Hong Kong Cyber Security Insurance Implementation Guide
In one sentence: In Hong Kong, cyber insurance is not legally mandatory, but cyber security has become a statutory duty and an actual operational risk. This page compiles the statutory context, incident landscape, the different paths for SMEs and critical infrastructure operators, and a pre-coverage preparation checklist for Hong Kong businesses implementing cyber security insurance.
This page last updated: 28 October 2026 | Data collection date: 28 October 2026
Scope and Stance of This Page
- This page only compiles public data and general market practice; it does not constitute insurance product sales, an offer or solicitation, nor does it provide quotations or arrange cover.
- All incident and regulatory figures use officially published data, with sources and dates indicated.
- This page focuses on enterprise (commercial) solutions.
1. Hong Kong's Cyber Risk Landscape (Official Data)
| Item | Figure | Source |
|---|---|---|
| Hong Kong cyber security incidents in 2025 | 15,877 (up 27% year-on-year, a record high) | HKCERT |
| Share of phishing in total incidents | 57% | HKCERT |
| Data breach notifications in 2025 | 246 (up 21% year-on-year; 81 involved hacking) | Office of the Privacy Commissioner |
| SMEs with no dedicated cyber security person | about 74% (only 26% have a dedicated person) | HKCERT |
These figures show two things: incidents are rising while SME defence resources are clearly insufficient. For most businesses, the cost of a single uninsured incident is usually far higher than the annual premium.
2. Statutory Duty: Cyber Security Has Become "Must Do"
Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)
- Gazetted on 28 March 2025, in effect from 1 January 2026.
- Imposes three categories of statutory duty on designated critical infrastructure operators: governance structure (establish a security management unit), prevention (risk assessment and security audit), and incident notification and response (a two-hour notification time limit).
- Covers sectors such as energy, information technology, banking and financial services, transport, healthcare, and communications and broadcasting.
- Fines range from HK$500,000 to HK$5,000,000, with additional daily fines for continued non-compliance. SMEs and ordinary citizens are not directly bound, but the Ordinance's requirements flow down to suppliers through procurement and outsourcing contracts.
Personal Data (Privacy) Ordinance (Cap. 486)
Data users must take practicable steps to safeguard personal data; upon a data breach, notify in accordance with the requirements of the Office of the Privacy Commissioner, which may trigger investigation and an enforcement notice. The 2025 work report shows that of 246 notifications, 92 (37%) came from schools and non-profit organisations, and most incidents stemmed from everyday processes and human error rather than sophisticated hackers.
Insurance Authority "Cyber Security Guideline" (GL20)
The revised version has been in effect since 1 January 2025, introducing the Cyber Resilience Assessment Framework (CRAF). Although it applies to authorised insurers, it indirectly affects their IT supply chain and intermediaries' operational requirements.
3. Different Paths for Two Types of Business
| Business type | Meaning of cyber insurance | Suggested starting point |
|---|---|---|
| Critical infrastructure operators | Cyber security is already a statutory duty; insurance is part of risk transfer and incident response | First meet the Ordinance's governance and notification requirements; arrange high-limit coverage through layered insurance |
| Ordinary SMEs | Limited defence resources, but hold valuable data or cash flow, making them common attack targets | Start with standardised SME cyber products, prioritising MFA and backups |
4. Pre-Cover Preparation Checklist
A cyber insurance underwriting questionnaire is itself a practical risk checklist. Before applying, a business should prepare the following controls:
- Multi-factor authentication (MFA): covering email, remote access and administrative accounts;
- Endpoint detection and response (EDR): on all managed devices;
- Backups: offline or immutable, with recovery tested regularly;
- Staff training: including drills to recognise AI-enhanced phishing messages;
- Incident response plan: a written plan and incident records for the past three years;
- Supply chain management: security capability assessment of key suppliers and contractual security clauses;
- AI usage policy: whether company or personal data is input, and whether there is a human review mechanism.
These are both conditions for premium reduction and thresholds for underwriting. Businesses that fail to maintain specified security controls may be denied claims (see the exclusions in Products and Coverage Structure).
5. Frequently Asked Questions
Is cyber insurance mandatory for Hong Kong businesses?
No. There is currently no mandatory requirement for businesses to purchase cyber insurance in Hong Kong. However, the Protection of Critical Infrastructures (Computer Systems) Ordinance has imposed statutory cyber security duties on designated critical infrastructure operators since 1 January 2026; the Personal Data (Privacy) Ordinance also requires data users to take practicable safeguarding steps. These statutory duties indirectly raise business demand for cyber insurance, but whether to purchase it remains the business's own decision.
Can Hong Kong SMEs obtain cyber insurance?
Yes. Hiscox, OneInfinity, Coalition, Cowbell and others offer solutions suitable for SMEs, some supporting online or digital application, and standard premiums have become affordable for SMEs with sound security posture. For most SMEs, the cost of a single uninsured incident is usually far higher than the annual premium.
What should a business prepare before taking out cyber insurance?
Underwriting usually requires the business to have: comprehensive multi-factor authentication (MFA), endpoint detection and response (EDR), offline or immutable backups tested regularly, staff security training, an incident response plan, and supply chain risk management. These are both conditions for premium reduction and thresholds for underwriting.
Must suppliers of critical infrastructure operators also buy cyber insurance?
The Ordinance does not directly bind suppliers, but operators, to meet statutory requirements, will write security requirements into procurement and outsourcing contracts. Suppliers ultimately receive these requirements in the form of contractual terms, including requests for proof of security capability, or even to take out cyber insurance themselves.
6. In Support of Local Corporate Insurance Services
This site is supported by Henderson Insurance Consultants Limited (licensed insurance agency, licence FA-2958). Enterprises interested in understanding or arranging cyber insurance, as well as other Hong Kong local corporate insurance (group medical, employee compensation, commercial comprehensive insurance, etc.), may enquire via the contact details on the About Henderson Insurance Consultants page footer. The website itself does not sell insurance products, provide quotations or arrange cover.
7. Sources
- HKCERT "Hong Kong Cyber Security Outlook 2026" (institution publication, 2026-01-28)
- Office of the Privacy Commissioner 2025 Work Report (official original, 2026-02-03)
- Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653, Government Gazette)
- Insurance Authority "Cyber Security Guideline" (GL20, revised version effective 2025-01-01)