CRAF in GL20 for Insurers

The initial assessment involves evaluating your organization's inherent risk level using the Inherent Risk Assessment Matrix. Depending on the rating:

• Low Risk: Proceed to Cybersecurity Maturity Assessment.
• Medium/High Risk: Re-assessment by assessors with required qualifications. Proceed to Cybersecurity Maturity Assessment after re-perform the assessment.

Following the inherent risk assessment, the organization's cybersecurity maturity will be evaluated based on the Cybersecurity Maturity Assessment Matrix. This phase ensures that the organization has the necessary controls and processes in place to mitigate cyber risks effectively.

For an insurer with a medium or high inherent risk rating, the CMA must be conducted by an Assessor with the required qualifications.
If the assessment is performed by an Internal Staff as the Assessor, the results of the CMA must also be independently validated by a Validator with required qualifications.

As an item in the Cybersecurity Maturity Assessment, an independent Threat Intelligence and Cyber Attack Simulation Testing shall be conducted by experts who have the necessary skills and expertise, as well as industry-recognised qualifications across red team and threat intelligence.

It is different and on top of performing security vulnerability and penetration testing of a single system or an isolated environment. A minimum of 3 end-to-end cyber attack scenarios shall be covered in the simulation, in a production environment to simulate real-life attack scenarios.

• Regular Assessments: Conducted at least every three years.
• Ad Hoc Assessments: Recommended upon major changes in business or technologies. An insurer should also , conduct assessment on an ad hoc basis when the IA considers it appropriate.

Related assessments should be conducted by competent professionals with the necessary qualifications and experience in cybersecurity and risk management. All results are validated independently to maintain the highest standards of integrity and accuracy.

Insurers must submit assessment results to the Insurance Authority (IA) within specified timeframes based on their inherent risk ratings. This includes:

• Detailed reports on inherent risk assessment and cybersecurity maturity assessment, including the identified gaps of control principles from TIBAS Testing for insurers with medium or high inherent risk rating.
• Identification of control gaps and an improvement plan.
• Regular updates every three years post-initial submission.

A non-compliance, without mitigation measure, may reflect on the IA’s view of the continued fitness and properness of the directors or controllers of authorized insurers to which this Guideline applies.