HKMA sets statutory cyber code for designated payment system infrastructure operators
The Hong Kong Monetary Authority has published a sectoral Code of Practice under the Protection of Critical Infrastructures (Computer Systems) Ordinance for retail payment system infrastructure operators designated as critical infrastructure operators. It sets baseline requirements for protecting critical computer systems, from designation and governance through to risk assessment, penetration testing and logging. This segment covers what the Code binds, how it is enforced, and where it leans on existing frameworks.
- The Code binds Retail Payment System Infrastructure operators designated by the Monetary Authority as Critical Infrastructure operators.
- Breach of the Code is not itself an offence, but failure to comply with MA written directions, assessed against the Code, is an offence.
- Security management plans must be endorsed by the Board, a delegated sub-committee or senior management, and reviewed at least once every two years.
- System logs must be retained for a minimum of 6 months, secured so they cannot be deleted or altered, and user access rights reviewed at least annually.
- Risk assessments must include a vulnerability assessment and a penetration test conducted by qualified professionals.