New Rules Give You More Time to Report Cyber Security Issues!

Let’s Dive In

The Security Bureau has announced potential changes to the reporting timeline for serious security incidents by essential service providers. This follows a month-long consultation on a new law aimed at enhancing the protection of critical infrastructure computer systems. With overwhelming support from stakeholders, this legislation could significantly impact various sectors.

Proposed New Law for Critical Infrastructure

Key Highlights:

• The proposed law will affect eight key sectors, including banks, electricity suppliers, and telecommunications.
• Operators must report serious security incidents within two hours, but this may be extended to twelve hours due to practical challenges.

The bureau received 53 submissions, with nearly all in favor of the legislation. This indicates strong industry support for enhanced cybersecurity measures.

Compliance and Penalties

Important Details:

• Organizations that fail to comply with reporting requirements could face penalties ranging from HK$500,000 to HK$5 million.
• A commissioner’s office will be empowered to investigate disruptions in critical infrastructure systems.

In cases like recent outages (e.g., Microsoft), authorities aim to determine if issues stemmed from attacks or mere technical glitches. Only attacks will fall under the new regulations.

Legislative Timeline

The government plans to present this bill before the Legislative Council by year-end. This move reflects a proactive approach towards safeguarding essential services against cyber threats while considering operational realities faced by companies.

In Conclusion

As cybersecurity becomes increasingly vital, these legislative efforts signify a commitment to protecting critical infrastructures. By potentially extending reporting timelines and establishing clear penalties, the government aims not only for compliance but also for resilience against future cyber threats.

Reference

#####

1. Security Bureau Proposes New Cybersecurity Law – Example News Source
2. Consultation Results on Cybersecurity Legislation – Another News Outlet
3. Government’s Plan for Enhanced Cyber Protection – Third Reliable Source