Firms could lose licence over cybersecurity failures

Companies providing services deemed "essential" could be stripped of their licence to operate if they fail to comply with planned legislation aimed at enhancing cybersecurity, the government said on Tuesday. A proposed new law would cover critical infrastructure spanning eight sectors, including banks and telecommunication services, with companies in these fields required to take action to prevent cybersecurity incidents and report any attacks that take place. At a Legco panel meeting, Security Secretary Chris Tang said the Hong Kong Monetary Authority and the Communications Authority could revoke or refuse to renew a company's licence if it breaches the law. "For other sectors, when a corporation wishes to renew its licence, we will report its work on protecting computer systems of critical infrastructure to related bodies," Tang said. "I believe the related bodies will make considerations on whether to renew or revoke one's licence based on the seriousness of an incident." Asked whether broadcasters would be included in the list of essential services, Tang said a decision would be made once the legislation takes effect.