With significant obligations and penalties (from HKD 300,000 up to HKD 5 million plus daily penalty for a continuing offence), potential CIOs and service providers should watch this space closely for further developments and undertake suitable preparatory work, such as assessing the likelihood of designation, readiness of its existing cybersecurity framework and organizational structure for compliance and contractual provisions for risk allocation and mitigation.
Key takeaways
The draft provides much-needed clarity on various aspects of the legislative framework, particularly regarding the process of designation of CIOs and CSSs, as well as compliance standards. Organizations are recommended to conduct self-assessments to determine the likelihood of being designated by the Regulating Authorities. We are able to assist with assessments of the likelihood of an individual infrastructure or operator being regarded as a CI or a CIO, respectively.
For organizations with a higher likelihood of being designated, it is advisable to consider their existing cybersecurity framework in order to ensure compliance with the three categories of obligations, and to start formulating the required CCS management plans and/or emergency response plans in accordance with the requirements outlined in Schedule 3 of the Bill. This is especially important for multi-nationals facing competing obligations under different legal regimes (e.g., the EU’s NIS2 Directive) and organizations subject to additional sector-specific regulations. We are able to assist with drafting such plans and revising them once the COPs are available.
Potential CIOs and customers that rely on CIs should review existing supplier contracts in light of the Bill to ensure sufficient protection, especially for provisions relating to compensation, audit rights, service levels and termination. Third party service providers (e.g., cloud providers) may expect that their CIO customers would attempt to flow down certain obligations under the Bill, given the liability of CIOs in relation to CIs.
Particularly for companies with interconnected computer systems located outside of Hong Kong, it is important to consider whether computer system accessibility limitations need to be imposed, as much of the Bill’s obligations depend on accessibility rather than geographical location or control.
Click here to access the full alert.
* * * * *
Jacqueline Wong, Knowledge Lawyer, has contributed to this legal update.
