The government has introduced new legislation aimed at bolstering cybersecurity for critical infrastructures in Hong Kong. Under the proposed framework, operators of facilities such as banks, railway systems, and electricity suppliers will be required to report cybersecurity incidents or face fines of up to HK$5 million.
According to a paper submitted to the Legislative Council by the Security Bureau, critical infrastructures are defined as facilities essential for the normal functioning of Hong Kong society. These include facilities delivering essential services in sectors such as energy, information technology, banking, and healthcare, as well as other infrastructures crucial for societal and economic activities.
To oversee compliance, a new commissioner’s office will be established under the Security Bureau. Operators will need to establish a computer system security management unit, conduct regular security assessments and audits, and report serious incidents promptly.
Security minister Chris Tang emphasized that the legislation is aimed at organizations rather than individuals and will not impede internet usage. The proposal will be discussed in a security panel meeting on July 2, followed by a month-long consultation period. The Security Bureau aims to present the bill to Legco by the end of the year.