Hong Kong Protection of Critical Infrastructures (Computer Systems) Ordinance

NIS2-style regime for operators in energy, IT, transport, banking and financial services, healthcare, telecommunications and broadcasting, plus major venues and R&D parks: security management units, risk assessments, audits and incident reporting within 12 hours for serious incidents. Code of Practice issued January 2026.

JurisdictionHong Kong
CategoryCybersecurity
StatusActive
Effective date
Latest development

Analysis

The Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) is Hong Kong’s first dedicated, horizontal cybersecurity law for critical infrastructures, in force from 1 January 2026 and supported by a Code of Practice issued at the same time by the Office of the Commissioner of Critical Infrastructure (Computer-system Security). Key primary sources include: LegCo Ordinance PDF, Communications Authority PCICSO page, Gazette commencement notice, and the Commissioner’s site OCCICS.

Key Requirements

According to the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), operators of specified critical infrastructures (“CI operators” / “CIOs”) must comply with a structured set of statutory obligations organised into three main categories. Primary legal text: Ordinance (Cap. 653) – LegCo PDF and Bill document. Official regulatory overview: Communications Authority PCICSO page and OCCICS “Legislative Intent and Principles”.

1. Scope: Designated Critical Infrastructures and Critical Computer Systems

  • CI operators designation and sector coverage
  • The Ordinance applies to “designated operators of specified critical infrastructures” in sectors listed in Schedule 1, including essential services in energy, information technology, transport, banking and financial services, healthcare, telecommunications and broadcasting, and other infrastructures whose damage or data loss would hinder critical societal or economic activities in Hong Kong.
  • This is confirmed in the Security Panel background paper describing “specified critical infrastructures” and sectors in Schedule 1.Background paper – Panel on Security 6 May 2025
  • The Communications Authority PCICSO overview explicitly states that PCICSO “aims to impose statutory obligations on designated operators of critical infrastructures (‘CI operators’)” to protect their computer systems.Communications Authority PCICSO page
  • Critical Computer Systems (CCS) designation
  • Under the Ordinance, computer systems essential to the core function of a critical infrastructure, accessible in or from Hong Kong, may be designated as Critical Computer Systems (CCS), triggering obligations under the law.OCCICS home page
  • Legal and industry commentary confirms the definition and role of CCS in the framework.Mayer Brown summary and Thales compliance overview

2. Category 1 Obligations – Governance & Security Management

  • Establish security management structure and measures
  • CI operators must implement organisational and technical measures to safeguard the security of CCSs, including governance, security management, and internal controls.Communications Authority PCICSO page
  • The OCCICS Code of Practice elaborates expectations for security management units, assignment of responsibilities, and maintenance of security policies and procedures.OCCICS Code of Practice PDF
  • Risk assessments and regular reviews
  • The Ordinance requires CI operators to “put in place necessary measures and controls to safeguard the security of the computer systems”, which the Code of Practice translates into periodic risk assessments, threat analysis, and review of security controls.OCCICS “Legislative Intent and Principles” and OCCICS CoP
  • Sector-specific Codes (e.g., for authorized institutions under HKMA) provide templates and detailed expectations for risk assessment documentation and reporting.HKMA sector CoP index

3. Category 2 Obligations – Technical and Operational Controls

  • Implementation of security controls and audits
  • The Communications Authority sets out Category 2 obligations relating to technical and operational controls, which include implementing appropriate protections, system monitoring, and security audits over CCSs.Communications Authority PCICSO page
  • The OCCICS Code of Practice provides detailed guidance on required security baselines, configuration management, logging, vulnerability management, and periodic audits of CCSs.OCCICS CoP

4. Category 3 Obligations – Incident Reporting and Response

  • Mandatory incident reporting within defined timeframes
  • Category 3 obligations include notifying computer-system security incidents in respect of CCSs to the Commissioner within a designated timeframe, participating in drills, and submitting/implementing an emergency response plan.Communications Authority PCICSO page
  • Official materials and practitioner commentary emphasise time‑bound reporting and structured response requirements.OCCICS FAQ and BRG analysis
  • Emergency response plans and exercises
  • CI operators must prepare emergency response plans, conduct drills, and cooperate with OCCICS and sector regulators in simulated or real incidents.Communications Authority PCICSO page
  • The Code of Practice sets expectations for incident classification, escalation, communication channels, and post‑incident review.OCCICS CoP

5. Regulatory Oversight and Penalties

  • Establishment of OCCICS and enforcement structure
  • The Ordinance establishes the Office of the Commissioner of Critical Infrastructure (Computer-system Security) (“OCCICS”) and empowers existing sector regulators to enforce obligations within their domains.OCCICS “Legislative Intent and Principles”
  • OCCICS acts as the central cybersecurity regulator for CI operators and CCSs.OCCICS home
  • Fines and sanctions for non‑compliance
  • The OCCICS FAQ states that the maximum penalty is a fine of HK$5,000,000, and for continuing offences a further fine of HK$100,000 per day may be imposed.OCCICS FAQ
  • Industry analysis of the Bill confirms penalty ranges and compares them with EU/UK regimes.Thales compliance overview

Compliance Challenges

Organizations subject to PCICSO face both structural and operational challenges similar to those seen under EU NIS‑style regimes, but within Hong Kong’s specific regulatory architecture.

1. Identification and Designation of CCS and CIs

  • Challenge in scoping and designation
  • Determining which infrastructures qualify as “critical” and which systems as CCS can be complex, particularly for multi‑national groups and conglomerates.Panel on Security background paper
  • Commentary notes difficulty for organizations in mapping existing IT/OT assets to CCS definitions and anticipating future designation.China Briefing analysis and Mayer Brown CoP analysis

2. Governance and Resource Constraints

  • Building security management units and governance frameworks
  • The CoP expects CI operators to have clear governance structures, roles and responsibilities; organizations without mature cybersecurity functions must rapidly build security management units.OCCICS CoP
  • Advisory pieces highlight resourcing and skills shortages as key obstacles, particularly for medium‑sized CI operators.BRG analysis and LinkedIn practitioner overview

3. Incident Reporting Timelines and Operational Readiness

  • Tight reporting deadlines and classification challenges
  • Category 3 obligations require notification within prescribed timeframes; industry commentary notes that organizations need robust detection and escalation to meet these deadlines.Communications Authority PCICSO
  • The CoP’s detailed expectations around incident classification and escalation processes can be demanding for organizations with fragmented monitoring or legacy systems.OCCICS CoP

4. Alignment with Existing Sectoral and Global Frameworks

  • Overlap with other regulatory and security obligations
  • Financial institutions designated as CI operators must align PCICSO obligations with Hong Kong Monetary Authority requirements and global cybersecurity standards, creating an integration challenge.HKMA sector CoP index
  • Comparative analyses of PCICSO versus EU NIS and other regimes highlight complexity in harmonising controls and reporting across jurisdictions.Thales compliance overview and China Briefing analysis

Implementation Best Practices

Although the Ordinance is principle‑based, the Code of Practice and sector guidance provide structured implementation expectations that can be turned into practical steps.

1. Governance and Security Management Structure

  • Establish a dedicated security management unit for CCSs
  • Follow CoP guidance to formalise roles, reporting lines and accountability for CCS security, including board‑level oversight and defined responsibilities for incident response.OCCICS CoP
  • OCCICS’ legislative principles emphasise the need for CI operators to “strengthen the protection of their computer systems” through systematic governance.OCCICS “Legislative Intent and Principles”
  • Define and maintain CCS inventory and criticality assessments
  • Maintain a documented inventory of CCSs, including dependencies, criticality, and cross‑border interfaces, consistent with the Ordinance’s focus on systems “essential to the core function” of CIs.OCCICS home
  • Align classification with the sector CoP templates where applicable.HKMA sector CoP index

2. Risk Management and Controls

  • Conduct regular, structured risk assessments
  • Implement periodic risk assessments of CCSs as described in the CoP, covering threat scenarios, vulnerabilities, and potential impact on essential services.OCCICS CoP
  • Use recognized cybersecurity frameworks (e.g., NIST CSF or ISO/IEC 27001) as reference models to meet Ordinance requirements while maintaining global consistency; this approach is recommended in several practitioner analyses of PCICSO implementation.BRG PCICSO operational implications and China Briefing comparison
  • Implement baseline technical controls and monitoring
  • Follow CoP guidance on baseline security configurations, network segregation, access controls, logging, and continuous monitoring of CCSs.OCCICS CoP
  • Sector CoPs for authorized institutions offer detailed templates for security measures and reporting formats.HKMA sector CoP index

3. Incident Response and Reporting

  • Build a PCICSO‑aligned incident response plan
  • Develop an incident response plan explicitly covering notification obligations, communication with OCCICS and sector regulators, and participation in drills, as required under Category 3.Communications Authority PCICSO
  • The CoP provides guidance on incident severity levels, escalation paths, and post‑incident reviews.OCCICS CoP
  • Implement reporting workflows and tooling
  • Use templates and notification formats provided in sector Codes of Practice (e.g., HKMA annex templates) to ensure accurate and timely reporting.HKMA CoP annex
  • Industry advisory material recommends integrating incident detection, SIEM tooling, and ticketing workflows to meet the Ordinance’s “designated timeframe” reporting obligations.BRG PCICSO operational implications and Mayer Brown CoP analysis

Recent Updates

1. Enactment and Commencement

  • Passage of the Ordinance
  • The Protection of Critical Infrastructures (Computer Systems) Bill was passed by the Legislative Council on 19 March 2025, and the Ordinance (Ord. No. 4 of 2025) was published in the Gazette on 28 March 2025.Panel on Security background paper and LegCo Ordinance PDF
  • Effective date (commencement)
  • The Secretary for Security appointed 1 January 2026 as the day on which the Ordinance comes into operation, via Gazette notice under section 1(2) of the Ordinance.Gazette commencement notice
  • Industry commentary confirms enforcement set to begin in 2026 for designated CI operators.[China Briefing analysis](https://www.china-briefing.com/news/hong-kong-cybersecurity-law-critical-infrastructure

Recent developments

  • — The government’s ordinance page was updated, signaling continued maintenance of the official implementation materials. No major substantive policy change is evident from the page snippet, but it confirms the regime remains active and publicly administered. (source)
  • — Industry-facing legal commentary emphasized that operators must maintain security controls, report material changes, and implement compliance processes. The practical impact is increased governance, audit, and incident-response burdens for designated critical infrastructure operators. (source)
  • — The Commissioner’s Office homepage was updated with the ordinance’s status and background. This suggests continued rollout activity and public-facing guidance for regulated operators. (source)
  • — A version 1.0 Code of Practice document was published for the ordinance. This is an important implementation milestone because it translates the statutory regime into operational guidance for covered operators. (source)
  • — The Commissioner’s Office published an announcement referencing the commencement notice for the ordinance. This indicates ongoing administrative updates and formal publication of implementation materials. (source)
  • — Hong Kong issued a Code of Practice under the ordinance, setting out practical compliance expectations for critical infrastructure operators. The update confirms obligations around material system changes, security measures, and implementation requirements. (source)
  • — A legal update noted that the government was still finalizing relevant codes of practice for essential service sectors as the regime took effect. It also highlighted the new enforcement structure, with the Commissioner’s Office coordinating designation, oversight, and incident reporting. (source)
  • — The government stated that the ordinance came into operation on 1 January 2026. It described the law as imposing statutory obligations on designated critical infrastructure operators to protect computer systems and reduce cyber disruption risks. (source)
  • — Hong Kong announced the appointment of the Commissioner of Critical Infrastructure (Computer-system Security) and the launch of the Commissioner’s Office. The office was tasked with designating operators and critical computer systems and enforcing compliance under the ordinance. (source)
  • — The Commissioner’s Office confirmed the ordinance’s commencement and framed the regime as aligned with relevant overseas legislation and international standards. This reflects the formal rollout of the new cybersecurity regulatory framework for critical infrastructure. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates