Management Summary
- Purpose / Background: This Code of Practice, issued by the Monetary Authority (MA) under the *Protection of Critical Infrastructures (Computer Systems) Ordinance*, provides operational guidance for Stored Value Facility (SVF) licensees designated as Critical Infrastructure Operators (CIOs). It sets the baseline for securing "Critical Computer Systems" (CCSs) to ensure the resilience of essential financial services in Hong Kong.
- One-line conclusion: Designated SVF Licensees must formalize their cyber security governance, integrate the C-RAF (Cyber Resilience Assessment Framework) maturity requirements into their management plans, and conduct mandatory independent security audits and risk assessments.
- Key Changes:
- Explicit mandate to align security controls with the C-RAF maturity assessment matrix.
- Requirement to appoint/maintain a dedicated computer-system security management unit.
- Formalized obligations for material change notifications, specifically targeting deployments to production environments.
- Requirement to perform annual user privilege reviews and implement "Security by Design" across the System Development Life Cycle (SDLC).
- Enhanced supply chain risk management to mitigate over-dependence on individual vendors.
- Specific requirement for vulnerability assessments and penetration testing as part of security risk assessments.
- Key Dates / Deadlines:
- Ongoing: Immediate obligation to notify the MA of office changes and operator changes.
- Biannual: Mandatory review of the computer-system security management plan (at least every 2 years).
- Annual: Periodic user access re-certification (at least once per year).
- Retrospective: Logs must be retained for a minimum of 6 months.
- Applicability / Impact scope: This Code applies to all SVF Licensees formally designated by the MA as Critical Infrastructure Operators. It impacts IT infrastructure, core banking/SVF platforms, backup facilities, and any third-party systems directly supporting these essential functions.
- Recommended management actions:
- Gap Analysis: Map existing IT security policies against the C-RAF maturity assessment matrix and this Code.
- Governance Update: Ensure the Board or senior management formally endorses the "computer-system security management plan."
- Operational Review: Formalize the "Computer-System Security Management Unit" and ensure supervisors have appropriate certifications (e.g., CISSP, CISA).
- Compliance Reporting: Establish workflows for notifying the MA of "material changes" to production environments.
- Vendor Management: Review supply chain contracts to ensure audit rights and resilience in the event of vendor exit.
Detailed Summary
1) Document overview
- Nature: Sectoral Code of Practice issued by the HKMA.
- Purpose: To provide practical guidance on fulfilling statutory obligations under the *Protection of Critical Infrastructures (Computer Systems) Ordinance*.
- Scope: Designated SVF Licensees (CIOs). It sets baseline requirements for protecting CCSs and mandates specific security management, assessment, and audit processes.
2) Main requirements
- Governance: Must maintain an office in HK and a computer-system security management unit (need not be HK-based). The supervisor of this unit must hold professional qualifications (e.g., CISSP, CISM, CISA).
- Security Plan: Must submit and implement a management plan endorsed by the Board/senior management, reviewed at least every 2 years.
- Security Controls: Adoption of C-RAF maturity matrix across multiple domains: Asset Management, Access Control (including privileged access), Cryptography (data-at-rest/in-transit/in-use), Physical Security, and Network Security.
- Log Management: Logs of critical events (log-on attempts, privileged use, etc.) must be retained for 6 months and be tamper-proof.
3) Key changes (vs previous requirements)
- Formalization of the "material change" notification process for production deployments.
- Shift toward a risk-based "Security by Design" approach.
- Requirement for specific penetration testing and vulnerability assessments by qualified professionals.
- Strict requirement to manage supply chain and geopolitical risks regarding vendor availability.
4) Important dates & transition
- Standard review cycle: 2-year interval for the security management plan.
- Periodic activities: Annual user access reviews, continuous log retention (6 months).
- Immediate compliance upon designation.
5) Impact and risks
- Operational: Increased overhead for documentation, testing, and periodic audits.
- Compliance: Failure to comply with MA written directions related to this Code constitutes a statutory offence.
- IT: Systems must be "hardened," and privileged access management (PAM) must be strictly isolated and monitored.
6) Compliance action checklist
- [ ] Establish/Update Computer-System Security Management Plan and obtain Board approval.
- [ ] Identify and inventory all CCSs in coordination with the MA.
- [ ] Implement a formal "material change" notification workflow.
- [ ] Conduct annual vulnerability assessments and penetration tests using qualified third parties.
- [ ] Appoint an independent assessor for the biennial computer-system security audit.
- [ ] Implement secure logging (6-month retention) for all mandatory event categories.
7) Appendices/attachments summary
- Appendix 1: Provides specific technical requirements for access control (authentication/password rules), privileged IDs (monitoring/safeguarding), cryptography (key management), physical security (data centers/background checks), and system hardening (configuration documentation). It serves as a prescriptive checklist for the principles outlined in the main body.