In today’s digital era, critical infrastructure – from power and public utilities to transport and communications – has become a frequent target of malevolent hackers, threatening unimaginable chaos to a city like Hong Kong. The frontline is no longer bounded by geographical boundaries. To defend society’s functioning, economy and public safety against this constant threat of severe disruption, Hong Kong’s new Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap.653) (Ordinance), together with its Code of Practice (CoP) guidelines for gatekeepers at the front line of defence, came into effect on 1 January 2026. For an overview of the Ordinance and key practical implications, please refer to our previous legal update. The newly published CoP meanwhile provides practical, actionable guidance for Critical Infrastructure Operators (CI Operators), clarifying their statutory obligations and introducing new standards for the designation, management, and protection of Critical Computer Systems (CCSs). This legal update provides an overview of the CoP, highlighting some practical implications for CI Operators. Purpose and nature of the Code of Practice Published by the Commissioner of Critical Infrastructure (Computer-system Security) (Commissioner) in consultation with designated authorities, the CoP provides CI Operators with practical guidance on how to comply with their obligations under the Ordinance. While the CoP is not subsidiary legislation – meaning non-compliance itself does not automatically constitute an offence – the Commissioner may issue directions requiring CI Operators to take appropriate action in relation to compliance, with failure to comply an offence under the Ordinance. Relevantly, the CoP sets out baseline requirements for protecting CCSs, clarifying that it is not intended to target personal data or trade secrets of CI Operators. It should also be noted that the CoP is not related to any specific sector. CI Operators need to be aware that subsequent sectoral Codes of Practice may be issued by designated authorities, such as the Hong Kong Monetary Authority, and these should be referred to where applicable. Overview of the CoP The CoP is organised into sections covering the following areas: Designation of CCSs and information required for designation (Section 3 – 4 of CoP). Obligations of CI Operators, namely: Category 1 obligations to: maintain office in Hong Kong; notify operator changes; and set up and maintain a computer-system security management unit (Section 5 of CoP); Category 2 obligations to: notify material changes to certain computer systems; submit and implement computer-system security management plan; conduct computer-system security risk assessments; arrange to carry out computer-system security audits; and security measures for operational technology (Section 6 of CoP); and Category 3 obligations to: participate in computer-system security drills; submit and implement an emergency response plan; and notify authorities of computer-system security incidents within strict time frames (Section 7 of CoP). Annexures with template forms for notifications and compliance: Notifying office address Notifying changes of CI Operators Notifying appointment of employee supervising CSS Management Unit Notifying material changes to certain computer systems Notifying computer-system security incident Written report for computer-system security incidents Outline methodology for computer-system security audit required under section 25 of the Ordinance Sample contract clauses for external service providers Practical implications for CI Operators While CI Operators should observe all applicable requirements under the CoP, some key observations and practical implications include: Expanded and clarified criteria for CCS designation (sections 3.1.3-3.1.4 of CoP): Systems that play a material role in core CI function, storage or processing of sensitive digital data used directly in provision of essential services, or closely linked to other CCSs or CI Operators, are likely to be designated. The CoP specifies it is irrelevant whether a system is isolated from the internet or whether its core function could be switched to manual processing as a standby solution. This is particularly relevant to CI Operators of operational technology (OT) hardware and software. Importantly, the CoP makes clear that CCS security systems such as firewalls, security gateways, and intrusion prevention systems, as well as backup facilities and high-availability systems, are also included within the scope of designation. Why this matters: This expanded criteria is particularly significant for CI Operators utilising OT for critical functions, as this now falls under the scope of the CoP, which explicitly affirms that industrial control systems — including Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS) and Programmable Logic Controllers (PLC) — are considered “computer systems” under the Ordinance. Historically, industrial control systems relied on “air-gapping” or effective isolation from external networks as a natural security barrier. However, as industries embrace digital transformation, the convergence of OT and IT has become essential for monitoring operations and driving efficiency. This increased connectivity introduces new vulnerabilities, which the CoP acknowledges by removing internet isolation as a defence against designation. CI Operators must therefore recognise that legacy “air-gapped” environments or SCADA platforms are now squarely within the regulatory scope if they fulfil the critical functions defined in the Ordinance. Clarifying requirements of computer-system security management unit (sections 5.3 and 6.2 of CoP): CI Operators are required to set up and maintain a computer-system security management unit under the Ordinance. Although most organisations already have such a function, the CoP clarifies the necessity for a clear management structure in place for computer-system security, with lines of authority, roles and responsibilities of relevant personnel clearly set out. The CoP makes clear that such units need not be based in Hong Kong. The Ordinance also requires employees appointed to supervise the computer-system security management units to have “adequate professional knowledge in relation to computer-system security”. Examples of professional qualifications deemed appropriate include: Certified Information Security Professional (CISP), Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP). The CoP also provides a template form under Annex C for CI Operators to notify the Commissioner of such appointments. Why this matters: Beyond the administrative setup, the Computer-System Security Management Plan is of critical significance as it places duty on the Board of Directors (or a delegated sub-committee or senior management). This document is the linchpin for ensuring CI Operators fulfil their statutory obligations under Schedule 3 of the Ordinance. It serves as the operational roadmap for compliance, covering areas frequently identified as high-risk in cybersecurity cases (which is consistent with our experience), including: Risk Management Approach (Section 6.2.7 of CoP); Security by Design (Section 6.2.8 of CoP); Privileged Access Management (Section 6.2.11 of CoP); Patch Management (Section 6.2.17 of CoP); and Supply Chain Management (Section 6.2.25 of CoP). This plan must be endorsed by the Board of Directors (or a delegated sub-committee or senior management). This requirement is substantial as it places responsibility for the CI Operator’s security posture squarely at the feet of the Board, ensuring that cybersecurity is treated not just as an IT issue – but critical governance priority. Clarifying scope of computer-system security incidents (sections 7.3.2 – 7.3.4 of CoP): Usefully, the CoP clarifies that computer-system security incidents must involve access or acts without lawful authority that have an actual adverse impact on affected CCSs. This does not include incidents arising from pure technical failure, natural disasters, mass power outage, computer-system security threats that are promptly detected and removed or quarantined, or personal data breaches arising from human error. In addition, the CoP lists computer-system security incidents to include large-scale Distributed Denial of Service (DDoS) attacks causing degradation of an essential services, ransom DDoS attacks, ransomware attacks that causes suspension of an essential service or shows signs of data compromise and unintended external connection to a CCS caused by malware infection or by an adversary exploiting a vulnerability. Why this matters: It is critical for CI Operators to recognise the thresholds for when notification is to be triggered. A specific threat to launch an attack at a specified time, if likely to cause disruption or data leakage, is considered a “serious computer-system security incident”. This means the obligation to notify could be triggered even before an attack is executed. This has significant operational implications: Such threats must be notified to the Commissioner within 12 hours of the CI Operator becoming aware of them. CI Operators must therefore ensure their incident response protocols are sensitive enough to detect and escalate credible threats immediately, rather than waiting for the attack to materialise. Detailed obligation to submit and implement security management plans: CI Operators are required to develop, implement, and maintain comprehensive plans to protect the security of CCSs in accordance with Schedule 3 Part 1 of the Ordinance. Compliance should be ensured by fulfilling requirements stated under section 6.2.5-6.2.27, 6.3 to 6.5 of the CoP.  Key operational requirements include: Logging and retention: Logs of certain CCS activities such as log-on attempts, privileged access and changes to access rights must be retained for a minimum of six months. Assessment and audit: The plans must also provide for regular risk assessments and biennial audits, conducted by qualified professionals with appropriate certifications. Governance and training: The organisational structure, roles and responsibilities of personnel involved in CCS operations must be clearly defined, with ongoing training programmes established to ensure that all staff are aware of their security responsibilities. Supply chain management: CI Operators should ensure responsibility allocation with its suppliers is clearly defined and agreed in writing. The CoP provides some sample contract clauses for use with external service providers regarding liability for complying with the Ordinance (Annex H of the CoP). These clauses require the service providers / contractors to comply with the Ordinance, all applicable laws, and relevant codes of practice. Why this matters: “Living documentation”: Security management plans (and their related policies) should be considered as ‘living documents’. They need to be reviewed frequently and continually updated to reflect constantly evolving cybersecurity risks and even operational changes. Ripple effect on contractors: Contractors are made responsible for actions of their personnel and subcontractors, and contracts should clearly set out deliverables, service levels, and compliance expectations. Although the Ordinance only applies to designated CI Operators, it will have a ripple effect as there are consequences for third parties doing business with them. Clarifying participation in computer-system security drills (Section 7.1 of CoP): CI Operators will receive notification from the Commissioner to participate in computer-system drill assessing the validity and effectiveness of their emergency response plan, as well as participating personnel’s knowledge of their roles and responsibilities in security incident response. Drills will be required no more than once every two years. They may be in the form of tabletop exercise, functional exercise, simulated attack or by other means deemed appropriate by the Commissioner. The CoP states that CI Operator personnel required to participate include: management personnel, computer-system security management unit, emergency response team, public relations or corporate communications personnel and other personnel deemed necessary by drill scenario and CI Operator, such as cybersecurity insurer. CI Operators are also encouraged to include their nominated breach counsel in the drill.  Why this matters: Compliance and institutional readiness: This requirement formalises the testing of incident readiness, shifting it from internal best practice to regulatory obligation. Beyond satisfying the statutory requirement, these drills are essential for building institutional muscle memory. By mandating the involvement of non-technical stakeholders, the CoP reinforces the reality that cyber incident response is not solely an IT function but a critical business continuity issue involving reputation management and high-level decision making. Strengthening cohesion with external advisors: While the CoP lists cybersecurity insurers as potential participants, CI Operators are strongly encouraged to also include their nominated breach counsel or external legal advisors in these drills. Integrating legal counsel into the exercise is vital for practising how to establish and maintain legal professional privilege, manage liability exposure in real-time, and advise on legal issues arising from a breach. These are critical reflexes that must be honed in a simulated environment before a real crisis occurs to ensure the team is aligned on legal risks. Incident response and business continuity planning are also emphasised (Section 7.2 of CoP): The CoP places significant emphasis on preparedness, mandating that CI Operators maintain robust emergency response plans. These plans must set out clear protocols for responding to computer-system security incidents, specifically covering three key areas: Incident management: Procedures for detecting, analysing and containing incidents. Business continuity: Strategies to maintain essential functions during a disruption. Disaster recovery: Protocols for restoring data and systems to normal operation. Crucially, these plans should be endorsed by senior management. As with security management plans, they should also be reviewed regularly – particularly following material changes to CCSs – and in any case at least once every two years.  Why this matters: Tailored response is critical: There is no “one-size-fits-all” solution. Every emergency response plan must be carefully bespoke, dedicated specifically to ab organisation’s unique operational realities and risks. These plans also need to be tested through practising. From experience, incidents seldom unfold how the playbook expects. An unpractised plan is just a document; a practised plan is capability. Ready-to-Go communications: A critical component is the communications plan, mandated by the CoP for communicating with internal and external stakeholders. To ensure speed and accuracy during a crisis, this should include pre-approved, “ready-to-go” internal and external communication templates. Addressing the “Unwritten” gaps: While the CoP provides a baseline, prudent operators should go further. For example, the CoP does not explicitly mandate an out-of-band communications network, but having an alternative channel is vital if your primary infrastructure (such as the Active Directory) is compromised. Similarly, organisations should proactively develop their own internal ransom policy to guide decision making under pressure. Key takeaways The CoP introduces detailed operational standards that impact the governance, risk management and contractual arrangements of CI Operators. Beyond mere checklist compliance, the “practical implications” discussed here highlight several critical shifts in responsibility and strategy including: Board-level accountability: Cybersecurity is no longer solely an IT issue. The requirement for Board endorsement of the Computer-System Security Management Plan places responsibility for the CI’s security posture directly on senior leadership. Proactive threat reporting: The threshold for notification has lowered significantly. Credible threats must be reported within 12 hours, meaning operators must constantly monitor and escalate risks immediately, rather than waiting for an attack to materialise. Institutional readiness: Security drills are now a regulatory obligation, not just a best practice. These exercises should build “institutional muscle memory” and include non-technical stakeholders, including external breach/legal counsel to manage privilege and liability. Supply chain ripple effects: Security management plans must be treated as “living documents”, necessitating frequent updates that will inevitably impact third-party contractors through stricter contractual deliverables and liability clauses. Given the complexity and potential legal exposure, CI Operators are strongly encouraged to consult with relevant professionals to ensure they comply with the Ordinance and CoP. Early engagement with legal and technical advisors will help organisations navigate the new regulatory landscape, mitigate risks, and build resilience in the face of evolving cyber threats. It is expected there will also be sectoral codes published subsequently, so compliance will not always be limited to the CoP. JSM is well-placed to assist clients in their compliance journey with the Ordinance and CoP, leveraging our deep practical experience helping critical infrastructures navigate cybersecurity incidents and their legal exposure. We have a strong track record in conducting extensive incident response plan reviews and executive tabletop incident response workshops.