Security Risk Assessment and Audit (SRAA)

Cybersecurity assessment dedicated to HKSAR Government and NGO

All government departments and government-funded organizations are required to provide the Security Risk Assessment and Audit (SRAA) Verification Report.

HKSAR Bureaux / Departments
NGO / NPO

SRAA (Security Risk Assessment and Audit) is the Hong Kong programme that requires a Verification Report for government departments and government-funded bodies. UD performs Security Risk Assessment (SRA) and Security Audit (SA) as an independent third party, following the OGCIO IT Security Policy and Guidelines. Engagements cover scoping, vulnerability scanning, manual testing, reporting, and follow-up retesting so organisations can evidence compliance and remediate findings.

Security Risk Assessment (SRA)

Security Risk Assessment (SRA) is an evaluation that involves identifying the risks in your company, your technology, and your processes to verify that controls are in place to safeguard against security threats.

Security Audit (SA)

Security Audit (SA) is a comprehensive review and examination of your organization’s records and activities to determine the ampleness of system controls, and ensure compliance with IT security policies, standards, and requirements. IT security recommendations will be indicated for countermeasures.

Our Services

As a 3rd party auditor, we offer security risk assessment (SRA) and Security Audit (SA) services based on the OGCIO IT Security Policy and Guidelines.

Enquire Now

(852) 2554 7545

Talk to our cybersecurity experts

Security Risk Assessment (SRA)

With the automatic “vulnerability scanning” and UD’s in-house penetration testers providing manual testing can find more profound flaws.

Step 1: Client Meeting confirming the scope of work

Identify your organization’s critical technology assets and the sensitive data those devices create, store, or transmit.

Step 2: Information Gathering and Vulnerability Scanning

Gather all technical reviews, such as existing security policies, standards, guidelines, and procedures, and diagnose sensitive data that is created, stored, and transmitted by technology infrastructure assets.

Step 3: Manual Testing and Exploitation

Access and analyze assets and vulnerabilities including your impact and likelihood assessment.
Check the physical protection applied to computing equipment, server, firewall, and other network components.
Implement technical actions and address the vulnerabilities identified and reduce the level of security risk.

Step 4: Reporting, Debriefing, and Remediation Consultancy

A security report is delivered upon the test has been completed.

Step 5: Retesting previously found vulnerabilities

Re-assessment to review the vulnerabilities.

Security Audit (SA)

Step 1: Defining the audit scopes

Determine a practical approach for performing the audit and identifying constraints

Step 2: Collect Audit Data

Find out how much and what type of information is to be collected and how audit data and logs are screened, saved, and accessed.

Step 3: Perform Audit Tests

Conduct a thorough overview of security configuration and existing security policies or standards under the defined audit scope.
Implement different automated security scans for diagnostic reviews and/or technical investigations for penetration testing.

Step 4: Protect Audit Data & Tools

Audit data and all related physical documents should also be classified to the appropriate level and guarded according to their assortment.

Step 5: Auditing Reports, Enhancements, and Follow-up

Reports will be conveyed after the audit tests. If there are any remedial actions required, adjustments assistance can also be arranged.

Years of Experience

Over the years, UD has performed penetration tests in different kinds of HKSAR Government departments and government-funded organizations. We have even helped repair an NGO website that was cryptojacked.

Social Service NGO

Website testing before launch in Hong Kong
Establish a long-term relationship with an NGO

Local School

Identified major and critical vulnerabilities
Followed up repairing for months
Tested their old computer systems

Professional certifications

CISSP

Associate of ISC2

CEH

PCIP

CREST CPSA

CREST CRT

OSCP

OSWP

INE Security eCPPT

INE Security eCPTX

INE Security eWPT

INE Security eWPTX

Altered Security CRTP

Altered Security CRTE

CompTIA CySA+

CompTIA Security

Splunk Core Certified Power User

What is network cybersecurity? · Managed Security Service Provider (MSSP) in Hong Kong

Frequently asked questions

What is SRAA?

SRAA (Security Risk Assessment and Audit) is the programme under which Hong Kong government departments and government-funded organisations must obtain a Verification Report covering cybersecurity risk assessment and audit activities, typically delivered through Security Risk Assessment (SRA) and Security Audit (SA) by an independent provider.

What is the difference between SRA and SA?

Security Risk Assessment (SRA) focuses on identifying risks across people, process, and technology—including scanning and manual testing—while Security Audit (SA) reviews controls, policies, and evidence to verify compliance and recommend improvements.

How do I request a quotation?

Use the enquiry or quotation buttons on this page to open the UD product enquiry form with SRAA pre-selected, or call (852) 2554 7545 to speak with our cybersecurity team.

Protected your business now!
Service charge: HK $45,000 up / siteRequest a quote FREETalk to our expert

(852) 2554 7545

Security Risk Assessment and Audit (SRAA)

Cybersecurity assessment dedicated to HKSAR Government and NGO

Risk check, quick win

Security Risk Assessment (SRA)

Security Audit (SA)

Professional certifications

Related security pages

Frequently asked questions

What is SRAA?

What is the difference between SRA and SA?

How do I request a quotation?