Here is the honest situation. The HKMA Supervisory Policy Manual module TM-G-1 sets general principles for technology risk management in authorized institutions. It spans board and senior oversight, a technology risk management framework, information security and access, system development and change, IT operations and data centres, cyber security and monitoring, incident response and HKMA reporting, third-party and outsourcing risk, business continuity, and protection of digital banking. An institution with generic IT controls but no TM-G-1-aligned framework is exactly where organizations fall short in supervision.
This Kit removes the guesswork. It is the HKMA TM-G-1 technology risk principles written as adopt-ready controls you personalize in a weekend, with the evidence the HKMA examines.
What you get, the moment you buy
Grounded in the HKMA TM-G-1 technology risk principles. Editable Word and Excel files.
What one control looks like
This is the opening control, where the program begins. All 18 are built to this depth.
Why this is not another template pack
- The evidence is the point. A requirement you cannot evidence is a gap waiting to be found. This tells you what the HKMA examines and where organizations fall short, for every requirement.
- The specifics built in. The principle's distinctive requirements are written into the controls, not left generic.
- Built on a mapped compliance corpus, not one person's opinion, from a graph of thousands of controls across standards.
- It compounds. This work shares its shape with related security and safety frameworks, so it feeds your wider program.
Who buys this
Authorized institutions supervised by the HKMA and their technology, cyber and risk teams. Whether it is a first alignment or an examination-readiness pass, you save weeks and walk in with your governance, security, operations, cyber-resilience and continuity controls structured.
Common questions
Is it really editable? Yes. Word and Excel files you own and adapt. No portal, no subscription.
Are the principles mandatory? They set the HKMA's supervisory expectations, and institutions are examined against them. This Kit operationalises them.
Does it cover incident reporting to the HKMA? Yes. Incident response and prompt reporting of significant incidents to the HKMA are built as controls.
What if it is not for me? A 30-day money-back guarantee.
Instant digital download · 30-day money-back guarantee · The Art of Service Pty Ltd, GPO Box 2673, Brisbane QLD 4001 · support@theartofservice.com