Cybersecurity in Hong Kong 2026
PDPO, SFC Guidelines & HKMA Cyber Resilience

1. Executive Summary

Hong Kong occupies a unique position in the global cybersecurity landscape as a Special Administrative Region of China that maintains its own legal system, regulatory framework, and internet infrastructure under the "one country, two systems" principle. As one of the world's leading international financial centres, with over 160 licensed banks, 3,000+ licensed corporations under the SFC, and a stock exchange with market capitalization exceeding HK$30 trillion, Hong Kong presents an exceptionally high-value target for sophisticated cyber threat actors ranging from state-sponsored espionage groups to financially motivated cybercriminal organizations.

The cybersecurity market in Hong Kong reached an estimated HK$18.5 billion (approximately US$2.4 billion) in 2025, driven by intensified regulatory requirements from the HKMA, SFC, and Insurance Authority, the proposed Critical Infrastructure (Computer Systems) Bill moving through the Legislative Council, expanding cross-border data governance obligations under both the PDPO and mainland China's PIPL framework, and accelerating digital transformation across financial services, logistics, and professional services sectors. Year-over-year market growth stands at 14.2%, outpacing the broader Asia-Pacific average of 11.8%.

Hong Kong's regulatory approach to cybersecurity is characterized by a sector-specific model rather than a single unified cybersecurity law. The HKMA's Cyber Resilience Assessment Framework (C-RAF) governs banking, the SFC's cybersecurity circulars cover securities and asset management, the Insurance Authority's GL-20 addresses insurers, and the PDPO under the PCPD provides the overarching data protection framework. The proposed Critical Infrastructure Bill, if enacted as expected by mid-2026, will represent the first territory-wide statutory cybersecurity obligation, designating operators across eight sectors with mandatory security management, audit, and incident reporting requirements.

Despite significant investment and regulatory maturation, Hong Kong faces a cybersecurity talent shortage estimated at 8,000-10,000 professionals, an increasing complexity of cross-border data governance as Greater Bay Area integration deepens, and the challenge of maintaining cybersecurity standards across a business ecosystem dominated by small and medium enterprises that form the backbone of Hong Kong's trading and professional services economy.

2. Hong Kong's Cyber Threat Landscape

2.1 Threat Actor Landscape

Hong Kong's position as an international financial centre and gateway between mainland China and global markets creates a distinctive threat landscape. The territory faces persistent threats from multiple categories of adversaries. State-sponsored groups from various nations target Hong Kong's financial institutions for economic intelligence, its government systems for political intelligence, and its technology companies for intellectual property theft. HKCERT's annual threat assessment reported that advanced persistent threat (APT) activity targeting Hong Kong organizations increased by 37% between 2023 and 2025, with financial services, legal firms, and government agencies as primary targets.

Financially motivated cybercrime remains the highest-volume threat. Business Email Compromise (BEC) attacks are particularly prevalent given Hong Kong's role as a global trade and finance hub, with the Hong Kong Police Force (HKPF) reporting over HK$3.1 billion in losses from technology crimes in 2024. Ransomware groups increasingly target Hong Kong's professional services firms, trading companies, and logistics operators, exploiting the time-sensitive nature of these businesses to pressure rapid ransom payments. The HKPF's Cyber Security and Technology Crime Bureau (CSTCB) handled over 36,000 technology crime reports in 2024, a 28% increase over the previous year.

2.2 Financial Sector Threat Intelligence

Hong Kong's financial sector faces a sophisticated and persistent threat environment that reflects its systemic importance to global finance. Banking trojans and credential-harvesting campaigns specifically targeting Hong Kong banking customers surged in 2024, with HKMA reporting a 45% increase in unauthorized internet banking transactions attributed to phishing and social engineering. The proliferation of faster payment systems, particularly the Faster Payment System (FPS) and stored value facilities (SVFs), has created new attack surfaces that cybercriminals exploit through account takeover, authorized push payment (APP) fraud, and money mule networks.

The SFC noted an increase in cyber incidents targeting licensed corporations in 2024-2025, including intrusions at several asset management firms where attackers sought to exfiltrate client portfolio data and trading strategies. The virtual asset sector, which Hong Kong has actively promoted as part of its fintech hub strategy, has attracted targeted attacks against licensed virtual asset trading platforms (VATPs), with two significant breach attempts at VATP licensees detected and mitigated in 2025.

2.3 Threat Intelligence by Sector

3. PDPO: Personal Data (Privacy) Ordinance

3.1 Legislative Framework and Data Protection Principles

The Personal Data (Privacy) Ordinance (PDPO), Cap. 486 of the Laws of Hong Kong, is the territory's cornerstone data protection legislation. Enacted in 1996 -- making it one of the earliest comprehensive data protection laws in Asia -- the PDPO is administered and enforced by the Privacy Commissioner for Personal Data (PCPD), an independent statutory body established under the ordinance. The PDPO has been amended several times, with the most significant updates in 2012 (strengthening direct marketing provisions and introducing DPP penalties) and 2021 (adding anti-doxxing provisions with criminal sanctions).

The PDPO is structured around six Data Protection Principles (DPPs) that form the foundation of all data handling obligations in Hong Kong:

3.2 PCPD Enforcement and Penalties

The PCPD enforces the PDPO through investigations (initiated by complaint or proactively), compliance checks, and the issuance of enforcement notices. As of 2025, the PCPD has investigated over 2,500 cases involving data breaches, unauthorized data access, and improper data handling practices. Contravention of an enforcement notice constitutes a criminal offense punishable by a fine of HK$50,000 and imprisonment for 2 years. The 2021 anti-doxxing amendments introduced significantly enhanced penalties: disclosure of personal data with intent to cause specified harm (doxxing) carries a maximum penalty of HK$1 million fine and 5 years imprisonment.

The PCPD has been increasingly active in its enforcement posture. In 2024-2025, the PCPD conducted 147 compliance inspections, issued 38 enforcement notices, and published 12 investigation reports. Notable enforcement actions include investigations into data breaches at Cathay Pacific (affecting 9.4 million passengers, though the breach occurred earlier), multiple fintech companies for inadequate data security practices, and government departments for unauthorized sharing of personal data. The PCPD has proposed amendments to the PDPO that would introduce mandatory data breach notification within 5 business days, administrative fines for serious contraventions, and explicit data processor obligations.

3.3 PDPO vs. GDPR vs. China PIPL Comparison

4. HKMA Cyber Resilience Assessment Framework

4.1 C-RAF Overview and Structure

The Hong Kong Monetary Authority (HKMA) introduced the Cyber Resilience Assessment Framework (C-RAF) in November 2016, establishing a structured approach for authorized institutions (AIs) -- which include licensed banks, restricted licence banks, and deposit-taking companies -- to assess and enhance their cyber resilience. C-RAF was developed in consultation with the financial industry and draws upon international standards including the NIST Cybersecurity Framework, FFIEC Cybersecurity Assessment Tool, and the G7 Fundamental Elements for Cybersecurity in the Financial Sector.

C-RAF comprises three interconnected components: the Inherent Risk Assessment, which evaluates an institution's risk exposure based on factors including technologies adopted, delivery channels, organizational characteristics, and external threat landscape; the Maturity Assessment, which evaluates the institution's cybersecurity capabilities across defined control domains; and the Intelligence-led Cyber Attack Simulation Testing (iCAST), which validates defensive capabilities through realistic attack simulations conducted by approved red team providers.

4.2 C-RAF Control Domains

4.3 iCAST: Intelligence-led Cyber Attack Simulation Testing

The HKMA's iCAST program, modeled on the Bank of England's CBEST and the European Central Bank's TIBER-EU frameworks, requires systemically important banks in Hong Kong to undergo realistic, intelligence-led cyberattack simulations. Unlike conventional penetration testing, iCAST engages specialized threat intelligence providers to develop bespoke attack scenarios based on the specific threat landscape facing the target institution, followed by controlled red team operations that test the institution's detection and response capabilities across people, processes, and technology.

iCAST engagements are conducted by HKMA-approved service providers and follow a structured methodology: threat intelligence gathering and attack scenario development (4-6 weeks), red team execution simulating realistic threat actor TTPs (6-8 weeks), blue team assessment evaluating defensive detection and response (concurrent), and a comprehensive debrief with remediation planning (2-4 weeks). As of 2025, all Category 1 institutions (major retail banks with significant digital operations) have completed at least two iCAST cycles, with the HKMA expanding the requirement to Category 2 institutions and significant fintech entities from 2026.

4.4 Technology Risk Management (TRM) Module

The HKMA's Supervisory Policy Manual TM-E-1 (Risk Management of E-banking) and TM-G-1 (General Principles for Technology Risk Management) establish foundational requirements for technology and cybersecurity governance at authorized institutions. The TRM framework covers IT governance and strategy, IT infrastructure security, information security management, IT outsourcing and vendor management, business continuity management, technology audit, and emerging technology risk management including cloud computing, API banking, and artificial intelligence.

The HKMA updated TRM guidance in 2024 to address cloud-first strategies adopted by Hong Kong banks, with specific requirements for multi-cloud risk management, data sovereignty considerations, cloud exit planning, and security monitoring of cloud-native architectures. The updated guidance also addresses API security requirements aligned with the Open API Framework that the HKMA has promoted since 2018, requiring banks to implement OAuth 2.0 authentication, rate limiting, data classification for API-exposed information, and continuous API security monitoring.

5. SFC Cybersecurity Guidelines

5.1 Regulatory Framework for Licensed Corporations

The Securities and Futures Commission (SFC) regulates cybersecurity for licensed corporations (LCs) through a combination of statutory requirements under the Securities and Futures Ordinance (SFO), codes of conduct, and specific circulars. The foundational cybersecurity requirements are established in the SFC's Code of Conduct for Persons Licensed by or Registered with the SFC, General Principle 10 (Compliance) and paragraph 12.5 (IT Risk Management), supplemented by targeted circulars that provide detailed implementation guidance.

Key SFC cybersecurity circulars include the October 2019 Circular to All Licensed Corporations on Cybersecurity, the 2020 Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading, the 2022 Circular on Operational Resilience, and the 2024 Circular on Cybersecurity for Virtual Asset Activities. These circulars establish a comprehensive set of requirements including two-factor authentication for all client-facing systems, data loss prevention controls, regular penetration testing by independent assessors, cybersecurity incident response plans, 24-hour material incident reporting to the SFC, and annual cybersecurity reviews conducted by qualified assessors.

5.2 Internet Trading Security Requirements

The SFC's internet trading security requirements address specific risks arising from the high volume and velocity of electronic securities trading in Hong Kong. Licensed corporations operating internet trading systems must implement multi-factor authentication for client login and transaction authorization, session management controls including automatic timeout and device binding, real-time transaction monitoring with anomaly detection for unusual trading patterns, secure communication channels (TLS 1.2 minimum) for all client-facing applications, and client notification mechanisms for login attempts and transaction confirmations.

The SFC conducts thematic reviews of internet trading security on a biennial cycle, with the 2024-2025 review focusing on mobile trading application security, API-based trading platform vulnerabilities, and the adequacy of client asset segregation controls in automated trading environments. Findings from thematic reviews are communicated to the industry through circulars and incorporated into updated compliance expectations.

5.3 Virtual Asset Trading Platform Requirements

Following Hong Kong's adoption of the licensing regime for virtual asset trading platforms (VATPs) under the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) in June 2023, the SFC established comprehensive cybersecurity requirements for VATP licensees. These include requirements for hot wallet / cold wallet segregation with minimum 98% cold storage for client assets, multi-signature transaction authorization for all wallet operations, real-time blockchain transaction monitoring, smart contract audit requirements before listing any tokenized product, and insurance or compensation arrangements covering at least 50% of client virtual assets held in cold storage.

6. Insurance Authority GL-20 Cybersecurity

6.1 Guideline GL-20 Requirements

The Insurance Authority (IA) issued Guideline on Cybersecurity (GL-20) in September 2019, establishing baseline cybersecurity requirements for all authorized insurers operating in Hong Kong. GL-20 recognizes that insurers hold vast quantities of sensitive personal and financial data, making them attractive targets for cybercriminals. The guideline requires a risk-based approach to cybersecurity governance, aligned with international frameworks including NIST CSF and ISO 27001.

GL-20's core requirements mandate that authorized insurers establish a cybersecurity governance framework with board-level responsibility and a designated Chief Information Security Officer (CISO) or equivalent; conduct comprehensive cyber risk assessments at least annually; implement multi-layered technical controls including network segmentation, endpoint protection, encryption, and access management; maintain a documented cybersecurity incident response plan tested through regular exercises; manage third-party cybersecurity risks through contractual requirements and ongoing monitoring; and report material cybersecurity incidents to the IA within 72 hours.

6.2 InsurTech Cybersecurity Considerations

Hong Kong's growing InsurTech ecosystem, supported by the IA's regulatory sandbox and the Fast Track approval process for purely digital insurers, introduces additional cybersecurity considerations. Digital insurers, which rely entirely on online distribution and cloud-native architectures, must demonstrate robust cybersecurity controls as part of their authorization application. The IA conducts enhanced cybersecurity assessments for InsurTech applicants, evaluating cloud security architecture, API security, mobile application security, and the adequacy of cybersecurity staffing relative to the technology-intensive business model.

7. GovCERT.HK & HKCERT Operations

7.1 GovCERT.HK: Government Cyber Defense

The Government Computer Emergency Response Team Hong Kong (GovCERT.HK), operating under the Office of the Government Chief Information Officer (OGCIO), serves as the cybersecurity nerve center for Hong Kong's government digital infrastructure. GovCERT.HK monitors and protects government networks spanning over 80 bureaux and departments, operates a 24/7 Security Operations Center (SOC), coordinates incident response for government cyber incidents, and provides security advisory services to government agencies.

GovCERT.HK's capabilities include real-time network monitoring across the Government Backbone Network (GNET), which interconnects government offices territory-wide; threat intelligence gathering and analysis through partnerships with international CERT organizations including APCERT (Asia Pacific Computer Emergency Response Team), FIRST (Forum of Incident Response and Security Teams), and bilateral agreements with national CERTs in key partner nations; vulnerability scanning and penetration testing of government-facing web applications and services; and coordination of the annual government-wide cybersecurity exercise (Exercise CyberShield) that tests incident response across government departments.

7.2 HKCERT: Territory-Wide Cybersecurity Coordination

The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT), established in 2001 and operated by the Hong Kong Productivity Council (HKPC), serves as the territory's primary CERT for the private sector and general public. HKCERT is funded by the government through the OGCIO and provides its services free of charge. In 2025, HKCERT handled over 12,000 security incident reports, with phishing (42%), malware (23%), ransomware (14%), and web defacement (8%) as the most prevalent categories.

HKCERT's operational functions include incident response coordination for organizations reporting cyber incidents, vulnerability alerting through advisories and alerts published in both English and Chinese, security best practice guidance through the Cybersec Infohub portal, coordination of the annual Cyber Security Awareness Month campaign, and participation in international incident coordination through APCERT and FIRST networks. HKCERT also operates the Cybersecurity Fortification Initiative (CFI) in partnership with HKMA, providing a structured framework for organizations to assess cybersecurity readiness and engage qualified service providers.

7.3 OGCIO Cybersecurity Governance

The OGCIO publishes the Practice Guide for ICT Security (ISPG) series, which establishes mandatory cybersecurity standards for all government bureaux and departments. The ISPG framework encompasses over 40 individual practice guides covering topics from password management and email security to cloud security and mobile device management. Government departments are required to conduct annual IT security audits against ISPG requirements, with findings reported to the OGCIO's Information Security Management Committee.

The government's cybersecurity budget has increased significantly in recent years, from HK$1.8 billion in FY2022-23 to HK$2.7 billion in FY2025-26, reflecting both enhanced threat awareness and the expanding digital government footprint. Key investments include the migration of government systems to hybrid cloud infrastructure with enhanced security controls, implementation of zero-trust architecture across government networks, and deployment of AI-powered threat detection and response capabilities across GovCERT.HK operations.

8. Critical Infrastructure Protection Bill

8.1 Legislative Background

The Protection of Critical Infrastructures (Computer Systems) Bill, introduced to the Legislative Council in 2024, represents Hong Kong's first comprehensive statutory framework for critical infrastructure cybersecurity. Prior to this legislation, critical infrastructure protection relied on sector-specific regulations (HKMA for banking, SFC for securities, etc.) and voluntary guidelines, leaving several critical sectors without binding cybersecurity obligations. The bill was prompted by increasing global cyber threats to critical infrastructure, high-profile incidents including the Colonial Pipeline attack in the US and port disruptions in other jurisdictions, and recommendations from both the OGCIO and international advisory bodies.

8.2 Designated Sectors and Requirements

The bill proposes eight designated critical infrastructure sectors, each overseen by a designated authority responsible for supervising cybersecurity compliance:

Designated critical infrastructure operators (CIOs) would be required to establish and maintain a computer system security management plan approved by the designated authority; conduct security audits at least annually by approved assessors; report significant cybersecurity incidents to the designated authority within 2 hours of detection and submit detailed incident reports within 14 days; participate in government-led cybersecurity exercises; and designate a responsible officer for cybersecurity compliance. Non-compliance penalties proposed in the bill include fines of up to HK$5 million for operators and HK$500,000 for individual responsible officers.

9. Fintech & Virtual Asset Cybersecurity

9.1 Hong Kong as a Fintech Hub

Hong Kong has positioned itself as a leading fintech and virtual asset hub in Asia, with over 800 fintech companies operating in the territory, supported by regulatory sandboxes from the HKMA, SFC, and IA. The cybersecurity implications of this fintech ecosystem are significant: digital-native financial services inherently expand the attack surface, API-driven open banking creates new integration vulnerabilities, and the speed-to-market pressure on fintech startups can lead to security being deprioritized in favor of feature development.

The HKMA's Open API Framework, which promotes API connectivity between banks and third-party service providers, has been implemented across four phases from 2019 to 2024. Phase IV, covering transaction and account management APIs, requires robust OAuth 2.0 implementation, mutual TLS authentication, API gateway security controls, and real-time monitoring of API traffic for anomalous patterns. The HKMA conducts targeted assessments of banks' open API security as part of its regular supervisory cycle.

9.2 Virtual Asset Regulatory Cybersecurity

Hong Kong's virtual asset trading platform (VATP) licensing regime, effective June 2023, established some of the world's most comprehensive cybersecurity requirements for cryptocurrency exchanges. Licensed VATPs must maintain a minimum 98% cold storage ratio for client virtual assets, implement multi-signature (minimum 3-of-5) authorization for all cold wallet transactions, conduct annual penetration testing and smart contract audits by SFC-approved assessors, maintain real-time blockchain surveillance for sanctions compliance and suspicious transaction detection, and carry insurance covering at least 50% of cold-stored client assets with reputable insurers.

10. Cross-Border Data Flows & GBA Integration

10.1 The Cross-Border Data Challenge

Hong Kong's unique position under "one country, two systems" creates complex cross-border data governance challenges. Organizations operating in Hong Kong frequently need to transfer personal and business data to mainland China (and vice versa), but must navigate two fundamentally different legal regimes: Hong Kong's common law-based PDPO and mainland China's comprehensive data governance framework comprising the PIPL, Data Security Law (DSL), and Cybersecurity Law (CSL). The divergence in legal requirements, enforcement approaches, and government access provisions creates significant compliance complexity.

10.2 Greater Bay Area Data Transfer Facilitation

The Greater Bay Area (GBA) Standard Contract for Cross-boundary Flow of Personal Information within the GBA, piloted from 2024, represents a landmark development in facilitating data flows between Hong Kong and GBA cities including Shenzhen, Guangzhou, Dongguan, Foshan, Zhuhai, and others. The mechanism establishes simplified procedures for personal data transfers within the GBA, with data exporters and importers executing standard contractual clauses that incorporate protections from both the PDPO and PIPL.

Key parameters of the GBA data transfer mechanism include volume thresholds (applicable to transfers involving fewer than 100,000 individuals' data annually), sector limitations (initially covering banking, healthcare, and professional services), and mandatory security measures including encryption in transit and at rest, access logging, and annual compliance assessments. The mechanism is administered jointly by the PCPD and the Cyberspace Administration of China's Guangdong branch, with a joint dispute resolution mechanism for data protection complaints arising from cross-boundary transfers.

10.3 Practical Compliance Framework

Organizations operating across the Hong Kong-mainland China boundary should implement a comprehensive data transfer governance framework addressing: data classification and mapping of all cross-border data flows; assessment of applicable legal bases under both PDPO and PIPL for each transfer; implementation of appropriate transfer mechanisms (GBA standard contract, PIPL security assessment, or PIPL standard contractual clauses depending on data volume and type); technical safeguards including end-to-end encryption, pseudonymization where feasible, and access controls limiting data access to authorized personnel; and documentation of transfer impact assessments and compliance records for regulatory review.

11. Cloud Security & Government Adoption

11.1 Cloud Adoption Landscape

Hong Kong's cloud computing market has matured rapidly, with enterprise cloud adoption rates exceeding 82% as of 2025. The territory hosts major cloud availability zones from AWS (Hong Kong Region), Microsoft Azure (East Asia), Google Cloud (Hong Kong), Alibaba Cloud, and Tencent Cloud, reflecting demand from both international enterprises using Hong Kong as their Asia-Pacific hub and mainland Chinese companies accessing international cloud services through Hong Kong. This dual-facing cloud infrastructure creates unique cybersecurity considerations around data residency, jurisdictional access, and multi-cloud governance.

The OGCIO's Government Cloud strategy has driven significant adoption of cloud services across government departments, with a cloud-first policy effective from 2020. The government utilizes a hybrid cloud model combining a Government Community Cloud (GCC) operated by approved local providers with public cloud services from hyperscalers. All government cloud deployments must comply with the OGCIO's Cloud Security Supplementary Guide, which mandates data classification-based controls, encryption of government data at rest and in transit, CASB (Cloud Access Security Broker) deployment, and regular security assessments by approved cloud security assessors.

11.2 Financial Sector Cloud Guidelines

The HKMA issued specific cloud computing guidelines for authorized institutions in its Supervisory Policy Manual module SA-2, requiring banks to conduct thorough risk assessments before cloud adoption, implement strong contractual arrangements addressing data access, audit rights, and exit provisions, ensure cloud-hosted data remains accessible to the HKMA for supervisory purposes, and maintain operational resilience through multi-region deployment and cloud exit planning. The SFC's 2023 cloud guidance for licensed corporations similarly requires robust vendor due diligence, data classification-based cloud deployment decisions, and regular security assessments of cloud environments.

12. Healthcare Cybersecurity

12.1 Hospital Authority Cybersecurity Framework

The Hospital Authority (HA), which manages Hong Kong's 43 public hospitals and 49 specialist outpatient clinics serving approximately 80% of inpatient care, operates one of the territory's most extensive digital health infrastructures. The HA's Clinical Management System (CMS) contains electronic health records for over 10 million patients, making it a high-value target for cybercriminals and requiring robust cybersecurity protections. The HA maintains a dedicated Cybersecurity Operations Center (CSOC) that monitors clinical systems, administrative networks, and medical devices across all HA facilities.

The Electronic Health Record Sharing System (eHRSS), operated by the government since 2016, enables the sharing of patient health records between public and private healthcare providers with patient consent. Cybersecurity for eHRSS includes end-to-end encryption, role-based access with healthcare professional authentication through the Electronic Health Record Registration Board, comprehensive audit logging, and strict data minimization principles ensuring only clinically necessary information is shared.

12.2 Medical Device Cybersecurity

The Department of Health (DH) has issued guidance on cybersecurity requirements for connected medical devices following the international IMDRF framework. Medical device suppliers seeking registration in Hong Kong must submit cybersecurity risk assessments for connected devices, demonstrate vulnerability management and coordinated disclosure capabilities, and maintain software bill of materials (SBOM) documentation. The HA's medical device procurement standards include cybersecurity evaluation criteria, with particular attention to device network segmentation, default credential management, and encryption of patient data transmitted by medical devices.

13. Smart City Cybersecurity

13.1 Smart City Blueprint and Cyber Implications

Hong Kong's Smart City Blueprint 2.0, published in 2020 with implementation ongoing through 2026, outlines over 130 smart city initiatives spanning smart mobility, smart living, smart environment, smart people, smart government, and smart economy. Each initiative introduces new cybersecurity considerations as IoT sensors, AI systems, and interconnected platforms expand the territory's digital attack surface. Key smart city cyber risks include IoT device compromise (estimated 15+ million IoT devices deployed across Hong Kong by 2025), data privacy implications of pervasive sensing and monitoring, and the resilience of AI-driven decision systems to adversarial attacks.

The OGCIO's IoT Security Guidelines, published in 2023, establish minimum security requirements for IoT deployments in government and public infrastructure projects. Requirements include secure boot and firmware integrity verification, encrypted communications (TLS 1.3 minimum for IP-based devices), centralized device identity and lifecycle management, network segmentation isolating IoT devices from core IT networks, and regular vulnerability scanning and patch management for all connected devices.

14. Supply Chain & Third-Party Risk

14.1 Third-Party Risk Management in Financial Services

Hong Kong's financial regulators have placed increasing emphasis on third-party and supply chain cybersecurity risk. The HKMA's TRM module requires authorized institutions to maintain comprehensive vendor risk management programs covering all material outsourcing arrangements, with specific cybersecurity due diligence, contractual requirements, and ongoing monitoring obligations. The 2024 HKMA circular on operational resilience further emphasized concentration risk management, requiring banks to assess and mitigate dependencies on common third-party service providers, cloud platforms, and technology vendors.

The SFC's outsourcing requirements for licensed corporations mandate that cybersecurity responsibilities remain with the licensed entity regardless of outsourcing arrangements, requiring firms to maintain oversight capabilities, conduct regular assessments of service provider security controls, and ensure contractual provisions for audit access, incident notification, and data protection. The SFC has conducted targeted inspections of licensed corporations' vendor management practices, resulting in several enforcement actions against firms with inadequate third-party cybersecurity oversight.

14.2 Supply Chain Security for Trading Companies

Hong Kong's status as one of the world's busiest trading hubs creates unique supply chain cybersecurity challenges. Trading companies, logistics operators, and freight forwarders handle sensitive commercial data including bills of lading, letters of credit, and customs documentation that are high-value targets for BEC attacks and supply chain fraud. The Hong Kong Trade Development Council (HKTDC) and HKPC have published supply chain cybersecurity guidelines encouraging adoption of electronic trade documentation with digital signatures, secure communication platforms for trade finance transactions, and cybersecurity awareness training specifically addressing trade-related fraud typologies.

15. Cybersecurity Talent Shortage

15.1 Scale and Impact

Hong Kong faces a cybersecurity talent shortage estimated at 8,000-10,000 professionals as of 2025, representing a significant constraint on both the territory's cybersecurity posture and its aspirations as a technology and financial hub. The shortage is particularly acute in specialized areas including threat intelligence analysis, incident response, cloud security architecture, and OT/ICS security. Financial sector regulators have noted that the talent shortage contributes to compliance gaps, with smaller licensed corporations struggling to recruit and retain qualified cybersecurity personnel.

15.2 Government Workforce Development Initiatives

16. Compliance Frameworks & Certifications

16.1 Regulatory and Certification Landscape

Hong Kong's cybersecurity compliance landscape reflects its position as an international business centre with strong alignment to global standards combined with sector-specific local requirements. The absence of a unified cybersecurity certification scheme means organizations typically pursue internationally recognized certifications to demonstrate security capabilities.

16.2 Professional Certifications

International cybersecurity certifications are widely recognized in Hong Kong's labor market. CISSP (ISC2) remains the most sought-after credential for senior cybersecurity roles, with approximately 1,800 CISSP holders in Hong Kong as of 2025. CISM (ISACA) is particularly valued in the financial sector for its governance focus, while OSCP (Offensive Security) and GIAC certifications are preferred for technical penetration testing and incident response roles. The HKMA's ECF-C program provides sector-specific competency benchmarks that map to these international certifications, guiding professional development pathways for financial sector cybersecurity practitioners.

17. Frequently Asked Questions