GL20 Assessment Services

The Hong Kong Insurance Authority's revised GL20 Guideline imposes stringent new cybersecurity mandates on all insurers. With deadlines fast approaching, demonstrating compliance through a robust Cyber Resilience Assessment Framework (CRAF) and Threat Intelligence-Based Attack Simulation (TIBAS) is not just a regulatory requirement—it's a critical pillar of your operational resilience.
iSystems Security Limited specializes in guiding insurance companies through this complex landscape. We provide end-to-end GL20 assessment services, ensuring you meet IA deadlines, strengthen your security posture, and protect your policyholders' trust.

Our tailored GL20 service package is designed to fulfill all regulatory requirements efficiently and effectively:
Inherent Risk Assessment (IRA): We conduct a thorough evaluation of your digital assets, processes, and third-party dependencies to accurately determine your inherent risk rating (Low, Medium, or High) as mandated by the IA.
Maturity Assessment (MA): Our experts benchmark your current cybersecurity controls against the GL20's required maturity levels. We identify gaps and work with you to build a pragmatic and prioritized remediation plan.
Threat Intelligence-Based Attack Simulation (TIBAS): Going beyond standard penetration testing, our elite team executes real-world, multi-layered attack scenarios tailored to the insurance sector. We provide clear, actionable reports on vulnerabilities and response efficacy, exactly as required by the guideline.
Comprehensive Reporting & Executive Sign-Off Support: We prepare the complete CRAF documentation package, ready for review and sign-off by your Senior Management, ensuring full transparency and accountability for the IA.

GL20 Expertise: Our consultants are deeply versed in the intricacies of the GL20 guideline, its revisions, and the IA's expectations.
IA-Readiness: We ensure your submissions are complete, accurate, and submitted on time, mitigating the risk of regulatory penalties.
Proven Methodology: We leverage industry-best frameworks and a structured project approach to deliver assessments with minimal disruption to your operations.
Beyond Compliance: While our goal is your compliance, our value is in truly enhancing your cybersecurity defenses against evolving threats.