OptimaTechPentest as a Service · powered by Blacklock
Hong Kong · Critical infrastructure

Cap. 653: what Hong Kong’s critical infrastructure law says about penetration testing

A plain-English guide to the security risk assessment, penetration test and tester qualifications in the Code of Practice, with links to the official text.

Last reviewed 20 October 2026 by OptimaTech Limited. General information, not legal advice.

Short answer Yes, for designated operators. The Code of Practice under the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) says each security risk assessment “should include a vulnerability assessment and a penetration test” (section 6.3.4), carried out by a tester with “appropriate professional qualification” (section 6.3.6). Assessments are due at least once every 12 months.12

The three obligations, and where testing fits

OCCICS groups operators’ duties into three categories. Penetration testing sits inside the second: the annual computer-system security risk assessment.2

Cap. 653 timeline for designated operators After designation: security risk assessment within 12 months then every 12 months, including a penetration test; security audit within 24 months then every 24 months; serious incidents reported within 12 hours and other incidents within 48 hours. Designation Risk assessment: within 12 months then every 12 months · includes pen test Security audit: within 24 months then every 24 months Incidents: serious 12 h · others 48 h · report 14 days
Figure 1. Timelines as published by OCCICS.2
ObligationTiming (OCCICS)Role of penetration testing
Security risk assessmentFirst within 12 months of designation, then at least every 12 months; written report within 3 months after the deadlineShould include a vulnerability assessment and a penetration test (CoP 6.3.4); the test report is an annex to the risk assessment report (CoP 6.3.7(k))
Security auditFirst within 24 months, then at least every 24 months; report within 3 monthsAnnex G’s sample audit assumptions note that the audit itself does not include penetration testing, so the test comes from the risk assessment
Incident reportingSerious incidents within 12 hours of becoming aware; others within 48 hours; written report within 14 daysRegular testing reduces the chance of reaching this stage

What the Code of Practice says about the test itself

  • Attacker’s view. The test “should be carried out from the position of a potential attacker or based on threat intelligence” (6.3.6).1
  • Qualified testers. It “should be conducted by a tester having suitable knowledge, relevant experience and appropriate professional qualification” (6.3.6).1
  • Recognised certifications. The 6.3.6 table includes CREST Certified Infrastructure Tester, CREST Certified Web Applications Tester, CREST Certified Simulated Attack Specialist and Manager, Offensive Security Certified Professional, GIAC Penetration Tester and others.1
  • Operational technology. Where live testing could disrupt operations, the Code allows alternatives such as testing in an offline environment or targeting critical peripheral nodes (6.5.9).1

How Blacklock PTaaS and OptimaTech help

Accredited testing

Blacklock announced CREST accreditation for its penetration testing services on 9 May 2025.3

Evidence for the annex

Executive, Developer and Full Penetration Test reports, plus a test certificate, ready to attach to your risk assessment report.4

Between assessments

Continuous scanning keeps watch between annual tests, with retesting once fixes are deployed.

Plan your Cap. 653 testing with our Hong Kong team

Sources

  1. OCCICS, Code of Practice v1.0, sections 6.3.4, 6.3.6, 6.3.7, 6.5.9 and Annex G.
  2. OCCICS, Three categories of obligations for CI operators.
  3. Blacklock, Blacklock Security achieves CREST accreditation, 9 May 2025.
  4. Blacklock, On-demand manual penetration testing.