Hong KongProtection of Critical Infrastructures (Computer Systems) Ordinance, Operator Security Obligations
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance, Reporting
As of .
What it requires
- This binds only an organization designated as a CI operator by written notice (section 12) because it operates an infrastructure essential to an essential service in energy, information technology, banking and financial services, air or land or maritime transport, healthcare, or telecommunications and broadcasting (Schedule 1), which you reach by declaring that you operate an essential service, provide financial services, handle health records or provide telecom services; a software vendor that is not designated is reached only through the supplier-contract policies a designated operator must include in its plan (Schedule 3, Part 1, section 3(h)).
- Maintain in Hong Kong an office that you occupy for carrying on your business, and notify the regulating authority of its address within 1 month after your designation date (section 19).
- Notify the regulating authority of a change of the organization that operates the critical infrastructure as soon as practicable and in any event within 1 month after the change (section 20).
- Maintain a computer-system security management unit, set up by you or by an engaged service provider, supervised by an employee with adequate professional knowledge of computer-system security, and notify the regulating authority of that appointment (section 21).
- Notify the regulating authority within 1 month after the date a material change occurs to the design, configuration, security or operation of a critical computer system, a critical computer system is removed, or a computer system essential to the core function is added (section 22).
- Submit a computer-system security management plan covering the matters in Schedule 3 within 3 months after your designation date, submit each revision within 1 month, and implement the plan (section 23).
- Conduct a computer-system security risk assessment within 12 months after your designation date and at least once every 12 months afterwards, and submit its report within 3 months after the period for the assessment ends (section 24).
- Arrange a computer-system security audit within 24 months after your designation date and at least once every 24 months afterwards, and submit its report within 3 months after the period for the audit ends (section 25).
- Submit an emergency response plan covering the matters in Part 2 of Schedule 3 to the Commissioner within 3 months after your designation date, submit each revision within 1 month, and implement the plan (section 27).
- Participate in a computer-system security drill when the Commissioner requires it after giving reasonable notice in writing (section 26).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Failing to notify an operator change (section 20) or to take part in a security drill (section 26) is punishable on conviction on indictment by a fine of HKD 5,000,000, with a further HKD 100,000 for each day an operator-change offence continues; a failure under sections 19, 21(4)(b) or (6), 22, 23(1) or (4), 24, 25 or 27 is punishable on conviction on indictment by a fine of HKD 500,000 and a further fine of HKD 50,000 for each day the offence continues.
Penalty structure
On conviction on indictment for failing to notify an operator change under section 20 (with a further daily fine of up to HKD 100,000) or to take part in a drill under section 26; the fine on summary conviction is HKD 3,000,000. The office, unit, material-change, plan, risk-assessment and audit duties carry HKD 500,000 on indictment and HKD 300,000 on summary conviction.
- Rule
- Fixed only
- As of
- Currency
- HKD
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
The Commissioner of Critical Infrastructure (Computer-system Security), whose functions include designating CI operators and critical computer systems.
Settledness
- As of
- Open questions
- Does a supplier of a hosted or managed computer service to a designated CI operator owe any duty under this Ordinance without being designated itself, or is it reached only through the supplier-contract policies the operator must include in its plan under Schedule 3, Part 1, section 3(h)?
What this law does
The Commissioner of Critical Infrastructure (Computer-system Security), or a designated authority for a regulated organization of its own, designates by written notice an organization that operates a critical infrastructure as a CI operator, and the duties below bind only a designated operator.
Schedule 1 specifies energy, information technology, banking and financial services, air transport, land transport, maritime transport, healthcare services, and telecommunications and broadcasting services as the sectors for the definition of critical infrastructure. A CI operator must maintain a unit (however described) for managing the computer-system security of its critical computer systems and ensuring that the Ordinance is complied with.
The operator may set up the unit itself or engage a service provider to do so. The operator must notify the regulating authority within 1 month after the date a specified event occurs, such as a material change to a critical computer system. The operator must submit a computer-system security management plan within 3 months of designation. The operator must conduct a computer-system security risk assessment within 12 months of designation and at least once every 12 months afterwards.
The operator must arrange a computer-system security audit within 24 months of designation and at least once every 24 months afterwards. The operator must submit an emergency response plan to the Commissioner within 3 months of designation.
The operator must notify the regulating authority of a change of the organization that operates the critical infrastructure within 1 month after the change, and must take part in a computer-system security drill when the Commissioner requires it after reasonable written notice. Failing to notify an operator change, or to take part in a drill, is an offence with a fine of 3,000,000 dollars on summary conviction and 5,000,000 dollars on conviction on indictment.
Failure to submit a plan or a revised plan, like a failure under the office, unit, material-change, risk-assessment and audit duties, is an offence with a fine of 300,000 dollars on summary conviction and 500,000 dollars on conviction on indictment, plus a further daily fine while the offence continues.
A defendant is acquitted where the offence was due to a cause beyond its control and it took all reasonable precautions and exercised all due diligence, and the Commissioner may exempt an operator from an obligation in the public interest. The Ordinance has been in operation since .
When LexLint raises it
When your app profile says your app runs an essential service, provides financial services, handles health records or provides telecom services.