Introduction to Hong Kong IA’s GL20

The Hong Kong Insurance Authority (IA) has issued the Guideline on Cybersecurity, known as GL20, to set the minimum standard for cybersecurity that authorized insurers are expected to have in place. This guideline provides general guiding principles that the IA uses to assess the effectiveness of an insurer’s cybersecurity framework. The primary goal of GL20 is to ensure that insurers implement resilient cybersecurity measures to protect their business data and the personal data of policyholders, thereby ensuring the continuity of business operations

Overview of the Cyber Resilience Assessment Framework (CRAF)

GL20 introduces the Cyber Resilience Assessment Framework (CRAF), which assists insurers in assessing their inherent risks and the maturity level of their cybersecurity measures against a set of prescribed control principles. The CRAF is a structured assessment framework that aims to help insurers evaluate whether their cybersecurity measures are adequate and effective

Key Components of GL20

Cybersecurity Strategy and Framework: Insurers are required to establish a comprehensive cybersecurity strategy and framework that aligns with their business objectives and risk appetite. This includes defining roles and responsibilities, setting cybersecurity objectives, and implementing policies and procedures to manage cyber risks
Governance: Effective governance is crucial for ensuring that cybersecurity measures are properly implemented and maintained. Insurers must establish a governance structure that includes oversight by senior management and the board of directors. This structure should ensure accountability and provide clear lines of communication for cybersecurity matters
Risk Identification, Assessment, and Control: Insurers must identify, assess, and control cyber risks through a risk management process. This involves conducting regular risk assessments, identifying potential threats and vulnerabilities, and implementing controls to mitigate identified risks
Continuous Monitoring: Continuous monitoring of cybersecurity measures is essential for detecting and responding to cyber threats in a timely manner. Insurers should implement monitoring tools and processes to track cybersecurity events, analyse security incidents, and take corrective actions as needed
Response and Recovery: Insurers must have a robust incident response plan in place to address cybersecurity incidents. This plan should outline procedures for detecting, containing, eradicating, and recovering from security incidents. Additionally, insurers should conduct regular drills and exercises to test the effectiveness of their incident response plan
Information Sharing and Training: Information sharing and training are critical components of a strong cybersecurity framework. Insurers should participate in information-sharing initiatives to stay informed about emerging threats and best practices. They should also provide regular cybersecurity training to employees to enhance their awareness and skills

Implementation of GL20

To comply with GL20, insurers must implement the prescribed cybersecurity measures and continuously assess their effectiveness. The IA will use the CRAF to evaluate insurers’ cybersecurity frameworks and ensure that they meet the minimum standards set by the guideline. Insurers are encouraged to regularly review and update their cybersecurity measures to address evolving cyber threats and maintain compliance with GL20

Conclusion

Hong Kong IA’s GL20 is a comprehensive guideline that sets the minimum standard for cybersecurity in the insurance industry. By implementing the measures outlined in GL20, insurers can enhance their cyber resilience, protect their business and policyholders’ data, and ensure the continuity of their operations. The Cyber Resilience Assessment Framework (CRAF) provides a structured approach for assessing and improving cybersecurity measures, helping insurers stay ahead of emerging threats and maintain compliance with regulatory requirement