Is a bank, in Hong Kong

Cap. 653, s. 28 and Schedule 6 (Protection of Critical Infrastructures (Computer Systems) Ordinance) · Read the law's page

• This binds only an organization designated as a CI operator by written notice, which you reach by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services (sections 12 and 28).
• Notify the Commissioner as soon as practicable, and within 12 hours after becoming aware of a computer-system security incident that has disrupted, is disrupting or is likely to disrupt the core function of the critical infrastructure, or within 48 hours in any other case (section 28(1), (2) and Schedule 6).
• If you did not notify in the form and way the regulating authority specified, submit a written record of the incident in that form within 48 hours after the notification (section 28(3) and Schedule 6).
• Submit a written report of the incident in the specified form and way to the Commissioner within 14 days after the date you become aware of it (section 28(4) and Schedule 6).

Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), ss. 12, 19 to 27, 55 and 65 · Read the law's page

• This binds only an organization designated as a CI operator by written notice (section 12) because it operates an infrastructure essential to an essential service in energy, information technology, banking and financial services, air or land or maritime transport, healthcare, or telecommunications and broadcasting (Schedule 1), which you reach by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services; a software vendor that is not designated is reached only through the supplier-contract policies a designated operator must include in its plan (Schedule 3, Part 1, section 3(h)).
• Maintain in Hong Kong an office that you occupy for carrying on your business, and notify the regulating authority of its address within 1 month after your designation date (section 19).
• Notify the regulating authority of a change of the organization that operates the critical infrastructure as soon as practicable and in any event within 1 month after the change (section 20).
• Maintain a computer-system security management unit, set up by you or by an engaged service provider, supervised by an employee with adequate professional knowledge of computer-system security, and notify the regulating authority of that appointment (section 21).
• Notify the regulating authority within 1 month after the date a material change occurs to the design, configuration, security or operation of a critical computer system, a critical computer system is removed, or a computer system essential to the core function is added (section 22).
• Submit a computer-system security management plan covering the matters in Schedule 3 within 3 months after your designation date, submit each revision within 1 month, and implement the plan (section 23).
• Conduct a computer-system security risk assessment within 12 months after your designation date and at least once every 12 months afterwards, and submit its report within 3 months after the period for the assessment ends (section 24).
• Arrange a computer-system security audit within 24 months after your designation date and at least once every 24 months afterwards, and submit its report within 3 months after the period for the audit ends (section 25).
• Submit an emergency response plan covering the matters in Part 2 of Schedule 3 to the Commissioner within 3 months after your designation date, submit each revision within 1 month, and implement the plan (section 27).
• Participate in a computer-system security drill when the Commissioner requires it after giving reasonable notice in writing (section 26).