The Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) ("PCICSO") comes into operation on 1 January 2026. It aims to impose statutory obligations on designated operators of critical infrastructures ("CI operators") to ensure they adopt appropriate measures to protect their computer systems, minimising the risk of essential services being disrupted or compromised due to cyberattacks, thereby maintaining the normal functioning of Hong Kong society and the daily lives of its people.

The PCICSO imposes three categories of statutory obligations on CI operators as follows –

• Category 1 obligations (organizational) : include maintaining an office in Hong Kong; notifying operator changes in relation to a critical infrastructure; and setting up and maintaining a computer-system security management unit supervised by an employee of the operator.
• Category 2 obligations (preventive) : include notifying material changes in respect of critical computer systems ("CCSs"); submitting and implementing a computer-system security management plan; conducting computer-system security risk assessments; and arranging to carry out computer-system security audits.
• Category 3 obligations (incident reporting and response) : include participating in computer-system security drills; submitting and implementing an emergency response plan; and notifying computer-system security incidents in respect of CCSs to the Commissioner of Critical Infrastructure (Computer-system Security) ("Commissioner") within a designated timeframe.

Roles and functions of the Communications Authority ("CA")

The Commissioner is responsible for, among others, the monitoring and supervision of compliance with the provisions of the PCICSO, and coordinating the implementation of the PCICSO with designated authorities. CA, as a designated authority under the PCICSO, is responsible for enforcing the PCICSO in respect of supervising and monitoring compliance with category 1 obligations and category 2 obligations by CI operators in the telecommunications and broadcasting services sector under its purview.

Code of Practice

Pursuant to section 8 of the PCICSO, the Commissioner issued a Code of Practice ("CoP") that provides practical guidance on how a CI operator is to comply with category 1 obligations, category 2 obligations and category 3 obligations under the PCICSO.

CA adopts the CoP in respect of category 1 obligations and category 2 obligations of CI operators regulated by CA. The adoption of the Commissioner's CoP does not preclude CA from issuing any sectoral codes of practice in respect of category 1 obligations and category 2 obligations of CI operators under its purview when necessary.

• Frequently Asked Questions