27% of HKMA SPM you already have
PCI PIN Security already covers about 27% of HKMA SPM, leaving
8 of 11 controls as genuinely new work.
Already covered 0
Likely covered 3
New work 8
No control in PCI PIN Security
maps directly to one in HKMA SPM. Everything counted as covered is covered because both
map to the same third standard, which is what a crosswalk is, but it is an inference rather
than a lookup.
What is genuinely new work
Nothing in PCI PIN Security reaches these. This is the list to scope.
HKMA-SPM-AML-Ordinance-SectoralHKMA SPM AML/CFT (AMLO Guidelines), Banking Ordinance Integration, Sectoral Coordination
HKMA-SPM-CR-MR-IR-LM-CA-RiskHKMA SPM Credit Risk (CR), Market Risk (MR), Interest Rate Risk (IR), Liquidity (LM), Capital Adequacy (CA)
HKMA-SPM-Crosswalk-Basel-FATF-FSB-SectoralHKMA SPM Crosswalk to Basel III, FATF, FSB Operational Resilience, IOSCO and Sectoral Frameworks
HKMA-SPM-Implementation-AI-Compliance-SupervisoryDialogueHKMA SPM Implementation Roadmap, AI Compliance Roles, Supervisory Dialogue and Sectoral Engagement
HKMA-SPM-International-Coordination-2024-2025-PipelineHKMA SPM International Coordination (BCBS, IOSCO, FSB) and 2024-2025 Pipeline (Climate, AI, DORA, ESG)
HKMA-SPM-Module-Lifecycle-Versioning-ConsultationHKMA SPM Module Lifecycle, Versioning, Consultation Process and Sectoral Updates
HKMA-SPM-Status-Industry-Adoption-FutureHKMA SPM Status, Industry Adoption, Hong Kong International Financial Centre Positioning and Future
HKMA-SPM-Umbrella-60Modules-StructureHKMA SPM Umbrella Structure, ~60 Modules Organised by Topic, Module Numbering and Versioning
Show the 3 you already have
HKMA-SPM-CG-IC-AC-Governance-Control-AuditHKMA SPM Corporate Governance (CG-1/2/3/5/6), Internal Control (IC-1/5), Auditing (AC-G)
HKMA-SPM-OR-RR-SA-OperationalResilienceHKMA SPM Operational Risk (OR-1), Operational Resilience (OR-2), Recovery Planning (RR-1), Outsourcing (SA-2)
HKMA-SPM-TM-Technology-TM-G-1-CRAF-CoordHKMA SPM Technology Management Modules (TM-G-1 to TM-G-4, TM-E-1) + Coordination with C-RAF
How this is calculated
Already covered means a mapping runs from a control in PCI PIN Security to that control. Likely
covered means no direct mapping exists but both frameworks map to the same control in a third
standard. New work means neither. We keep those separate rather than adding them into one
friendlier number, because blending them would present a two-hop inference as a verified
fact.
Coverage is not symmetric.
Run it the other way and you will get a
different number; both are correct.
From 332,959 cross-framework control
mappings across 723 frameworks, 531 of them verified against
their source documents. It does not tell you that you are compliant: a mapped control means
the two standards ask for the same thing, not that you have done it.
Try another pair ยท
Today's edition