M4 — Path
Where to intervene first.
Ranked by RAG, buffer days, stale controls and unowned dependencies. Named dependencies. Named owners. No status-report abstraction.
Off track
0
At risk
1
Controls stale
10
Unowned controls
0
| Status | Regulation | Deadline | Buffer | Controls | Stale | Unowned | Score |
|---|---|---|---|---|---|---|---|
| At risk | HKMA Cyber Resilience Assessment Framework HKHKMA · 6 stale | 15 Dec 2026 | 18d | 7 | 6 | — | 60 |
| On track | SFC Virtual Asset Licensing Regime HKSFC · 4 stale | 28 Feb 2027 | 50d | 5 | 4 | — | 12 |
Score combines RAG (0–100), buffer penalty, stale controls (×3) and unowned dependencies (×5). Higher scores need attention first.