Content Gen Dashboard

On June 2, 2026, the Hong Kong Monetary Authority (HKMA) issued an updated Code of Practice (COP) pursuant to the Protection of Critical Infrastructures (Computer Systems) Ordinance for authorized institutions designated as Critical Infrastructure Operators. The COP establishes cybersecurity requirements and obligations for authorized institutions that operate critical infrastructure systems. The document provides a regulatory framework addressing technology risk management and cybersecurity governance for these institutions. The update includes category 1 and category 2 obligations, with accompanying notification templates to facilitate compliance reporting. The COP applies to all authorized institutions that have been designated by the HKMA as Critical Infrastructure Operators under the ordinance. This development reflects the HKMA's continued focus on strengthening cybersecurity resilience within Hong Kong's banking sector. The issuance of the updated COP builds on previous cybersecurity initiatives, including the Cybersecurity Fortification Initiative (launched in 2016) and Cybersecurity Fortification Initiative 2.0 (issued in November 2020). The new COP supersedes previous versions and provides institutions with updated guidance on managing cyber risks and protecting critical infrastructure systems. Authorized institutions designated as Critical Infrastructure Operators must comply with the obligations outlined in the COP. The document includes annexes containing templates for notifications required under category 1 and category 2 obligations, enabling institutions to standardize their reporting to the HKMA. Institutions should review the COP and implement necessary measures to ensure compliance with the specified cybersecurity requirements and notification procedures. REFERENCES: Hong Kong Monetary Authority. (2026). Code of Practice Pursuant to the Protection of Critical Infrastructures (Computer Systems) Ordinance. Retrieved from HKMA Banking Regulatory Document Repository.

The Hong Kong Monetary Authority (HKMA) has issued a Sectoral Code of Practice under the Protection of Critical Infrastructures (Computer Systems) Ordinance (PCICSO) for Authorized Institutions (AIs) designated as Critical Infrastructure (CI) operators. The Code of Practice prescribes: Designation of Critical Computer Systems (CCSs) detailing criteria for designating a system as a CCS, which includes systems that play a material role in core CI functions, systems whose disruption would cause severe impact, and systems storing or processing sensitive digital data for essential services. Organizational obligations (Category 1) mandating that Designated AIs maintain an operational office in Hong Kong, promptly notify the Monetary Authority (MA) of any operator changes (such as ceasing essential services or transferring a banking license), and establish a computer-system security management unit supervised by a qualified professional. Security management plans and notifications (Category 2) requiring AIs to notify the MA of material changes to their CCSs, such as platform migrations, major version upgrades, or significant code changes. Furthermore, AIs must submit and implement a computer-system security management plan endorsed by the Board or senior management and reviewed at least once every two years. This plan must cover robust controls including access and password management, cryptography, physical security, patch management, supply chain management, and cloud computing security. Risk assessments and audits stipulating that Designated AIs must conduct regular computer-system security risk assessments, which must encompass both vulnerability assessments and penetration tests performed by qualified professionals. Additionally, AIs must appoint an assessor to conduct computer-system security audits to evaluate whether the security management plan is properly implemented and whether the security controls adhere to the Code's guidance. The code takes immediate effect.

meta_id 3204498

Generated

Hong Kong Monetary Authority Issues Code of Practice for Critical Infrastructure Cybersecurity

Agent draft

Published

Hong Kong Monetary Authority Issues Code of Practice on Cybersecurity for Banks Designated as Critical Infrastructure Operators