Framework overlap

Does PCI SSF cover HKMA SPM?

You hold PCI SSF and have been told to do HKMA SPM. Here is how much overlaps, control by control.

27% of HKMA SPM you already have

PCI SSF already covers about 27% of HKMA SPM, leaving 8 of 11 controls as genuinely new work.

Already covered 0 Likely covered 3 New work 8

No control in PCI SSF maps directly to one in HKMA SPM. Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in PCI SSF reaches these. This is the list to scope.

HKMA-SPM-AML-Ordinance-Sectoral
HKMA SPM AML/CFT (AMLO Guidelines), Banking Ordinance Integration, Sectoral Coordination
HKMA-SPM-CR-MR-IR-LM-CA-Risk
HKMA SPM Credit Risk (CR), Market Risk (MR), Interest Rate Risk (IR), Liquidity (LM), Capital Adequacy (CA)
HKMA-SPM-Crosswalk-Basel-FATF-FSB-Sectoral
HKMA SPM Crosswalk to Basel III, FATF, FSB Operational Resilience, IOSCO and Sectoral Frameworks
HKMA-SPM-Implementation-AI-Compliance-SupervisoryDialogue
HKMA SPM Implementation Roadmap, AI Compliance Roles, Supervisory Dialogue and Sectoral Engagement
HKMA-SPM-International-Coordination-2024-2025-Pipeline
HKMA SPM International Coordination (BCBS, IOSCO, FSB) and 2024-2025 Pipeline (Climate, AI, DORA, ESG)
HKMA-SPM-Module-Lifecycle-Versioning-Consultation
HKMA SPM Module Lifecycle, Versioning, Consultation Process and Sectoral Updates
HKMA-SPM-Status-Industry-Adoption-Future
HKMA SPM Status, Industry Adoption, Hong Kong International Financial Centre Positioning and Future
HKMA-SPM-Umbrella-60Modules-Structure
HKMA SPM Umbrella Structure, ~60 Modules Organised by Topic, Module Numbering and Versioning
Show the 3 you already have
HKMA-SPM-CG-IC-AC-Governance-Control-Audit
HKMA SPM Corporate Governance (CG-1/2/3/5/6), Internal Control (IC-1/5), Auditing (AC-G)
HKMA-SPM-OR-RR-SA-OperationalResilience
HKMA SPM Operational Risk (OR-1), Operational Resilience (OR-2), Recovery Planning (RR-1), Outsourcing (SA-2)
HKMA-SPM-TM-Technology-TM-G-1-CRAF-Coord
HKMA SPM Technology Management Modules (TM-G-1 to TM-G-4, TM-E-1) + Coordination with C-RAF

How this is calculated

Already covered means a mapping runs from a control in PCI SSF to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition