/2028 (details to follow).
- Applicability / Impact scope: All Authorized Institutions, SVF licensees, Hong Kong Interbank Clearing Limited, retail payment systems, licensed corporations, authorized insurers, and MPF trustees.
- Recommended management actions:
- Review internal third-party risk management frameworks to align with potential increased supervisory scrutiny on ICT service providers.
- Monitor upcoming circulars regarding the 2027/2028 exercise cycle to ensure data readiness.
- Engage in bilateral feedback sessions if notified by the Authorities regarding specific insights from the first production run.
- Evaluate current dependency on "recurring specialist vendors" in cybersecurity/network infrastructure as identified in the mapping trends.
Detailed Summary
- Document overview: A joint circular from the four major financial regulators detailing the findings of the first cross-sectoral Cyber Mapping exercise. The purpose is to map business/technology interdependencies to proactively manage systemic risk and "single point of failure" risks stemming from shared third-party service providers.
- Main requirements:
- Data Compliance: FIs are required to provide data as requested by the Authorities to maintain the Cyber Map, adhering to principles of data necessity and security.
- Supervisory Cooperation: Participation in future exercises is expected as the initiative becomes a recurring fixture.
- Risk Management: FIs must account for the Authorities’ heightened focus on ICT arrangements, specifically in network infrastructure, security event monitoring, and privileged access management.
- Key changes:
- Implementation of a dynamic dashboard-based mapping tool for systemic monitoring.
- Shift from sector-specific cyber supervision to a "borderless" ecosystem-wide approach.
- Important dates & transition:
- March 2026: Successful completion of the initial production run.
- 2027/2028: Targeted commencement of the next full exercise.
- Impact and risks:
- Operational: Increased scrutiny on dependencies regarding third-party ICT providers.
- Compliance: Potential for thematic reviews, drills, and additional contingency planning requirements following the mapping outputs.
- Data: Continued requirement to provide accurate, up-to-date dependency information to regulators.
- Compliance action checklist:
- Review current ICT vendor dependency list against the "recurring specialist vendors" categories mentioned (network appliances, security monitoring, privileged access management).
- Prepare internal data governance teams for potential future data calls for the 2027/2028 cycle.
- Await and review bilateral supervisory feedback if designated as a participant in the first production run.
- Appendices/attachments summary:
- Technical Note (Annex): Provides the technical details and data collection methodology used to build the Cyber Map, serving as the foundation for the Authorities' analytical dashboard.