Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1)
The Hong Kong Government practice guide for cloud computing security (ISPG-SM04 v2.1): management responsibilities, policy, human resource security, asset management, access control, cryptography, physical security, operations, communications and virtualisation security, secure development, outsourcing, incident management, business continuity and compliance for bureaux and departments using in-house, outsourced private or public cloud.
Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) is a compliance framework from Hong Kong SAR with 9 domains and 53 controls. The largest domains are 5.9: Communications security and virtualisation security – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) (12 controls), 5.1 to 5.3: Management responsibilities, IT security policies and human resource security – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) (7 controls), 5.10 and 5.11: System acquisition, development and maintenance; outsourcing security – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) (6 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (9)
5.1 to 5.3: Management responsibilities, IT security policies and human resource security – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1)
| Code | Title |
|---|---|
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.1.0 | Own security accountability, plan cloud in the IT strategy and counter provider lock-in |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.1.1 | Analyse the impact of jurisdiction on security procedures |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.1.2 | Verify the provider's compliance with recognised security standards |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.2 | Review the departmental security policy for cloud-specific adjustments |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.3.1 | Define roles and responsibilities for resource control and information security |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.3.2 | Bind provider staff to confidentiality and check their vetting and exit procedures |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.3.3 | Issue user guidelines and reminders and train relevant personnel |
5.10 and 5.11: System acquisition, development and maintenance; outsourcing security – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1)
| Code | Title |
|---|---|
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.10.1 | Apply a secure development lifecycle to cloud applications |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.10.2 | Manage and protect production credentials |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.11.1 | Analyse security risks before deciding to use outsourced cloud services |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.11.2 | Define measurable security requirements in the tender and a tailored SLA, and watch SLA changes |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.11.3 | Make sure the provider's controls meet government requirements and address external threats |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.11.4 | Formulate an exit strategy at the outset |
5.12: Information security incident management – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1)
| Code | Title |
|---|---|
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.12.1 | Define incident monitoring and reporting responsibilities and secure access to incident data |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.12.2 | Agree incident response steps, timing and evidence handling with the provider and review its track record |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.12.3 | Document incident handling procedures for off-premises cloud services and rehearse them with the provider |
5.13 and 5.14: Business continuity and compliance – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1)
| Code | Title |
|---|---|
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.13.1 | Make sure backup and disaster recovery arrangements are effective and tied to the SLA |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.13.2 | Cover loss of the provider in the business continuity plan and inspect the provider's plans |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.14.1 | Assess security risks before production and major change and reassess regularly |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.14.2 | Agree audit rights, scope and evidence sharing, and engage independent auditors |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.14.3 | Specify compliance deliverables in the contract and perform onsite checks |
5.4: Asset management – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1)
| Code | Title |
|---|---|
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.4.1 | Protect data by strong encryption at rest and in transit |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.4.2 | Observe data protection and privacy law for outsourced data centres |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.4.3 | De-identify personal data as an added layer of protection |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.4.4 | Keep track of data location and prevent unapproved movement to the cloud |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.4.5 | Maintain an up-to-date inventory of cloud assets |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.4.6 | Make sure equipment disposal and re-use destroy data securely |
5.5 and 5.6: Access control and cryptography – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1)
| Code | Title |
|---|---|
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.5.0 | Understand provider access controls, resume privileged access and keep keys out of the provider's hands |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.5.1 | Define logical access control with default deny and least privilege |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.5.2 | Build an identity and access management architecture on open standards |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.5.3 | Require strong authentication and restrict privileged access |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.5.4 | Restrict and control privileged utility programs |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.6 | Manage and protect cryptographic keys through their lifecycle under B/D custody |
5.7: Physical and environmental security – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1)
| Code | Title |
|---|---|
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.7.1 | Analyse risks of the site location and validate facility controls |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.7.2 | Define and verify physical protection for equipment and media in shared data centres |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.7.3 | Use an isolated, access-controlled area where data sensitivity requires it |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.7.4 | Grade controlled areas by sensitivity and control access to shared racks at equipment level |
5.8: Operations security – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1)
| Code | Title |
|---|---|
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.8.1 | Keep offline backups, test recovery and secure compliance copies |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.8.2 | Keep complete, tamper-resistant logs and review them by criticality |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.8.3 | Put in place processes to collect and keep configuration and audit evidence |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.8.4 | Keep control over patch management |
5.9: Communications security and virtualisation security – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1)
| Code | Title |
|---|---|
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.9.1 | Protect data in transmission and the computing resources on the network |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.9.2.1 | Keep the host operating system thin and harden every virtualisation component |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.9.2.10 | Log privileged account activity on hypervisors and virtual machines |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.9.2.11 | Protect administrative interfaces and monitor management sessions |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.9.2.2 | Deploy high availability technologies against single points of failure |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.9.2.3 | Control traffic between virtual machines with VM-specific and layered protection |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.9.2.4 | Enforce least privilege and segregation of duties among cloud administrators |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.9.2.5 | Create security zones by trust level and prefer bare-metal hypervisors for critical systems |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.9.2.6 | Analyse virtualisation risks before adoption and plan VM resources |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.9.2.7 | Keep an auditable inventory of the virtual environment and valid software licences |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.9.2.8 | Patch dormant virtual machines and verify security after snapshot restores |
| hong-kong-government-practice-guide-for-cloud-computing-security-ispg-sm04-v2-1::5.9.2.9 | Protect VM images, snapshots and configuration files and clear VM data securely |
What is Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) and who does it apply to?
Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) is a compliance framework from Hong Kong SAR with 9 domains and 53 controls. The Hong Kong Government practice guide for cloud computing security (ISPG-SM04 v2.1): management responsibilities, policy, human resource security, asset management, access control, cryptography, physical security, operations, communications and virtualisation security, secure development, outsourcing, incident management, business continuity and compliance for bureaux and departments using in-house, outsourced private or public cloud. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) actually require?
Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) has 53 controls organised across 9 domains. The largest domains are 5.9: Communications security and virtualisation security – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) (12 controls), 5.1 to 5.3: Management responsibilities, IT security policies and human resource security – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) (7 controls), 5.10 and 5.11: System acquisition, development and maintenance; outsourcing security – Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) do I already cover?
Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1)?
Start your Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 53 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,248 frameworks.
Get Started Free →Free forever, no credit card required