Hong Kong's first dedicated cyber security law, the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), has applied since 1 January 2026 and places statutory duties on designated operators of critical infrastructure, backed by criminal fines of up to HK$5 million. The Ordinance does not apply to every company in a critical sector: it bites only once the Commissioner or a designated authority formally designates an organisation as a critical infrastructure operator (CIO) and names its critical computer systems (CCSs). From that point a fixed clock starts for an office, a security unit, plans, risk assessments, audits and incident reports within 12 or 48 hours. This guide sets out scope, the three categories of obligation, the timeline, enforcement, and what the regime means for the service accounts, vendor access and automated tooling that run critical systems. It is written for security, compliance and technology leaders at Hong Kong operators and their suppliers. It does not cover personal data duties, which are in the Hong Kong PDPO Guide.
Status line (checked 27 October 2026): the Bill passed the Legislative Council on 19 March 2025, was gazetted on 28 March 2025 and commenced on 1 January 2026, when the Office of the Commissioner of Critical Infrastructure (Computer-system Security) issued its Code of Practice. Designations were expected to be made in phases from mid-2026; we could not confirm from an official source which organisations have been designated so far. The authoritative text is Cap. 653 on Hong Kong e-Legislation.
Key takeaways
- Designation is the trigger. Duties apply only to organisations designated as CIOs, and only in respect of the computer systems designated as CCSs, so the first question is whether you have received, or are likely to receive, a designation notice.
- Three categories of duty. Organisational (Hong Kong office, security management unit), preventive (change notification, security management plan, annual risk assessment, two-yearly audit) and incident (drills, emergency response plan, reporting).
- 12 hours for serious incidents. Published legal summaries report that incidents that disrupt or are likely to disrupt a core function must be notified within 12 hours of becoming aware, other incidents within 48 hours, with a written report reported to be due within 14 days.
- The Code of Practice is not law, but directions are. Breaching the Code is not itself an offence, but the Commissioner can issue written directions that refer to it, and ignoring a direction is an offence.
- Suppliers are pulled in by contract. The CIO stays liable when a contractor, cloud provider or managed service runs part of a CCS, so obligations flow down to vendors, including how they hold and use credentials for your systems.
Scope: who and what is covered
The Ordinance protects critical infrastructure (CI) in two categories. Category 1 is infrastructure delivering essential services in eight sectors. Category 2 is other infrastructure whose damage, loss of functionality or data leakage could seriously affect important societal or economic activities. Certain government-run services, such as water supply, drainage and emergency relief, are outside the regime because the government operates them itself.
| Element | What it means | Practical note |
|---|---|---|
| Category 1 sectors | Energy; information technology; banking and financial services; air transport; land transport; maritime transport; healthcare services; telecommunications and broadcasting services | Sector membership alone does not create duties |
| Category 2 CI | Other infrastructure for important societal or economic activities, for example major sports and performance venues and research and development parks | Expect a small number of designations |
| Critical infrastructure operator (CIO) | An organisation designated by the Commissioner or a designated authority as operating a CI | Bound only after designation |
| Critical computer system (CCS) | A computer system accessible by the CIO in or from Hong Kong that is essential to the core function of the CI | Industrial control systems (SCADA, DCS, PLCs) and supporting IT such as network devices, IoT and UPS can qualify |
| Designated authorities | Hong Kong Monetary Authority (banking and financial services) and Communications Authority (telecommunications and broadcasting) | They regulate category 1 and 2 duties for their sectors and may issue sectoral codes |
| Commissioner | Commissioner of Critical Infrastructure (Computer-system Security), heading an office set up under the Security Bureau | Handles incident (category 3) duties for all CIOs |
Territorial reach: the government has said the regime has no extraterritorial effect and targets operators in Hong Kong. However, a CIO must produce information it can access from Hong Kong when requested, even if the data sits on servers outside Hong Kong. Global groups with a Hong Kong CIO subsidiary should check that group-hosted logs, configuration records and audit evidence can be produced quickly.
Third parties: outsourcing does not move the duty. The CIO must take measures so that a CCS operated or supported by a third party still meets the Ordinance, and government statements indicate a CIO can be liable for a provider's acts or omissions.
Key obligations
The obligations fall into three categories. The deadlines below run from the date of designation unless stated otherwise.
| Category | Obligation | Deadline or frequency |
|---|---|---|
| 1 Organisational | Maintain an office in Hong Kong with real business operations (not just a correspondence address) and notify its address and any change | Within 1 month of designation |
| 1 Organisational | Report changes in the operator of the CI | Within 1 month of the change |
| 1 Organisational | Set up a computer-system security management unit, in-house or outsourced, supervised by an employee with adequate knowledge, and notify the supervisor | Within 1 month of designation |
| 2 Preventive | Notify material changes to CCSs, for example platform migrations, major version upgrades and significant code changes | As changes occur |
| 2 Preventive | Submit and implement a computer-system security management plan, with a cross-reference to the Code of Practice | Within 3 months of designation |
| 2 Preventive | Conduct a computer-system security risk assessment and submit the report | First within 12 months, then at least every 12 months; report within 3 months of each period |
| 2 Preventive | Arrange an independent computer-system security audit and submit the report | First within 24 months, then at least every 24 months; report within 3 months of each period |
| 3 Incident | Submit an emergency response plan, endorsed at board level or by a delegated committee or senior management | Within 3 months of designation; review after material CCS changes and at least every 2 years |
| 3 Incident | Participate in security drills organised by the Commissioner | On reasonable written notice, no more than once every 2 years |
| 3 Incident | Notify computer-system security incidents affecting a CCS | Serious: 12 hours; other: 48 hours from awareness |
Incident reporting in practice
- Serious incident: one that has disrupted, is disrupting or is likely to disrupt the core function of the CI. Factors in the Code include downtime, service level impact, the volume of data affected and the likely volume of customer complaints.
- When the clock starts: the Code treats awareness as the point when there is a reasonable degree of certainty that an incident has occurred, not the first unconfirmed alert. Document when that point was reached and why.
- Channel: an initial phone notification is allowed, but the specified form must then be submitted through the secure channel within 48 hours of the call.
- Follow-up: a written report is reported to be due within 14 days of becoming aware. Check the exact content requirements in the Code and the forms issued by the Commissioner's Office.
- Directions: the Commissioner can direct a CIO on its response to an incident and require it to cooperate with investigations.
The Code of Practice
The Commissioner's Code of Practice took effect on 1 January 2026. It explains how to meet the statutory duties and covers areas such as security policies and standards, supply chain management, cloud computing security, awareness training, incident management, and business continuity and disaster recovery. HKMA and the Communications Authority may adopt it for their sectors or issue their own codes. The Code is not subsidiary legislation and may be used as evidence, so map your security management plan to it clause by clause rather than to a generic framework alone.
Timeline and current status
| Date | Event |
|---|---|
| 19 March 2025 | Legislative Council passes the Protection of Critical Infrastructures (Computer Systems) Bill |
| 28 March 2025 | Ordinance gazetted as Cap. 653 |
| 1 January 2026 | Ordinance commences; Commissioner appointed for a three-year term; Code of Practice issued and effective |
| From mid-2026 (expected) | Phased designation of CIOs and CCSs |
| Designation + 1 month | Office address and security management unit notified |
| Designation + 3 months | Security management plan and emergency response plan submitted |
| Designation + 12 months (+3) | First risk assessment completed, report submitted within a further 3 months |
| Designation + 24 months (+3) | First independent audit completed, report submitted within a further 3 months |
Because duties run from each organisation's own designation date, two operators in the same sector can be at different stages. Treat the 1 month and 3 month deadlines as the tight ones: if your plan, unit and emergency response plan do not exist before designation, they are hard to produce in time.
Enforcement and penalties
- Criminal fines on the organisation: non-compliance with statutory obligations, requests or written directions is an offence. Published summaries put the maximum fines between HK$500,000 and HK$5 million depending on the obligation, with some lower tiers starting at HK$300,000, and daily fines of up to HK$100,000 for continuing offences.
- Highest tier: the HK$5 million maximum applies to failures such as not notifying incidents or not participating in drills, and to failing to comply with information requests.
- Individuals: liability sits with the organisation. Staff face personal criminal liability only where their conduct breaches existing criminal law, for example making false statements.
- Investigation powers: the Commissioner's Office can require documents and information, including information held outside Hong Kong that the CIO can access, and can investigate incidents and offences.
- Directions tied to the Code: a written direction referring to the Code of Practice turns a Code expectation into an enforceable requirement for that operator.
Read Cap. 653 itself for the exact offence provisions, defences and the appeal route against designations and directions before relying on any figure here.
What it means for AI agents and non-human identities
The Ordinance does not mention identities, AI agents or credentials by name. In practice, though, the evidence a CIO must produce (risk assessments, audits, change notices, incident reports) depends heavily on knowing which machine identities can reach a CCS and what they can do. The points below are good practice for meeting the duties, not text from the Ordinance or Code.
| Duty | Non-human identity question | Evidence to keep |
|---|---|---|
| Risk assessment (annual) | Which service accounts, API keys, certificates and automation agents can access each CCS? | NHI inventory per CCS with owner, privilege and last use |
| Material change notice | Does a migration or new integration create new machine credentials or trust relationships? | Change records listing credentials created, rotated or retired |
| Third-party measures | Which vendor and cloud identities hold standing access to CCSs? | Contract clauses, access reviews, session records for vendor access |
| Incident reporting (12 or 48 hours) | Can you tell quickly whether a stolen token or key was used against a CCS? | Centralised authentication and API logs for machine identities |
| Emergency response plan | Can you revoke and rotate credentials for a compromised CCS without stopping the service? | Tested rotation runbooks and break-glass procedures |
| Independent audit | Will the auditor find shared, hard-coded or never-rotated credentials? | Secrets management coverage and rotation reports |
- AI agents and automation: an AI agent or orchestration tool that can change CCS configuration is itself part of the attack surface. Give it a distinct identity, scoped permissions and logging, and treat adding one as a possible material change. See the Service Account Security Guide.
- OT environments: shared engineering accounts and default PLC credentials are common in SCADA and DCS estates. See the OT and ICS Identity and Access Guide.
- Vendor remote access: the Code's supply chain expectations are easiest to evidence when vendor access is brokered, time-bound and recorded. See the OT Remote Access Guide.
Compliance steps
- Assess designation likelihood. Map your services to the eight category 1 sectors and the category 2 test, and identify the systems essential to each core function. If you are regulated by HKMA or the Communications Authority, track their sector guidance as well as the Commissioner's.
- Prepare the 1 month items now. Confirm a Hong Kong office with real operations, name the security management unit (in-house or outsourced) and its supervising employee, and record their qualifications.
- Draft the CCS register. List candidate CCSs with owners, locations, dependencies, suppliers and the human and machine identities that can access them. This drives every later duty.
- Write the security management plan against the Code. Build a clause-by-clause cross-reference to the Code of Practice and any sectoral code, and note gaps with dates.
- Build the incident pathway. Define serious versus other incident criteria using the Code's factors, decide who confirms awareness, rehearse the 12 hour notification and the 48 hour form, and prepare the 14 day report template. See the Incident Response Plan Template.
- Get the emergency response plan endorsed. Board or delegated committee endorsement is expected; schedule a review after every material CCS change and at least every two years.
- Flow duties to suppliers. Add notification times shorter than 12 hours, audit and information rights, confidentiality terms and credential handling rules to contracts for CCS suppliers and cloud providers.
- Set the change notification gate. Add a "CCS material change" question to your change process so migrations, major upgrades and significant code changes are notified.
- Plan the first risk assessment and audit. Book an independent auditor early, agree methodology against the Code, and keep evidence in a form you can produce on request.
- Test. Run a tabletop on a CCS compromise involving a stolen service account credential and time each step. See the Tabletop Exercise Guide.
Framework mapping
| Ordinance duty | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 Annex A | CIS Controls v8.1 |
|---|---|---|---|---|
| Security management unit | GV.RR-02 | PM-11 | A.5.2 | 17 |
| Risk assessment | ID.RA-01 | RA-3 | Clauses 6.1.2 and 8.2 | 7 |
| Independent audit | ID.IM-01 | CA-2 | A.5.35 | 18 |
| Material change notice | PR.PS-02 | CM-3 | A.8.32 | 4 |
| Third-party measures | GV.SC-05, GV.SC-07 | SA-9, SR-6 | A.5.19 to A.5.23 | 15 |
| Machine and human access to CCS | PR.AA-01, PR.AA-05 | AC-2, AC-6, IA-5 | A.5.16, A.5.18, A.8.2 | 5, 6 |
| Incident notification | RS.CO-02 | IR-6 | A.5.24, A.5.26 | 17 |
| Emergency response plan | RC.RP-01 | IR-8, CP-2 | A.5.29, A.5.30 | 11, 17 |
Common failure patterns
- Waiting for the notice: the one month and three month deadlines are too short to create a security unit, plan and emergency response plan from nothing.
- Starting the 12 hour clock late: teams argue about whether an event is "really" an incident while the clock runs. Agree the awareness test in advance and log the decision time.
- Outsourced CCS with no flow-down: cloud or managed service contracts that do not require prompt notification leave the CIO unable to meet 12 hours.
- Treating the Code as optional: it is not an offence on its own, but a direction can make it binding and an auditor will test against it.
- Ignoring machine credentials: risk assessments that cover users but not service accounts, API keys and vendor tokens miss the access paths attackers use most in infrastructure intrusions.
Practitioner checklist
- Decide whether you are likely to be designated and which systems could be CCSs.
- Confirm the Hong Kong office and the security management unit with a named supervisor.
- Build a CCS register including suppliers and machine identities.
- Cross-reference the security management plan to the Code of Practice.
- Define serious incident criteria and the awareness decision point.
- Rehearse 12 hour and 48 hour notifications and the 14 day report.
- Obtain board endorsement of the emergency response plan.
- Add CCS clauses to supplier and cloud contracts.
- Insert a material change check into change management.
- Schedule the first risk assessment and independent audit.
Standards and references
- Hong Kong e-Legislation: Protection of Critical Infrastructures (Computer Systems) Ordinance, Cap. 653
- Mayer Brown: Hong Kong issues Code of Practice under the Ordinance
- China Briefing: Hong Kong's first comprehensive cybersecurity law
- Ashurst: Hong Kong passes new cybersecurity law
- Clyde and Co: Key highlights of the Protection of Critical Infrastructures Bill
- Kennedys: How the Ordinance and Code of Practice impact CIOs and suppliers
- Stephenson Harwood: Protection of Critical Infrastructures (Computer Systems) Ordinance
Related NHI Mgmt Group resources: Critical Infrastructure Regulation Map · Hong Kong PDPO Guide · Critical Infrastructure Identity Security Guide · Cyber Incident Reporting Requirements Map. This guide summarises the Hong Kong Protection of Critical Infrastructures (Computer Systems) Ordinance as at 27 October 2026 and is not legal advice.