Hong Kong issues Code of Practice under the Protection of Critical Infrastructures (Computer Systems) Ordinance

Hong Kong issued a Code of Practice under the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), with the Office of the Commissioner of Critical Infrastructure (Computer-system Security) issuing the CoP on 1 January 2026, the same day it came into force.

According to Mayer|Brown, the CoP translates the high-level obligations under the Ordinance into specific, actionable requirements for critical infrastructure operators (CIOs), clarifying scope and governance expectations and shifting from principles to implementation. On the same date, the Hong Kong Government appointed Mr.

Francis Chan Wing-on, former Chief Superintendent of the Cyber Security and Technology Crime Bureau of the Hong Kong Police Force, as Commissioner of Critical Infrastructure (Computer-system Security) for a three-year term. The CoP is not subsidiary legislation, and non-compliance with it does not itself constitute an offence; however, the Commissioner may issue written directions with reference to the CoP’s requirements, and failure to comply with such directions is an offence.

In practice, the CoP will serve as a compliance handbook against which CIOs can benchmark their cybersecurity governance and controls, providing a central reference point for supervisory expectations and enforcement directions addressing non-compliance.