HKMA OR-2 focuses on operational resilience for authorized institutions. It asks institutions to identify critical operations, map dependencies, set disruption tolerances, test scenarios, and remediate weaknesses.
Official source
What teams need to do
- Confirm the current OR-2 module version.
- Identify critical operations and disruption impact.
- Map people, processes, systems, data, facilities, third parties, and fourth parties.
- Test severe but plausible scenarios and track remediation.
- Report resilience posture to management.
Evidence to maintain
- Critical operations register and dependency maps.
- Disruption tolerance and scenario test evidence.
- Incident, issue, remediation, and reporting records.
- Provider and technology dependency evidence.
Common gaps
- Critical operations do not include enough third-party depth.
- Scenario tests are not severe enough.
- Remediation is not tracked to closure.
How Halbarad helps
Halbarad helps connect critical operations to providers, fourth parties, incidents, tests, issues, and remediation.
Disclaimer
This guide is for general information only and is not legal advice. Review the official regulation, guidance, and supervisory materials, and consult qualified counsel or compliance advisors for your organization's specific obligations.