Hong Kong has enacted its first dedicated cybersecurity law aimed at safeguarding the computer systems of “critical infrastructure” (CI) against cyber-attacks and other operational disruptions. The law provides a statutory framework for risk management, incident response, and regulatory oversight of essential sectors.
- Effective date: January 1, 2026
- Full name: Protection of Critical Infrastructures (Computer System) Ordinance
- Purpose: Protect essential services and ensure their continuous, secure operation under rising cyber threats.
Eight Essential Sectors Covered
The law applies to critical infrastructure operators (CIOs) in these eight key sectors — deemed vital for Hong Kong’s societal and economic functioning:
- Energy (power generation and supply)
- Information Technology
- Banking and Financial Services
- Air Transport
- Land Transport
- Maritime Transport
- Healthcare Services
- Telecommunications & Broadcasting Services
These sectors are considered Category 1 critical infrastructures because disruption of their essential services could significantly impact daily life or economic stability.
Key Compliance Obligations for CI Operators
1. Security Management Requirements
CIOs must:
- Establish and maintain a security management unit to protect critical computer systems (CCS).
- Develop and implement security management plans.
- Conduct risk assessments and periodic security audits.
2. Incident Reporting Deadlines
A central feature of this law — and one of the strictest global reporting standards — is the tight timeframe for reporting serious cyber incidents:
| Incident Type | Reporting Window |
|---|---|
| Serious computer-system security incidents (e.g., those disrupting or likely to disrupt core CI functions) | Within 12 hours of becoming aware |
| Other security incidents | Within 48 hours |
| Written detailed report | Within 14 days |
The 12-hour requirement for major incidents places Hong Kong among the world’s most stringent cyber incident reporting regimes — underscoring regulatory emphasis on responsiveness and real-time risk control.
3. Regulatory Oversight & Enforcement
- A Commissioner’s Office for Critical Infrastructure will oversee compliance.
- Regulators can investigate, request information, and enforce corrective actions.
- Failure to comply (including late reporting) can result in fines up to HK$5 million and other penalties.
What This Means for Organizations
If your organization operates in one of the eight designated sectors and is designated as a CI operator by authorities:
- You must upgrade cybersecurity practices to meet statutory standards.
- Prepare incident response frameworks that can report and escalate incidents in near-real time.
- Align internal processes to meet tight reporting windows — especially the 12-hour rule for serious incidents.
Failing to do so could result in regulatory action — and in today’s threat environment, strict compliance is also key to operational resilience
