On March 19, 2025, Hong Kong SAR’s Legislative Council passed the Protection of Critical Infrastructures (Computer Systems) Bill (“CI Bill”). This is the city’s first dedicated law targeting cybersecurity for essential services. It aims to reduce the impact of cyber incidents on critical sectors and will come into effect on January 1, 2026.

For CI operators (CIO), the CI Bill is a clear regulatory mandate: build cyber resilience or risk fines of up to HK$5 million.

Who Must Comply: The Eight Designated Sectors

The CI Bill applies to organizations designated as Critical Infrastructure (CI) operators—entities responsible for ensuring the continuous delivery of essential services across eight key sectors: energy, information technology, banking and finance, maritime, land transport, air transport, healthcare, and communications. These organizations are now subject to specific cybersecurity obligations aimed at safeguarding Hong Kong’s core infrastructure.

If your organization operates in one of these sectors, it may be designated as a CI operator and become subject to comprehensive cybersecurity obligations.

CI Operator Compliance Checklist: Core Legal Requirements

CI operators must prepare to meet the following critical obligations under the CI Bill:

• Keep computer systems patched and updated
• Submit annual cybersecurity risk assessments
• Establish and maintain a local office in Hong Kong
• Report serious cybersecurity incidents within 12 hours

Outsourcing IT operations does not remove your legal responsibilities. CI operators remain fully accountable for compliance, even when third-party vendors are involved.

Why Proactive Defense Is Now Essential

Recent cyberattacks on Cyberport and the Investment Promotion Agency highlight that even major institutions can fall victim to cyber threats. These incidents emphasize the need for proactive, not reactive security.

The CI Bill raises the bar—organizations must prove their resilience through continuous risk assessments, drills, and testing.

Penetration Testing: A Compliance and Security Imperative

Penetration testing simulates real-world cyberattacks to identify system vulnerabilities before malicious actors exploit them.

For CI operators, penetration testing offers:

• Early detection of vulnerabilities
• Confirmation that patching and system hardening are effective
• Testing of incident response plans
• Support for demonstrating CI Bill compliance

Why Choose CyberServal for Penetration Testing in Hong Kong?

At CyberServal, we help critical infrastructure operators strengthen their defenses while aligning with the legal and technical expectations of the CI Bill.

We provide:

• CI Bill–compliant penetration testing services
• Actionable security assessments and remediation guidance
• Local expertise and guaranteed confidentiality

Whether you're preparing for designation, undergoing audits, or enhancing incident response, we offer real-world simulations that help you stay compliant and secure.

Contact CyberServal to assess your cyber risk exposure, improve response strategies, and build resilience ahead of regulatory deadlines.

How CyberServal Advanced DDR Adapt to the New Cyber Security Law?

Unified Security Platform: Traditional DLP tools are often siloed and complex, tracking only static data flows.  In contrast, modern DDR platforms integrate multiple protections (DLP, Information Rights Management, Endpoint Management) into a single system. Enterprises are moving toward such unified solutions to avoid “tool sprawl”.

Full Data Lifecycle Visibility: Next-gen DDR monitors data at rest, in use and in motion, linking content with user context.  This means every sensitive file – from creation to deletion – can be tracked. By combining content inspection with user and device context, DDR uncovers risky behavior that traditional DLP misses.

AI-Powered Detection: CyberServal’s DDR uses machine learning to improve accuracy.  Field tests show it generates 90% fewer false positives than legacy DLP.  Lower false alerts mean security teams save time and can focus on real threats.  This “AI advantage” also adapts as new data types (e.g. AI-model data, cloud files) emerge.

Lower Cost & Operational Efficiency: By consolidating functionality, DDR simplifies deployment and maintenance.  Compared to multiple point products (each requiring separate licenses and tuning), a unified DDR platform significantly lowers total cost of ownership.  It is designed for easy management by lean IT teams, ideal for SMEs that lack large security staffs.

Rapid Incident Response: With real-time detection and automated policy enforcement, DDR enables instant blocking or encryption of leaking data.  For example, if an employee attempts to send a confidential file externally, DDR can quarantine or shred the data on the spot. Such automation – often missing in legacy DLP – helps contain breaches immediately.

Finance & Fintech DLP Solutions

Hong Kong's banks and fintech companies deal with a huge amount of customer data. DDR can implement the Hong Kong Monetary Authority's "Mandatory TIBER - HK" and other guidelines by recording all cross - border data transfers and helping with auditing and compliance.

Manufacturing & Supply Chain DLP Solutions

Advanced manufacturers (such as those in semiconductors and machinery) need to protect their intellectual property across factories and supplier networks. DDR can be used in operational technology (OT) environments to protect design files and formulas. Government programs like the New Industrialisation Acceleration Scheme even offer subsidies for smart production upgrades, which can include better cybersecurity.

Cloud & SaaS Providers DLP Solutions

Tech and SaaS companies are both the ones making tools and the targets. Since data is spread across different cloud services (like Office 365, AWS, etc.), DDR's cloud agents and integration with cloud access security brokers (CASB) provide visibility. Companies can use grants from the Innovation and Technology Fund (ITF) or subsidies from the Digital Trading and Settlement Platform Pilot Programme (DTSPP) to speed up the adoption of secure cloud services.

Healthcare & Education DLP Solutions

Hospitals and schools in Hong Kong store sensitive personal information. DDR helps meet the requirements of the Personal Data (Privacy) Ordinance (PDPO) by classifying patient/student records and preventing unauthorized sharing. For example, the cost of encryption and redaction features can be covered by projects funded by the Innovation and Technology Fund.

Energy & Utilities DLP Solutions

Critical infrastructure (such as electrical grids) in the Greater Bay Area is facing new cyber threats. DDR can be part of a comprehensive security upgrade as the government funds Internet of Things (IoT) and smart city projects (like smart lampposts), where protecting data while it's being transferred is very important.

Discover how CyberServal’s next-gen Data Detection & Response (DDR) platform helps Hong Kong enterprises stay ahead of evolving data security threats. From AI content hijacking to supply chain breaches, the risks are growing—and traditional DLP isn’t enough. CyberServal combines DLP, IRM, and endpoint controls into one powerful, cost-effective system that tracks sensitive data across its full lifecycle with 90% fewer false positives. Whether you're in finance, manufacturing, SaaS, or healthcare, DDR is built for your industry.

Reference

• Full Version of the Bill: Protection of Critical Infrastructures (Computer Systems) Bill