{"text_format":"1","workbook":"xlsx","n_sheets":10,"sheets":["Basic Information","1. Management Oversight","2. User Access Controls","3. Network Infrastructure","4. Application Controls ","5. System Implementation","6. Backup and Contingency","7. Monitoring","8. Vendor Management ","9. Application Vulnerability"],"not_rendered":{"charts":0,"images":313,"macros":1,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Basic Information","index":0,"n_rows":37,"n_cols":2,"rows_kept":37,"cut":false,"hidden":false,"merged":[]}
[null,"0 Basic Information"]
[]
["1.","Name of the firm:"]
[]
[]
[]
["2.","Please select the Internet trading platform(s) provided to clients: "]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["3.","Please state the percentage of turnover derived from Internet trading system(s) over the total trading turnover of the firm for the last 12 months (in approximate value):"]
[]
[]
[]
["4.","How many active users (in approximate number) are there in all Internet trading system(s) of your firm?"]
[]
[]
[]
["5.","Has/Have any major incident(s) (e.g., unavailability of Internet trading services during trading hours, hacking activities, system errors resulting in erroneous trades, etc.) occurred over the past 12 months?"]
[]
[]
[]
[]
[]
[]
[]
["6.","Please sign off the self-assessment checklist by relevant Responsible Officer:"]

{"sheet":"1. Management Oversight","index":1,"n_rows":87,"n_cols":2,"rows_kept":87,"cut":false,"hidden":false,"merged":[]}
[null,"1 Management Oversight"]
[]
["1.","How is senior management involved in managing the IT risks, controls, and security related matters of Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["2.","Who is responsible for overseeing the day-to-day IT risks, controls, and security related matters of Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["3.","Please state which of the following elements are covered in the IT security policies and procedures:"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["4.","Is there any process to periodically review and assess whether the firm is in compliance with all relevant rules and regulatory requirements concerning electronic trading?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["5.","Has/Have there been any independent assessment(s) (e.g., independent IT audit and/or security penetration testing) conducted on the Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["6.","Does your firm provide periodic IT security awareness training to employees?"]

{"sheet":"2. User Access Controls","index":2,"n_rows":64,"n_cols":2,"rows_kept":64,"cut":false,"hidden":false,"merged":[]}
[null,"2 User Acess Controls"]
[]
["1.","Are there procedures in place for managing logical access rights (e.g., authorisation, suspension, revocation and re-certification) and reviewing the validity and appropriateness of user accounts and access rights in the Internet trading system(s) on a regular basis?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["2.","Are there procedures in place for managing logical access rights (e.g., authorisation, suspension, revocation and re-certification) and reviewing the validity and appropriateness of privileged user accounts and access rights (e.g., administrative account, troubleshooting account, etc.) in the Internet trading system(s) on a regular basis?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["3.","Are system development personnel (including vendors and system developers) granted with access to the production environment(s) of the Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["4.","Is there a mechanism in place to record and monitor the system development personnel (including vendors and system developers) activities in production environment(s) of the Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["5.","Is there a mechanism in place to record and monitor the activities of user accounts and privileged user accounts in the Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["6.","Is there a mechanism in place to record and monitor the unusual client activities (e.g. unreasonable change of IP addresses in a short period of time, account takeover, etc.) in the Internet trading system(s)?"]

{"sheet":"3. Network Infrastructure","index":3,"n_rows":62,"n_cols":2,"rows_kept":62,"cut":false,"hidden":false,"merged":[]}
[null,"3 Network Infrastructure Architecture Design"]
[]
["1.","Does your firm maintain a network diagram reflecting the detailed topology (e.g., network segregation between head office and branches, resilience structure of infrastructure components) of the existing network?"]
[]
[]
[]
[]
[]
["2.","Is there a Demilitarised Zone (\"DMZ\") in the network infrastructure where only the components facing Internet are situated?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["3.","Is there an intrusion detection system (\"IDS\")/intrusion prevention system (\"IPS\") or equivalent capability in place for your Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
["4.","Does your firm have tools and procedures in place to detect and/or prevent distributed denial-of-service (\"DDoS\") attacks?"]
[]
[]
[]
[]
[]
[]
[]
["5.","Is there a mechanism to monitor network security, availability and connectivity of your Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["6.","Which of the following Internet trading infrastructure component(s) (e.g., servers, databases, firewalls and routers) is/are covered in the infrastructure management policies and/or security configuration baselines?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["7.","Which of the following infrastructure component(s) of the Internet trading system(s) is/are set up in resilient?"]

{"sheet":"4. Application Controls ","index":4,"n_rows":108,"n_cols":2,"rows_kept":108,"cut":false,"hidden":false,"merged":[]}
[null,"4 Application Controls and Processing Integrity"]
[]
["1.","How are your Internet trading clients authenticated to access to view clients' portfolio and trading history?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["2.","Is the initial password of the client's Internet trading account randomly generated by the Internet trading system(s) or equivalent?"]
[]
[]
[]
[]
[]
[]
[]
[]
["3.","How does your firm communicate the initial password of the Internet trading account to client?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["4.","Is/Are your Internet trading system(s) configured to enforce compulsory change of the initial password for the first time login?"]
[]
[]
[]
[]
[]
["5.","Is there a mechanism in place to prevent clients placing incorrect order(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["6.","Is there an authentication mechanism (e.g. providing personal identifiable information) to verify the identity of the client for resetting password and/or changing personal information?"]
[]
[]
[]
[]
[]
["7.","Is account lockout (e.g. account would be locked for 3 invalid password attempts) enforced in the Internet trading system(s)"]
[]
[]
[]
[]
[]
[]
[]
[]
["8.","Are password complexity requirements enforced in the Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["9.","Is session timeout configured in your Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["10.","Is sensitive information (e.g., clients' information, login password, etc.) in the database(s) supporting the Internet trading system(s) encrypted?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["11.","Is Secure Sockets Layer (\"SSL\") implemented in the Internet trading system(s) to maintain the confidentiality and integrity of data transmission?"]
[]
[]
[]
[]
[]
["12.","Is/Are there valid digital certificate(s) issued by Certification Authority (\"CA\") for the Internet trading system(s)?"]

{"sheet":"5. System Implementation","index":5,"n_rows":98,"n_cols":2,"rows_kept":98,"cut":false,"hidden":false,"merged":[]}
[null,"5 System Implementation, Upgrade and Modification"]
[]
["1.","Is there a formal System Development Life Cycle (\"SDLC\") process in place with defined security requirements incorporated, such that the firm's information confidentiality, integrity and availability requirements are addressed during system development and testing for your Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["2.","Are there procedures in place for evaluating the risks, impacts, costs and needs of implementing changes on the Internet trading system(s) and it/their supporting infrastructure?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["3.","Are approvals required and documented for program changes/fixes including normal and emergency changes/fixes?"]
[]
[]
[]
[]
[]
["4.","Are there source code version controls in place for managing source code of the Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["5.","Are tests (e.g., system integration test (\"SIT\"),  user acceptance test (\"UAT\"), regression test, etc.) conducted before implementation of changes?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["6.","Are the results of tests signed off?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["7.","Does your firm have the testing environment(s) set up for testing purpose?"]
[]
[]
[]
[]
[]
["8.","Is there a mechanism to mask clients' personal information (e.g., client's ID, password of the Internet trading account, etc.) for testing purpose?"]
[]
[]
[]
[]
[]
[]
[]
["9.","Has/Have stress/performance test(s) been conducted with sufficient data volume to simulate the anticipated and historical peaks on the Internet trading system(s) and its/their supporting infrastructure before the Internet trading system(s)/change(s) is /are implemented?"]
[]
[]
[]
[]
[]
["10.","Have the results of stress/performance test(s) been followed up to ensure necessary remedial actions have been implemented and reported to senior management?"]

{"sheet":"6. Backup and Contingency","index":6,"n_rows":153,"n_cols":2,"rows_kept":153,"cut":false,"hidden":false,"merged":[]}
[null,"6 Backup and Contingency"]
[]
["1.","How often is backup performed for the Internet trading system(s) (including databases) and its/their supporting infrastructure?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["2.","Please state which of the following of the information, logs and/or configuration files has/have backup(s) performed:"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["3.","Are all backups related to the Internet trading system(s) and its/their supporting infrastructure stored offsite?"]
[]
[]
[]
[]
[]
["4.","Is restoration test of the backups performed?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["5.","Is there a formal business continuity plan(\"BCP\")/disaster recovery plan (\"DRP\") covering the Internet trading system(s)?"]
[]
[]
[]
[]
[]
["6.","Did your firm conduct business impact assessment (\"BIA\") to analyse the impact of different contingency scenarios before establishing a formal business continuity plan(\"BCP\")/disaster recovery plan (\"DRP\")?"]
[]
[]
[]
[]
[]
[]
[]
["7.","Does your firm have a backup site/secondary data centre/disaster recovery site for the Internet trading system(s) to failover the services in the event of significant system failures or incidents adversely impacting the primary site?"]
[]
[]
[]
[]
[]
["8.","Has the Recovery Time Objective (\"RTO\") to recover Internet trading services as supported by vendor(s) (including intra-group support) been verified prior to contracting with the vendor(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["9.","Could the failover of the Internet trading system(s) to the backup site/secondary data centre/disaster recovery site be completed within the Recovery Time Objective (\"RTO\") in the last primary site outage, or during the business continuity or disaster recovery drill?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["10.","How often is the business continuity drill/disaster recovery drill conducted?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["11.","Have the results of business continuity drill/disaster recovery drill been followed up to ensure necessary remedial actions have been implemented and updated to business continuity plan(\"BCP\")/disaster recovery plan (\"DRP\") and reported to senior management?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["12.","Are there incident response and management procedures in place to cater for potential interruptions impacting the Internet trading services?"]
[]
[]
[]
[]
[]
[]
[]
["13.","Please state who will be notified in the escalation, reporting and communication process in the event of major incident (e.g., Internet trading system outage):"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["14.","Is there a mechanism to document incidents with relevant details?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["15.","Is there a mechanism to analyse the root cause of incident and ensure necessary remedial actions have been implemented to prevent the occurrence of the same incident?"]

{"sheet":"7. Monitoring","index":7,"n_rows":40,"n_cols":2,"rows_kept":40,"cut":false,"hidden":false,"merged":[]}
[null,"7 Monitoring"]
[]
["1.","Is there a mechanism to monitor the performance (i.e., service availability, system uptime, system resource utilisation including CPU, memory and disk space) against the predefined system performance thresholds of the Internet trading system(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["2.","Which of the following elements are included in the monitoring mechanism:"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["3.","Is there a formal reporting mechanism to report the performance of the Internet trading system(s) and its/their supporting infrastructure to the senior management?"]

{"sheet":"8. Vendor Management ","index":8,"n_rows":55,"n_cols":2,"rows_kept":55,"cut":false,"hidden":false,"merged":[]}
[null,"8 Vendor Management (All references made to 'vendor' in this section shall include intra-group developers)"]
[]
["1.","Please state the activities that are outsourced to external vendors and/or intra-group company(ies):"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["2.","Are there procedures to evaluate vendor(s)' services and performance during the vendor selection process for Internet trading system(s) and its/their supporting infrastructure?"]
[]
[]
[]
[]
[]
[]
[]
["3.","Is there a mechanism to monitor and review vendor(s)' performance (e.g., service availability, timely technical support, number of incidents)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["4.","Is/Are the Service Level Agreement(s) (\"SLA\") with pre-defined performance threshold(s) included in the contract(s) with external vendor(s) and/or intra-group company(ies) for the Internet trading system(s) and its/their supporting infrastructure?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["5.","Is the contractual power of data ownership (e.g., power and means to promptly remove or destroy data, including client information, stored at the vendor’s system(s) and backup media in the event of contract termination) clearly stated in the outsourcing contract(s) where applicable?"]

{"sheet":"9. Application Vulnerability","index":9,"n_rows":82,"n_cols":2,"rows_kept":82,"cut":false,"hidden":false,"merged":[]}
[null,"9 Application Vulnerability Management and Client Awareness Controls"]
[]
["1.","Was/Were security penetration test(s) conducted on the Internet trading system(s) and its/their supporting infrastructure over the past 12 months or for the latest major development of change(s)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["2.","Please state the type(s) of security penetration test(s) performed on your Internet trading system(s) and its/their supporting infrastructure:"]
[]
[]
[]
[]
[]
[]
[]
["3.","Have the results of security penetration test(s) been followed up to ensure necessary remedial actions have been implemented and reported to senior management?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["4.","Is there a mechanism in place to evaluate and schedule security patch updates to be implemented in the production environment of the Internet trading system(s)? "]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["5.","Are patch updates tested in a testing environment which is comparable with the production environment of the Internet Trading system(s) before migrating to the production environment?"]
[]
[]
[]
[]
[]
["6.","Is there a mechanism to monitor potential fraudulent websites and/or mobile trading applications that can potentially be mistaken as that of your firm?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["7.","Has the discovery of fraudulent websites and/or mobile trading applications been followed up to ensure necessary remedial actions have been implemented and reported to all relevant internal and external stakeholders (e.g., senior management, compliance, clients, regulators, etc.)?"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["8.","Are clients made aware of the risks associated with Internet trading through Terms and Conditions and/or risk disclosure statements during the account opening?"]
[]
[]
[]
[]
[]
["9.","Are security tips (e.g., never reveal user IDs and passwords to others) regarding the use of Internet trading services (through web and/or mobile applications, where applicable) provided to clients?"]