Management Summary
- Purpose / Background: This Code of Practice is issued by the Monetary Authority (MA) under the *Protection of Critical Infrastructures (Computer Systems) Ordinance*. It provides mandatory operational guidance for Retail Payment System Infrastructure (RPSI) operators designated as Critical Infrastructure Operators (CI Operators) to ensure the security and resilience of their critical computer systems (CCSs).
- One-line conclusion: Designated RPSI operators must formalize their computer-system security management, implement rigorous risk assessment/audit frameworks, and align with C-RAF maturity standards to satisfy new statutory obligations under the Ordinance.
- Key Changes:
- Formal establishment of a "Computer-System Security Management Unit" with designated, qualified supervision.
- Requirement to submit and maintain a "Computer-System Security Management Plan" endorsed by the Board or senior management.
- Mandatory notification regime for "operator changes" and "material changes" to CCSs.
- Systematic alignment with Cyber Resilience Assessment Framework (C-RAF) maturity principles.
- New requirements for vulnerability assessments and penetration testing within risk assessments.
- Mandatory 6-month minimum retention for system security logs.
- Key Dates / Deadlines: Effective 15 October 2026. Ongoing: biennial review of the security management plan and periodic risk assessments/audits as per Ordinance schedules.
- Applicability / Impact scope: All RPSI operators designated by the MA as CI Operators. Applies to all infrastructure components supporting "core functions" of the payment system, regardless of outsourcing or manual failover capability.
- Recommended management actions:
- Gap Analysis: Map existing security policies against the C-RAF maturity matrix and the requirements of this Code.
- Governance: Formally designate a supervisor for the Computer-System Security Management Unit and ensure Board-level endorsement of the security plan.
- Asset Inventory: Finalize the list of CCSs in bilateral consultation with the MA.
- Procurement/Supply Chain: Review contracts with external service providers to ensure alignment with new supply chain management obligations.
- Testing/Audit: Schedule initial vulnerability assessments and penetration tests; appoint qualified assessors for upcoming security audits.
Detailed Summary
1) Document overview
This Code provides regulatory guidance to ensure the security of critical computer systems (CCSs) of designated RPSI operators. It focuses on implementing "Category 1" (statutory notifications/structure) and "Category 2" (security management plans/risk assessment) obligations defined in the *Protection of Critical Infrastructures (Computer Systems) Ordinance*.
2) Main requirements
- Governance: Establish a dedicated security management unit with qualified leadership (e.g., CISP, CISA, CISSP).
- Security Management Plan: Must be Board-approved and updated every two years. If full compliance is impossible, implement and document "alternative security controls."
- Risk Management: Must cover all applications, hosts, and network devices.
- Operational Security: Includes strict access control (multi-factor authentication for high-risk), privileged access management (peer reviews of logs), cryptography, and physical security.
- Lifecycle Management: Strict change management (testing in non-production environments) and patch management.
- Monitoring: 6-month log retention for security events (log-on attempts, privilege usage, system changes).
3) Key changes
- Shift from general best practice to explicit statutory-linked compliance requirements.
- Integration of C-RAF maturity assessment matrix as the benchmark for security controls.
- Defined threshold for "material changes" (e.g., platform migration, server virtualization, major upgrades).
4) Important dates & transition
- Effective Date: 15 October 2026.
- Ongoing: Biennial plan review; notification of operator/system changes; cyclical risk assessments and audits as required by the Ordinance.
5) Impact and risks
- Operational: Increased overhead for documentation, log retention, and external audit reporting.
- Compliance: Non-compliance with MA directions issued under this Code constitutes an offence.
- IT: Required upgrades to logging infrastructure, cryptographic standards, and supply chain oversight.
6) Compliance action checklist
- [ ] Define and submit CCS list to the MA.
- [ ] Appoint security management unit lead.
- [ ] Draft/Update Security Management Plan and obtain Board approval.
- [ ] Establish automated log management meeting the 6-month retention criteria.
- [ ] Perform initial vulnerability scan and penetration test.
- [ ] Document all alternative security controls for audit purposes.
7) Appendices/attachments summary
- Appendix 1: Provides specific technical requirements for access control, privileged ID management, password rules, physical security, and system hardening. These serve as mandatory operational sub-clauses to the core obligations defined in Section 6.