[Home](/)/[Resources](/resources)/HK Critical Infrastructure Cybersecurity Hong KongCybersecurity guide # Hong Kong PCICO: Critical Infrastructure Cybersecurity and Hardware Supply Chains Hong Kong's Protection of Critical Infrastructures (Computer Systems) Ordinance (PCICO), enacted in 2024, imposes statutory cybersecurity obligations on operators in eight critical sectors. While direct obligations fall on CI operators, the law's supply chain security requirements mean electronics hardware suppliers into Hong Kong's energy, financial, transport, and healthcare sectors will face escalating procurement security requirements as operators build PCICO compliance programmes. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fhong-kong-critical-infrastructure-cybersecurity) At a glance Law PCICO (2024) Sectors 8 critical sectors Enforcer Commissioner of Police Supply chain Indirect obligations on suppliers ## PCICO and electronics hardware supply chains ### Hong Kong's Protection of Critical Infrastructures (Computer Systems) Ordinance The Protection of Critical Infrastructures (Computer Systems) Ordinance (PCICO), enacted in 2024, is Hong Kong's first dedicated legislation establishing cybersecurity obligations for operators of critical infrastructure (CI). Modelled in part on similar frameworks in Singapore (CCA), Australia (SOCI Act), and UK (NIS), PCICO designates CI operators in eight sectors (energy, information technology, banking and financial services, land transport, aviation and maritime, healthcare services, communications, and broadcasting) and imposes proactive cybersecurity obligations on their computer systems. ### Obligations on CI operators and supply chain implications Designated CI operators under PCICO must: establish an internal computer security management unit; maintain a computer system security plan; conduct regular risk assessments and security audits; notify the Commissioner of Police of major security incidents within prescribed timelines; and comply with directions from the Commissioner in connection with security incidents. For electronics hardware companies supplying IT equipment, network hardware, industrial control systems, or IoT devices to Hong Kong CI operators, PCICO creates indirect obligations — CI operators are expected to address supply chain security as part of their security plans, which means supplier hardware scrutiny is increasing. ### Computer system security standards for CI The Commissioner of Police (as competent authority under PCICO) issues codes of practice and technical standards for CI computer systems. These standards address: access control, patch management, network segmentation, vulnerability management, incident response, and supply chain security for hardware and software used in CI computer systems. While the standards are primarily directed at CI operators, they directly affect the requirements that electronics hardware suppliers must meet when supplying into Hong Kong's critical infrastructure — procurement requirements and contractual obligations will increasingly reflect PCICO's underlying security standards. ### Intersection with Hong Kong's broader cybersecurity framework PCICO sits alongside the existing Hong Kong Office of the Government Chief Information Officer (OGCIO) cybersecurity framework, the Cybersecurity Fortification Initiative (CFI) for financial institutions (administered by HKMA), and sector-specific guidelines from the Communications Authority and HA for healthcare. Electronics companies supplying multiple Hong Kong regulated sectors need to understand the specific requirements of each sector's cybersecurity framework — while PCICO provides an overarching statutory CI framework, sector-specific guidelines often impose additional requirements beyond the PCICO baseline. ## Steps for electronics hardware suppliers into HK CI 01 Identify whether any of your electronics hardware customers in Hong Kong are designated CI operators under PCICO — if they are, your products and supply chain security practices will face heightened scrutiny through their PCICO compliance processes. 02 Review your product's security capabilities against the cybersecurity expectations for CI computer systems: patch management capabilities, access control features, network segmentation support, audit logging, and vulnerability disclosure processes are all relevant to CI procurement requirements. 03 Prepare product security documentation for Hong Kong CI customers: technical security specifications, vulnerability management policies, support and patching timelines, and any existing third-party security audit reports — CI operators need this documentation for their PCICO-required security risk assessments. 04 Assess your own internal cybersecurity posture if you are a critical vendor to CI operators — PCICO's supply chain security requirements create obligations on CI operators to manage their supplier security risks, which will translate into supplier assessment questionnaires, contractual security representations, and potentially right-to-audit clauses. 05 For products sold to Hong Kong financial institutions, also review HKMA Cybersecurity Fortification Initiative (CFI) requirements — financial sector CI operators face additional CFI-specific cybersecurity requirements beyond the PCICO baseline. 06 Monitor Commissioner of Police codes of practice and technical standards issued under PCICO — the operational details of CI computer system security requirements are set in these secondary instruments, which are updated as the threat landscape evolves. 07 Consider obtaining ISO/IEC 27001 certification for your organisation and IEC 62443 certification for industrial control system products — these internationally recognised standards increasingly satisfy CI operator supply chain security requirements in Hong Kong and other markets simultaneously. ## Frequently asked questions ### When did the PCICO come into force and what are the implementation timelines? The Protection of Critical Infrastructures (Computer Systems) Ordinance was passed by the Legislative Council and enacted in 2024, with a phased implementation timeline giving designated CI operators time to build internal security units and comply with security plan requirements. The initial designation of CI operators and the registration process were the first implementation steps. Compliance with security plan, audit, and incident reporting obligations follows the designated operators' registration with the Commissioner. Monitor the Security Bureau and Hong Kong Police Force cybersecurity division for current implementation status and compliance timelines. ### Does PCICO apply to electronics companies that are not CI operators themselves? PCICO's direct obligations fall on designated CI operators — electronics hardware companies that are not themselves designated CI operators do not have direct PCICO statutory obligations. However, the law has significant indirect effects: CI operators are required to address supply chain security as part of their PCICO computer system security plans, which means their procurement of IT equipment and hardware will increasingly include security requirements, supplier assessments, and contractual obligations that reflect PCICO standards. Suppliers who cannot demonstrate adequate security practices may find themselves excluded from CI supply chains. ### How does PCICO compare to similar frameworks in Singapore and Australia? PCICO is broadly similar in structure to Singapore's Cybersecurity Act (CCA) and Australia's Security of Critical Infrastructure Act (SOCI Act), all of which designate critical sectors and impose proactive cybersecurity obligations on CI operators. Key differences: Singapore's CCA was enacted earlier (2018) and has more established implementation; Australia's SOCI Act includes positive security obligations (PSOs) that are more prescriptive than PCICO; and Hong Kong's PCICO is enforced by the Commissioner of Police (a unique feature — most CI cybersecurity frameworks use civilian regulators). For electronics companies operating across all three markets, a unified CI supply chain security position covering all three frameworks is more efficient than three separate approaches. ### What incident reporting timelines apply under PCICO? PCICO requires CI operators to report major security incidents to the Commissioner of Police within prescribed timelines — the specific timelines are set in the Ordinance and codes of practice and are designed to enable rapid government response to significant CI cyber incidents. For electronics hardware suppliers, the indirect relevance is that if your hardware is implicated in a CI security incident at a Hong Kong CI operator, the operator must report it to police — and the supplier may be involved in the incident investigation. Having robust incident response capabilities and documented cooperation procedures for supplier-side investigations is important for CI-supply relationships. **Disclaimer:** Educational resource only. PCICO implementation details, codes of practice, and CI operator designation are subject to ongoing development. Consult a qualified Hong Kong cybersecurity law specialist for supply chain and product security compliance planning. 🇭🇰 Hong Kong roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇭🇰 Hong Kong compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/62-hong-kong-ofca-radio-equipment-certification)[Prefer to read? Get the book — $34.99](/books/62-hong-kong-ofca-radio-equipment-certification) Related guides * [HK Noise Control OrdinanceHong Kong Noise Control Ordinance (Cap 400) for electronics: EPD neighbourhood noise enforcement, ISO 7779/ISO 9296 IT equipment noise measurement, acoustic design for Hong Kong's dense urban environment, and abatement notice exposure for noisy electronic equipment.](/guides/hong-kong-noise-control-ordinance) * [HK Radiation OrdinanceHong Kong Radiation Ordinance (Cap 303) for electronics: RPS licensing for XRF analysers, industrial X-ray inspection systems, and analytical CT — controlled irradiating apparatus import licences, technical documentation requirements, and OFCA RF type approval framework.](/guides/hong-kong-radiation-ordinance) * [Australia Critical Infrastructure SecurityAustralia SOCI Act 2018 for electronics hardware suppliers: 11 critical sectors, Positive Security Obligations (PSOs), Critical Infrastructure Risk Management Programme supply chain hazard category, Systems of National Significance, and 12-hour serious incident reporting.](/guides/australia-critical-infrastructure-security) * [UAE Cybercrime IoT HardwareUAE Federal Decree-Law 34/2021 cybercrime law for IoT hardware: unauthorised access offences, TDRA type approval for connected devices, ETSI EN 303 645 alignment, UAE Personal Data Protection Law interaction, and criminal penalties for connected device security failures.](/guides/uae-cybercrime-iot-hardware) * [Hong Kong Cybersecurity Ordinance for ProductsHong Kong's Protection of Critical Infrastructures (Computer Systems) framework and what it means downstream for IoT suppliers, industrial control vendors, and connected hardware sold into critical sectors.](/guides/hong-kong-cybersecurity-ordinance-products)