DTSPP Cybersecurity: 5 Basic Risks for Hong Kong SMEs
The enhanced DTSPP has set out a cybersecurity direction. This article covers the account, backup, update and staff-practice risks SMEs should review first, and what to look for when choosing a solution.
The Hong Kong government has announced that the enhanced DTSPP will use matching grants to help more SMEs adopt AI and cybersecurity solutions. Eligibility, funding amounts, the scope of qualifying services and supplier arrangements for the new round are still to be announced.
Before choosing a cybersecurity service, an SME should understand the risks the company is most likely to overlook. The checks below help a business set out its needs, and then judge whether it needs tools, technical services or staff training.
1. Are company accounts properly protected?
Review how email, cloud platforms, website admin and finance systems are managed. Have accounts been disabled when staff leave? Do important accounts use unique passwords and multi-factor authentication? Is there a clear record of who uses shared accounts?
2. Is important data backed up regularly?
Confirm where customer data, accounting documents, order records and company files are stored, and how often backups run. A business should also know whether data can be restored within an expected time after deletion or system failure, not merely that "a backup exists".
3. Are software and websites updated regularly?
Check whether computers, website platforms, plugins and cloud services are still receiving updates and support. Outdated software can add maintenance and security risk. Assign an owner for updates and set a basic review cycle.
4. Do staff know how to spot suspicious messages?
Common risks include emails impersonating a supplier, fake login pages and messages demanding an urgent transfer. Set a simple internal process: for example, verify any change to payment details or any suspicious attachment through a second, known contact channel.
5. Do staff know what to do when something looks wrong?
If an account shows an unknown login, files will not open or a website behaves strangely, staff should know who to report to, which accounts to suspend and how to keep the relevant records. A clear reporting process helps a business respond early.
When comparing solutions, look closely at what is covered
Cybersecurity solutions can cover very different work: account protection, backup, system checks, monitoring services or staff training. Confirm what the supplier will do, what it delivers, whether ongoing support is included, and who handles day-to-day management after the engagement ends.
The government has announced cybersecurity as one direction of the enhanced DTSPP, but whether an individual service meets the funding requirements of the new scheme depends on the formal guidelines. A business can set out its own risks and current measures first, then assess suitable solutions against what is announced.
Want to know which of your current cybersecurity measures could be improved? Contact us to discuss an initial review. Eligibility and funding arrangements are subject to the latest official announcement.