TL;DR: Hong Kong’s Protection of Critical Infrastructures Bill, effective January 1, 2026, requires operator-level accountability, continuous monitoring, formal risk assessments, and supplier oversight across critical sectors, according to SecurityScorecard. The compliance burden is increasingly about proving control over external dependencies, not just documenting internal security posture.
At a glance
What this is: Hong Kong’s critical infrastructure bill formalises cybersecurity governance for essential services, with stronger accountability for suppliers and external dependencies.
Why it matters: It matters because IAM, PAM, NHI, and third-party access programmes will need evidence of control over cloud, managed service, and vendor dependencies, not just internal policy coverage.
Context
Hong Kong’s Protection of Critical Infrastructures Bill is a governance and resilience measure, not just a compliance update. It raises the bar for organisations that rely on external providers by making supplier oversight, monitoring, and documented mitigation part of the operating model for critical sectors.
For identity and access teams, the policy pressure lands squarely on third-party access, service accounts, delegated administration, and machine-to-machine dependencies. That makes the bill relevant to NHI governance as well as broader cyber risk management, because external access paths are often where control evidence is weakest.
Key questions
Q: Where does supplier governance fail in critical infrastructure programmes?
A: Supplier governance fails when external access is treated as a procurement issue rather than a controlled access path. The weak point is usually standing privilege, unmanaged service accounts, or unclear ownership across cloud and managed service dependencies. If operators cannot show who can access critical systems, why that access exists, and how it is reviewed, governance is incomplete.
Q: Why do external dependencies create regulatory risk for critical services?
A: External dependencies create regulatory risk because responsibility does not end at the operator’s perimeter. When third-party systems, vendor accounts, or delegated access can influence critical operations, the organisation must still prove oversight, monitoring, and mitigation. Regulators increasingly expect evidence that the full service chain is governed, not just the internal network.
Q: What are the signs that vendor oversight is not working?
A: Look for vendors with unclear owners, dormant accounts, duplicate access paths, expired approvals, unresolved exceptions, and reassessment cycles that do not change permissions. Those signals show that the governance process exists administratively but is not controlling real access.
Q: How should security teams respond when critical infrastructure rules extend to third parties?
A: Security teams should expand governance to include external identities, privileged supplier connections, and evidence-ready monitoring. That means defining access ownership, proving offboarding, and aligning reporting to regulatory obligations. The aim is not simply more controls, but a demonstrable chain of accountability across the dependency landscape.
Technical breakdown
What the bill changes for third-party access governance
The legislation shifts security responsibility outward from the operator’s own environment to the full chain of dependencies that support essential services. In practice, that means cloud platforms, managed service providers, and suppliers become part of the governed attack surface, even when they are outside the operator’s direct perimeter. This is a material change for access governance because third-party connections often rely on shared credentials, delegated roles, API keys, and support pathways that outlive individual projects. A compliance programme now has to show who can access what, on whose authority, and under what monitoring model.
Practical implication: review third-party access inventories as a governed access domain, not a procurement list.
Why continuous monitoring becomes an evidence problem
Continuous monitoring is not only a detection requirement. It is also the mechanism by which operators prove that external risk is being watched, assessed, and acted upon over time. That makes alerting, asset discovery, supplier telemetry, and reporting cadence part of regulatory evidence, not just security operations. Where external services or NHI credentials are involved, stale inventories and periodic reviews are too slow to establish control assurance. The governance question becomes whether the organisation can demonstrate an always-current view of exposure across suppliers, workloads, and connected services.
Practical implication: align monitoring outputs to audit-ready reporting so external dependency risk is visible on demand.
Supplier oversight now includes identity and privilege boundaries
Supplier governance under this bill is not limited to contractual language or due diligence questionnaires. It extends into privilege boundaries, authentication methods, and the lifecycle of external access. That matters because many supplier incidents begin with overbroad entitlements, long-lived credentials, or unmanaged delegated access rather than conventional network compromise. For identity teams, the relevant control question is whether a vendor, service account, or automation path is still necessary, still scoped correctly, and still observable. The bill effectively turns access lifecycle management into a resilience requirement.
Practical implication: treat external identities as regulated access paths with explicit ownership, review, and offboarding.
Threat narrative
Attacker objective: The objective is to exploit weak external governance to reach essential services or create control failure in the operator’s wider dependency environment.
- Entry occurs through external dependencies such as cloud platforms, managed service providers, or third-party vendors that already have access to critical operations.
- Escalation happens when those external pathways retain standing access, broad entitlements, or insufficient monitoring across systems that support essential services.
- Impact is regulatory and operational: organisations must absorb the control burden of proving supplier oversight, continuous monitoring, and accountability across the dependency chain.
Breaches seen in the wild
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
- Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Supplier governance is now an identity problem, not only a procurement problem. Once a critical infrastructure law requires oversight of external dependencies, the weak point is often the access path itself. That means delegated administration, service accounts, and vendor-issued credentials become governance objects, not just technical artefacts. The practical conclusion is that supplier assurance must include identity ownership, privilege scope, and offboarding evidence.
Continuous monitoring only has value if it is tied to actionable accountability. A flood of telemetry does not satisfy a bill that expects demonstrable mitigation and operator responsibility. Organisations need evidence that external risk signals are mapped to named owners, tracked to closure, and preserved for audit. The real control gap is not lack of alerts but lack of governed response to supplier exposure.
External dependency control is becoming the new resilience baseline. Critical infrastructure regimes increasingly treat suppliers, cloud platforms, and managed services as part of the control boundary. That trend validates stronger third-party access governance and will expose programmes that still rely on periodic reviews and static trust assumptions. Practitioners should expect supplier identity evidence to sit alongside conventional security posture evidence.
Hong Kong is reinforcing a global shift toward auditable cyber resilience. The article’s alignment with NIS2 and other national regimes shows that regulators are converging on one expectation: operators must prove control over the whole service chain. For identity-led programmes, that means third-party access, machine identity, and privileged external connectivity will be judged as operational resilience issues, not narrow IAM tasks.
The named concept here is external dependency governance debt. That is the accumulation of unmanaged supplier access, opaque cloud reliance, and weak evidence of oversight across essential services. The longer an organisation postpones inventory, monitoring, and access lifecycle control, the harder it becomes to prove resilience under regulatory scrutiny. The practitioner response is to close the gap before compliance becomes a forensic exercise.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: Third-Party, B2B and Contractor Access Guide
What this signals
External dependency governance debt: the longer critical service operators leave supplier access, delegated roles, and managed-service pathways under-governed, the harder it becomes to prove resilience under regulatory scrutiny. The bill pushes programmes toward evidence-based control over third-party access rather than policy statements alone.
A compliance response should therefore start with access ownership and monitoring evidence, then move into supplier remediation and reporting discipline. For identity-led teams, this is a clear sign that third-party access is becoming a board-level governance issue, not a back-office control.
For practitioners
- Map supplier access paths to critical services Inventory every cloud, managed service, and vendor connection that can reach regulated workloads, then assign an owner and business purpose to each path.
- Require evidence for continuous monitoring Define what monitoring outputs count as compliance evidence, including alerting, reporting cadence, and escalation records for external dependencies.
- Review standing privilege for external identities Find vendor accounts, service accounts, and delegated roles that retain persistent access, then set review and removal criteria for each one.
- Build supplier oversight into audit reporting Link risk assessments, mitigation actions, and control attestations into one reporting trail so regulators can trace decisions from issue to closure.
Key takeaways
- Hong Kong’s bill turns supplier oversight into an operational requirement for critical infrastructure operators, not just a contractual expectation.
- The hardest part of compliance is likely to be proving control over third-party access, cloud dependencies, and managed services.
- Identity governance, especially around external identities and standing privilege, is now central to resilience and audit readiness.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The bill’s supplier oversight pressure maps to governed access across external dependencies. |
| GV.RM-01 — Risk Management Strategy | Formal risk assessments and mitigation actions are central compliance requirements in the article. | |
| Recommendation — Apply PR.AA-05 to enforce reviewed, documented access permissions for suppliers and service providers. Integrate supplier and dependency risk into the organisation’s formal risk management strategy. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article’s focus on external access, accounts, and oversight aligns to account lifecycle control. |
| Recommendation — Use CIS-5 to inventory, review, and remove unnecessary supplier and service accounts. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Operator accountability for external dependencies depends on controlled account lifecycle governance. |
| Recommendation — Apply AC-2 to govern creation, review, and offboarding of external and supplier accounts. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Third-party access chains often become pathways for credential abuse and movement into critical systems. |
| Recommendation — Map supplier access risk to TA0006 and TA0008 when assessing downstream compromise paths. | ||
Key terms
- Supplier Security Governance: Supplier security governance is the discipline of controlling how third parties access, handle, and support sensitive information and systems. In defence and other regulated supply chains, it links onboarding, access review, data handling, and offboarding to business trust and resilience.
- Continuous Monitoring: Continuous Monitoring is the ongoing evaluation of access, activity, and control state rather than a periodic snapshot. In practice, it helps teams spot privilege drift, conflicting transactions, and configuration changes before they become audit findings or operational losses.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- External Dependency: An external dependency is any cloud platform, managed service, vendor system, or third-party connection that can influence a critical business service. The governance challenge is to treat these dependencies as part of the control boundary, even when they sit outside direct ownership.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect access control evidence to real-world identity and resilience programmes.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org