Rethinking Vendor Risk: Building Supply Chain Digital Trust Under HK Cap. 653

Hong Kong's Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) came into force on 1 January 2026, accompanied by a Code of Practice issued by the newly established Office of the Commissioner of Critical Infrastructure (Computer-system Security). It applies to designated critical infrastructure operators across eight sectors, including banking and financial services, healthcare, energy, telecommunications, transport and information technology.

The detail that matters most to the wider market is this: designated operators are required to adopt measures ensuring their third-party service providers meet the relevant obligations, and the Code of Practice goes as far as providing model contract clauses for use with external service providers. Contractors are made answerable for the conduct of their own personnel and their subcontractors.

The practical consequence is a flow-down effect. Throughout 2026, designated operators have been renegotiating supplier contracts to push statutory obligations down the chain. If you supply software, analytics, logistics, cloud services or professional services to a designated operator, the Ordinance reaches you contractually even though it does not name you directly. The assumption that this regime only concerns a handful of large designated entities is the most expensive misreading available.

The pattern is not unique to Hong Kong. Under the EU's NIS2 Directive, supply chain security sits explicitly within the required risk-management measures, and responsibility for approving and overseeing those measures rests with management bodies personally. Our white paper mapping NIS2 Article 21 requirements against ISO 27001 sets out that comparison in detail. Across jurisdictions, the direction of travel is the same: regulators have stopped accepting "our vendor was breached" as an explanation.

A single generic assessment process applied to every supplier produces the worst of both worlds: heavy administrative burden and weak assurance. Segment by the mechanism of exposure, not by contract value.

Data-processing relationships

SaaS platforms, outsourced customer service, analytics providers. The controlling questions concern data flows, retention, cross-border transfer and subprocessor disclosure. Under Hong Kong's Personal Data (Privacy) Ordinance, a data user engaging a processor is expected to use contractual or other means to prevent unauthorised access, retention beyond necessity, or loss — the accountability does not transfer with the data.

System-access relationships

Managed service providers, remote support vendors, integrators. Here the questions are about privilege, credential management, network segmentation and lateral movement. A compromised support account with standing administrative rights is not a vendor problem; it is your incident. Where the third party is a cloud provider, CSA STAR assessment offers cloud-specific assurance that a generic questionnaire cannot.

Product-embedded relationships

Software components, OEM modules, embedded firmware. The questions concern software bills of materials, vulnerability disclosure practices and patch cadence. You inherit every weakness in the code you ship, whoever wrote it.

Different mechanisms, different controls. Applying cloud-vendor questions to a firmware supplier produces documentation, not security.

Certification is one of the strongest signals available in vendor risk assessment— but only if you read it correctly, and this is where a great deal of assurance is lost.

An ISO 27001 certificate is not a blanket guarantee. It confirms that an information security management system has been assessed against the standard within a defined scope, documented in the organisation's Statement of Applicability. That scope may cover a head-office function and exclude the very business line, data centre or product team that serves you. The first question to ask a certified supplier is not "are you certified?" but "what is your certified scope, and does it include the service we are buying?"

Read correctly, though, ISO 27001 is genuinely informative. Its supplier-relationship controls require the certified organisation to manage security in its own supply chain — meaning a properly scoped certificate gives you visibility one layer deeper than a questionnaire ever will. It also evidences something a point-in-time assessment cannot: an operating management system, subject to surveillance audits, with defined ownership and continual improvement.

Where personal data is central to the relationship, ISO 27701 extends the management system into privacy information management, addressing exactly the controller–processor accountability that the PDPO and GDPR both impose.

For automotive supply chains, TISAX® solves a different and very practical problem. Its value is mutual recognition: an assessment result can be shared with multiple participating partners, replacing repeated bilateral audits of the same supplier. For suppliers, that means one rigorous assessment rather than a dozen inconsistent ones. For manufacturers, it means comparable, standardised assurance across a fragmented supplier base.

And where the third party supplies AI capability — an increasingly common and poorly governed category — ISO/IEC 42001 provides management-system requirements specific to AI, covering the governance questions that information security standards alone were never designed to answer.