Hong Kong: Actions to take under critical infrastructure cybersecurity regime

Why should I read this?

Hong Kong’s Protection of Critical Infrastructures (Computer Systems) Ordinance came into effect on January 1, 2026. It is designed to protect critical infrastructure from cyber threats that could disrupt essential services, including power, banking, telecoms, healthcare and transport.

The regime is now operational. A new Commissioner of Critical Infrastructure (Computer-system Security) has been appointed, codes of practice have been issued across several sectors and the process of designating critical infrastructure operators (CIOs) is underway.

Businesses in the covered sectors should act now. Even if an organization has not yet been formally designated, pre-designation inquiries have begun. Once designated, CIOs face strict compliance deadlines, including for cybersecurity plans, risk assessments, audits and incident reporting.

Who does it apply to?

The Ordinance applies to CIOs. These are organizations that run infrastructure that Hong Kong relies on for essential services. The regime covers sectors such as energy, IT, banking and financial services, air transport, land transport, maritime transport, healthcare services, and telecommunications and broadcasting.

Infrastructure may also fall within the regime if a computer system failure could substantially affect Hong Kong’s critical societal or economic activities. This could include, for example, major sports and performance venues or research and development parks.

The list of designated CIOs and critical computer systems will not be made public. Designations are being made in phases from mid-2026 and the focus is mainly on privately operated infrastructure. Government-run infrastructure and non-designated entities are outside scope.

Once designated, CIOs must comply with three categories of obligations:

• Organizational obligations, such as maintaining a Hong Kong office and setting up a computer-system security management unit.
• Preventive obligations, including security management plans, annual risk assessments and arranging security audits every two years.
• Incident response obligations, including emergency response plans, taking part in security drills and reporting cyber incidents within the required timeframes.

Failure to comply can lead to significant fines. Penalties apply to the organization, not to individuals.

What guidance has been issued?

Codes of practice have been issued to guide operators on compliance. These include practical guidance, standards and specifications. Although the codes are not legally binding, failure to follow them may still have consequences. The Commissioner may issue written directions by reference to the codes and failure to comply with those directions is an offence.

Codes have already been issued for all sectors generally, as well as for energy, banking and financial services, payment system infrastructure operators, stored value facility licensees and land transport. The Communications Authority has adopted the generic code for telecoms and broadcasting.

An Appeal Panel has also been established. It gives CIOs a route to appeal a designation or written direction.

Actions for boards

Boards of designated CIOs (or those likely to be designated) should prepare for the following:

• Assess whether the business may be designated as a CIO, especially if it operates in one of the covered sectors.
• Identify the systems that are most important to the business, including any software, suppliers, cloud services or outsourced providers needed to keep those systems running.
• Review current cybersecurity arrangements against the Ordinance and the relevant code of practice.
• Review cybersecurity governance against the Ordinance’s requirements. The Ordinance imposes organizational obligations that go beyond having a cybersecurity team. CIOs must map and adjust their existing cybersecurity and enterprise risk governance frameworks. Organizational measures under the Ordinance include maintaining a physical office in Hong Kong and promptly notifying the Commissioner of changes to operations (such as mergers and outsourcing arrangements). It also includes setting up and maintaining a computer-system security management unit (as well as employing a qualified head to supervise it). 
• Develop or update cybersecurity plans, including plans for responding to cyber incidents.
• Check incident reporting processes, including how the business would meet the 12-hour deadline for serious incidents and 48-hour deadline for other reportable incidents.
• Review contracts with key suppliers, such as cloud, software and IT providers, to make sure they include appropriate security, compliance and audit rights.
• Establish board oversight and accountability. Designate a board committee (such as technology, legal, risk or audit) responsible for oversight and reporting to the board.
• Engage early with regulators, including the Commissioner or sector regulator, if guidance is needed.
• Obtain independent assurance. Consider regular cyber risk assessments, independent audits and compliance reviews against the relevant code of practice.
• Build evidence into monitoring workflows. Capture remediation actions, exception approvals and monitoring outcomes in a form that can be reused for audit and regulatory reporting.

What comes next?

Expect the following developments:

• More sectoral codes of practice may follow. Codes have so far been issued for energy, banking and financial services and land transport. Separate codes do not currently appear to have been issued for air transport, maritime transport, healthcare services and IT. For telecoms and broadcasting, the Communications Authority has adopted the generic code  but may issue its own sectoral code if needed.
• Formal CIO designations. Pre-designation inquiries have begun. Formal written notices will be the next key step. These notices trigger the compliance timetable.
• First compliance submissions. Once designated, CIOs must submit their security management plan and emergency response plan within three months. Their first risk assessment report is due within 12 months, and their first security audit report within 24 months.
• First security drills. The Commissioner may organise drills involving CIOs across one or more sectors at least once every two years. The first drill will be an important sign that the regime is fully operational.
• First enforcement directions. The Commissioner can issue written directions requiring corrective action.

Instead of waiting for formal designation, businesses in the covered sectors should begin preparing now so they are ready when the deadlines begin to apply.