CRAF for Insurers

What is CRAF ?

CRAF is a structured assessment tool designed for authorised insurers to assess their inherent risk and maturity in cyber defence. The CRAF provides a comprehensive set of risk metrics, control principles and methodologies to guide organizations in identifying vulnerabilities and implementing effective cyber security measures. By utilizing both qualitative and quantitative assessment criteria, CRAF gives insurers insight into the state of their cyber defenses, ensuring that they are able to proactively manage risk and protect their critical assets from evolving cyber threats.

What are the benefits of CRAF?

CRAF offers numerous benefits to authorized insurers seeking to strengthen their cybersecurity posture:

• System Risk Assessment: The CRAF provides a structured approach to identifying and assessing inherent cyber risks, enabling organizations to effectively prioritize their security efforts.
• Regulatory Compliance: The framework facilitates compliance with regulatory requirements, helping insurers avoid potential penalties and maintain their operational integrity.
• Practical insights: CRAF provides customized recommendations that enable organizations to implement effective cybersecurity controls and improve their overall resilience.
• Enhanced Reputation: By adopting CRAF, insurers can build trust with their customers and enhance their reputation in the marketplace.
• Business Continuity: Ultimately, CRAF will result in a more secure operating environment, ensuring business continuity in the face of evolving cyber threats.

Who is CRAF for?

CRAF is suitable for authorized insurers operating in or from Hong Kong, including those involved in various types of insurance businesses. This framework is particularly beneficial for organizations that are looking to enhance their cyber resilience and comply with regulatory requirements set by the Insurance Authority (IA). CRAF is designed for both large insurance firms and smaller entities, providing a flexible approach to assessment that caters to the specific needs and complexities of each organization. Additionally, it serves as a valuable resource for risk management and cybersecurity teams, helping them make informed decisions to strengthen their overall cyber risk management strategies.

What documentation is required for CRAF?

Authorized insurers are required to submit their assessment results to the Insurance Authority (IA) of Hong Kong within a specified period of time: 12 months for insurers with high inherent risk ratings and 18 months for insurers with low or medium risk ratings, starting from the effective date of the CRAF. After the initial submission, the assessment needs to be submitted every three years. The submission should include:

1. Inherent Risk Assessment: Provide ratings and associated supporting documentation using the prescribed template;
2. Cybersecurity maturity assessment: maturity level for each control principle and a detailed improvement plan for identified gaps, including clear action points and target completion dates;
3. Medium/High Risk Insurer: gaps identified from Threat Intelligence Based Attack Simulation (TIBAS) exercises, including review findings and risk ratings;
4. Other information: Any other relevant information requested by the IA.

All submitted results, including completed templates, must be reviewed and signed off by the CEO or Senior Executive, as well as the assessors and validators involved in the assessment.

Related Services by DQS

DQS HK provides Cyber Resiliance Assessment service for insurers in accordance with the CRAF, including one or all of the following:

• Inherent Risk Assessment,
• Cybersecurity Maturity Assessment, and
• Threat Intelligence Based Attack Simulation (TIBAS).