Skip to content
#1 Trusted Compliance Solution
AI-Powered GL20 Compliance:
Faster IRA, MA & TIBAS Submissions
The Hong Kong Insurance Authority’s new Guideline on Cybersecurity (GL20), introduces a systematic and risk-based methodology that all authorized insurers must adopt. The methodology consists of three key assessments: Inherent Risk Assessment (IRA), Maturity Assessment (MA), and Threat Intelligence-Based Attack Simulation (TIBAS). Each has detailed documentation and submission requirements—adding huge operational and reporting complexity for compliance teams.
GL20
Automated Documentation, Control Validation, and Cyber Risk Mitigation in One Platform
ComplyNexus offers an AI-powered audit and compliance management solution that assesses and categorizes inherent risks across systems, operations, and third-party dependencies, maps current controls against the 90+ baseline, 78 intermediate, and 54 advanced control principles, generates remediation roadmaps aligned to the insurer’s risk tier (low, medium, or high) and automates report creation for IRA, MA, and TIBAS, formatted to IA requirements.
Solution
Reduce your privacy compliance burden by less than half
Conventional privacy compliance processes are time-consuming and costly and require significant effort. ComplyNexus streamlines as much as 80% of the process, enabling you to get certified faster and more easily for ISO 27701. Our workflows are AI-enabled and bring governance on privacy under one roof so you can be compliance-ready without hindering business.
Our intelligent compliance framework seamlessly aligns with GDPR, CCPA, and other global privacy standards, guaranteeing continuous compliance without redundant efforts.
Frameworks
Automate, Secure & Scale GL20 Compliance
Inherent Risk Assessment (IRA)
Identify your inherent risk level using 40 risk indicators across five categories, including business operations, external threats, and data sensitivity. ComplyNexus applies IA’s scoring formula, automates classification, and generates the required risk-tier documentation and remediation roadmap.
Maturity Assessment (MA)
Assess the maturity of your cybersecurity controls across seven domains, matched to your inherent risk level. ComplyNexus performs gap analysis, tracks control effectiveness, and compiles sampling-based testing records across 6-12 month cycles.
Cross-Border Regulatory Alignment
Simulate 3–5 real-world cyberattacks (based on risk level) using industry-relevant threat intelligence. ComplyNexus supports red team coordination, captures response metrics, and documents findings for submission within the 9-month window.
Our Solution
AI-Powered Control
Validation and Continuous GL20 Readiness
Dynamic Gap Analysis & Maturity Alignment
ComplyNexus continuously evaluates your cybersecurity controls against GL20’s full set of 222 principles. Using real-time data, it identifies control gaps, prioritizes them by risk impact, and auto-generates tailored remediation roadmaps—mapped to your expected maturity level (baseline, intermediate, or advanced).
Cross-Framework Control Mapping & Harmonization
Seamlessly align existing frameworks like ISO 27001, NIST CSF, and internal policies with GL20 requirements. ComplyNexus eliminates redundancy by intelligently mapping overlapping controls—saving time and effort while ensuring full compliance coverage.
Smart Sampling Strategy & Validator-Ready Testing
Build risk-based sampling strategies for both initial and recurring assessments. ComplyNexus provides built-in templates and guidance for MA testing windows (6 or 12 months), ensures representative control testing, and automatically compiles evidence for validator review.
Automated Regulator-Ready Documentation
Generate fully formatted submission reports—including IRA classification, MA maturity summaries, remediation plans, and TIBAS evaluation findings. All reports are exportable in GL20-compliant formats, with version control and traceability baked in.
Automation
Automated Regulator-Ready Documentation
Generate fully formatted submission reports—including IRA classification, MA maturity summaries, remediation plans, and TIBAS evaluation findings. All reports are exportable in GL20-compliant formats, with version control and traceability baked in.
Pricing
Choose the perfect plan for your needs
Try any plan with a Free 5-day Trial before you commit.
Free 5-day trial
NexusEssentials
$599 USD/Month
Paid monthly, One year commitment
Ideal for essential data privacy and information security compliance management
- Up to 20 users
- GDPR Compliance
- Local/regional information security & data privacy frameworks
Free 5-day trial
NexusCertify
$999 USD/Month
Paid monthly, One year commitment
Ideal for SMEs/MSMEs
- Up to 50 users
- ISO 27001
- ISO 9001
Essential Features
- One compliance framework
- Easy upload & configuration
- Nexi AI Document Finder
- Audit Manager & Control Library
- Risk & Task Management
- Document Repository
- Analytics & Dashboards
- Onboarding Guidelines
- In-app & Email Support
Standard Features
- Nexi AI Audit Report Generator
- Onboarding & Training Support
- Email Assistance During Trial
Get your
free demo today
No hassle. No risk. Just smarter compliance.
Insights
Smart reads for smarter decisions
Stay ahead with expert insights, industry trends, and practical tips to help you make smarter decisions.
FAQs
Frequently Asked Questions
1. What is GL20?
GL20 is the Hong Kong Insurance Authority’s Cybersecurity Guideline. It requires insurers to perform Inherent Risk Assessment (IRA), Maturity Assessment (MA), and Threat Intelligence-Based Attack Simulation (TIBAS), with detailed documentation and submission to the IA.
2. Who needs to comply with GL20?
- Operate in highly regulated industries (finance, healthcare, tech, etc.).
- Need a structured approach to risk management and security.
- Want to streamline audits and regulatory reporting.
- Handle sensitive data and require strong governance policies.
3. Can GL20 be integrated with other compliance frameworks?
- ISO standards (ISO 27001, ISO 27701, ISO 42001, etc.)
- GDPR & HIPAA for data privacy compliance.
- ESG frameworks for sustainability and governance.
4. What happens if a company is non-compliant with GL20?
- Regulatory fines for non-compliance.
- Operational risks due to unmanaged security threats.
- Legal liabilities from improper governance practices.
5. How do I get started with GL20 compliance using ComplyNexus?
- Request a free demo to see our GL20 compliance solutions in action.
- Start a free 5-day trial and simplify your compliance process today!
ComplyNexus empowers you to build a verified single source of truth for compliance, streamlining both internal and external audits effortlessly.