The Code of Practice does not add obligations. It explains how a designated operator is expected to demonstrate the three categories of obligation in the Ordinance: organisational, preventive, and incident response.
The three categories
| Category | What is expected |
|---|---|
| Organisational | A security management plan, named accountability, and staff competence. |
| Preventive | Documented controls, monitoring, and evidence that they operate. |
| Incident response | Detection, reporting routes and timescales, and tested response. |
What this means for you
The obligations fall on designated operators, not on business generally. But if you supply one, expect your own security posture to become a contractual requirement — and expect to be asked for evidence, not assurances.
Sources
OCCICS, Code of Practice Version 1.0, effective 1 January 2026 — occics.gov.hk
HKMA, sectoral Code of Practice for SVF licensees, 12 June 2026 — hkma.gov.hk
Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)