Which roles and skills are in demand
The Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), passed by the Legislative Council on 19 March 2025, came into force on 1 January 2026 as Hong Kong's first dedicated cybersecurity legislation.
The Ordinance covers eight sectors providing essential services — energy, information technology, banking and financial services, maritime, land transport, air transport, healthcare, and communications and broadcasting — plus infrastructure sustaining major social and economic activities such as major sports and performance venues and technology parks.
A new Commissioner's office under the Security Bureau oversees the regime, supported by sector regulators including the Hong Kong Monetary Authority and the Communications Authority.
Our perspective
Cybersecurity was already a growth area, but a statutory compliance deadline converts intention into budget. Designated operators in energy, transport, banking, healthcare, IT and communications now have a legal reason to build permanent security teams rather than rely solely on ad hoc consultancy.
Our advice to HR partners
Employers in covered sectors should scope their security organisation early rather than hire reactively, while HR teams outside those sectors should note that competition for security talent will intensify across the market. Realistic role scoping and clear progression paths will matter in a scarce talent pool.
What the law requires
Designated critical infrastructure operators must maintain a Hong Kong office, set up a computer-system security management unit supervised by an appointed employee, notify material changes to critical computer systems, implement a security management plan, conduct annual risk assessments and regular audits, join security drills, maintain an emergency response plan and report incidents. Organisations that fail to comply face fines ranging from HK$500,000 to HK$5 million.
Because designated operators must appoint an employee to supervise their computer-system security management unit, demand is strongest for professionals who combine technical grounding with governance, documentation and stakeholder communication skills. Certifications and audit experience add weight.
Want to know how these market trends affect your hiring plans?
Contact us and let’s explore the right strategy together.
