PCICSO Assessment Tool

Overview

The PCICSO Assessment Tool gives Hong Kong critical infrastructure operators a structured, evidence-backed way to evaluate their compliance posture against the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) — at the individual Critical Computer System level and across the entire CCS portfolio. Whether you are preparing for OCCICS engagement, a Board briefing, a Management Plan review, or your own internal gap analysis, the tool does the heavy lifting: scoring, gap identification, risk prioritisation, evidence management, and report generation — entirely within your browser, with no data leaving your environment unless you explicitly enable an AI feature.

The assessment covers all three statutory obligation categories — Organisational, Preventive, and Incident Reporting and Response — translated from the Ordinance and the Commissioner's Code of Practice (Version 1.0, issued 1 January 2026) into a structured set of assessable practices. Multi-CCS portfolio mode aggregates assessments across every Critical Computer System you operate, surfacing cross-portfolio patterns no per-system view can show. Period tracking and year-over-year comparison turn point-in-time scoring into a defensible trajectory of improvement — exactly the evidence the Commissioner's Office will look for in supervisory engagement and post-incident review.

What PCICSO Asks You to Do — and How the Tool Handles It

PCICSO is Hong Kong's first dedicated cybersecurity law. It came into force on 1 January 2026, alongside the establishment of the Office of the Commissioner of Critical Infrastructure (Computer-system Security) (OCCICS) and the publication of the Commissioner's Code of Practice (CoP). It imposes three categories of statutory obligations on designated Critical Infrastructure Operators (CIOs) — and translates those high-level obligations, through the CoP, into specific operational requirements covering everything from board-approved Management Plans to incident reporting timeframes.

The tool integrates every element of the framework — the three obligation categories, the Code of Practice's operational requirements, the sector-specific CoP overlays from designated authorities (HKMA for banking and financial services; Communications Authority for telecommunications and broadcasting), and the supplier flow-down mechanics — so the question is never "did we cover everything?" but rather "what does the evidence support?".

Assessment Categories

All three PCICSO statutory obligation categories, organised by the practical compliance areas the Commissioner's Code of Practice identifies:

Common Compliance Anti-Pattern Detection

The tool goes beyond simple practice-by-practice scoring. Alongside the structured assessment, a curated set of compliance anti-patterns identifies organisational and operational conditions that actively undermine PCICSO compliance even when other controls appear adequate — for example, security management units that are technically established but lack the day-to-day authority to enforce policy, or Management Plans that are board-approved but not operationally embedded.

Anti-patterns are scored binary — present or not present — and contribute to a dedicated Anti-Pattern Assessment view that surfaces the structural weaknesses traditional self-assessment misses. This is what separates a defensible PCICSO compliance posture from a tick-box exercise that won't survive a Commissioner's inquiry.

Multi-CCS Portfolio Mode

Most designated CIOs operate multiple Critical Computer Systems — financial transaction platforms and their supporting infrastructure, OT environments and their corporate IT dependencies, primary and resilient setups. The CCS Registry holds every Critical Computer System in your portfolio, each with its own designation status, materiality classification, and assessment progress — all visible on a single dashboard. The portfolio-level views go well beyond simple aggregation:

• CCS × Category Heatmap — A colour-coded cross-portfolio matrix showing every CCS against the three obligation categories and their sub-areas, with average compliance by area across systems, sortable to surface the weakest categories across the CIO.
• Compliance by CCS Type — Compare compliance posture across CCS types (transactional, control, monitoring, data processing) to see whether systemic weaknesses cluster by operational context.
• Common Gaps Across the Portfolio — Practices where multiple CCSs are non-compliant, with the explicit list of affected systems. Fix one root cause at the policy or platform level, clear many CCS-level gaps at once.
• Common Evidence Weaknesses — Patterns where evidence quality is consistently weak across CCSs, pointing at systemic documentation deficiencies worth addressing centrally — plus reference examples of CCSs with strong evidence for the same practice.
• Common Low-Compliance Practices — The practices that consistently score below the Code of Practice expectation across CCSs — the structural patterns worth a portfolio-wide programme rather than per-system remediation.
• CIO Overview Dashboard — Tile metrics across the top show total CCSs, average compliance, category obligations met, and outstanding actions. Compliance leads see exactly where to push next.

Evidence Workflow & Reviewer Overrides

Each practice presents the assessor with a structured answer scale (None, Partial, Strong, plus N/A with justification), an inline guide to what good evidence looks like under the Code of Practice, and a drag-and-drop area for attaching supporting documents — PDFs, Word, Excel, images, CSV — directly to the practice.

An independent reviewer workflow captures observations against the evidence in structured fields. The reviewer can override the self-assessed compliance level where the evidence clearly contradicts it, with both the original answer and the reviewer override preserved in the audit trail. When AI is enabled, AI-suggested compliance levels (with confidence rating low/medium/high) sit alongside the self-assessment and the reviewer override — three independent signals, all visible side-by-side, all auditable.

Period Tracking, Baselines & Year-over-Year Comparison

The CoP requires Management Plans to be reviewed at least biennially or after major changes, and obliges material changes to CCSs to be notified to the Commissioner within one month. Single-point assessments are necessary but insufficient. The tool treats assessment as a continuous activity, with first-class support for the time dimension:

• Compliance Snapshot & Baseline — Save a point-in-time baseline; capture manual overrides where appropriate; replace, clear or revert baselines as the programme evolves.
• Period Closure — Formally close an assessment period and archive it, freezing the state for audit and historical comparison — ideal for the biennial Management Plan review cadence.
• Year-over-Year Comparison — Improvements, regressions, evidence added or removed, reviewer-decision changes, category compliance movement — all surfaced as a structured change report between any two assessment periods.
• Multi-Period Trend Comparison — Load three or more historical periods to visualise compliance trajectory by category and CCS across time.
• Per-CCS Compliance Trends — Each CCS's compliance trajectory over multiple closed periods, plus a CIO-average trend line — the trajectory of improvement that the Commissioner will examine in supervisory engagement.

For designated CIOs, this is the evidence trail that demonstrates credible intent — period by period, not just at biennial review.

Audit Log, Collaboration & Resilient Storage

Every answer, note, evidence change and reviewer override is captured in a chronological audit log — the complete record of who did what and when, with full version history accessible from the in-app log viewer. This is the artefact that supports the Commissioner's investigative powers under the Ordinance, and the secrecy obligations in section 57.

Optional Shared Folder Mode turns the assessment into a team workspace. Multiple assessors work in parallel on a multi-CCS portfolio via OneDrive, SharePoint, Microsoft Teams, Google Drive, or Dropbox. Per-CCS file locking prevents conflicting edits; identity stamping records who changed what; live change polling surfaces edits in seconds; and the sync provider conflict detector flags "conflicted-copy" files created by the sync provider so you can resolve them manually rather than discovering them at audit time. A 30-day soft delete with one-click restore prevents accidental data loss.

Evidence storage is resilient by design — content-derived filenames (so evidence titles never leak through the folder browser), per-file and per-question caps, browser-storage quota monitoring, optional encryption-at-rest, a crash-recovery mirror, and a read-only Evidence Health Check audit available from Settings. Crucially for PCICSO secrecy compliance, designation-related information is segregated and access-controlled by default.

Who It's For

• Designated Critical Infrastructure Operators across PCICSO's eight sectors — energy, IT, banking and financial services, land/air/maritime transport, healthcare, and telecommunications and broadcasting
• Operators of major sports and performance venues, and R&D parks, with critical-infrastructure designation
• Multi-CCS operators needing CIO-wide compliance visibility
• Suppliers and cloud service providers facing PCICSO flow-down obligations from CIO contracts
• Banking, FS and telco entities expecting sectoral CoPs from HKMA or the Communications Authority
• Audit, compliance and assurance teams evidencing PCICSO compliance to the Commissioner, the board, or independent reviewers