The statutory compliance audit for government and funded bodies.
SRAA is the information-security risk assessment and audit report that the HKSAR government requires every department and government-funded body (NGO / NPO) to submit on a regular basis, in line with the DPO IT Security Guidelines.
It isn't a single report, but rather the name for two parallel services, SRA risk assessment and SA security audit, both of which must be carried out by an independent third-party auditor.
Mandatory for organisations under the DPO standard; private firms can adopt it voluntarily as a head start on compliance and governance.
Government departments and funded bodies can engage UD for SRAA directly through a SOA-QPS5 contractor, with no extra procurement process, no repeated technical vetting, and a shorter path from procurement to delivered report.
The report structure maps straight to the ISPG-SM01 submission format, ready to hand to DPO, a bureau or the board, with no reformatting.
UD doesn't sell the hardware or software within audit scope, and doesn't push solutions tied to the findings. Independence is a statutory prerequisite of the DPO standard, and the core guarantee of audit validity.
UD auditors also hold offensive-testing certifications, catching technical misconfigurations that a document review alone would miss, turning compliance from a tick-box exercise into real risk identification.
Serving over 4,000 organisations, fluent in DPO submission formats and government audit processes. 100% local auditors, directly hired, sensitive data never leaves Hong Kong.
Government departments, Bureaux, Government-funded NGOs, Social-welfare bodies, Education institutions, Healthcare organisations
Meet with you to map critical technical assets, sensitive data flows and the applicable compliance targets; sign NDAs and authorisation, and collect existing security policies and procedure docs.
Asset classification, threat modelling, vulnerability scanning and impact assessment, checked item by item against the ISPG-SM01 control list, with residual risk calculated.
Technical sampling audit of firewalls, access control, encryption, patching and logs, plus a policy-document review, with targeted penetration testing where needed.
Deliver the combined SRAA report, risk register, compliance status and remediation priorities, and hold a debrief so IT, compliance and management understand the findings.
Re-assess the identified flaws and gap items, confirm the fixes, and issue a completion letter ready to submit straight to DPO or the relevant regulator.
Whether you want a formal quote or just have a question, a UD auditor will be in touch shortly to scope the work, estimate effort and prepare a tailored quote.
SRAA is an organisation-level compliance audit to the DPO standard, spanning management, process and technical layers, and including two parallel services, risk assessment (SRA) and security audit (SA); a penetration test focuses on the technical layer, deeply verifying exploitable system flaws. A targeted pen test can sit inside SRAA as one audit technique, but the two differ in scope and purpose.
Yes. Although SRAA was designed for government departments and government-funded bodies, the same framework works for private firms preparing for ISO 27001, HKMA readiness, PDPO compliance or internal IT governance, markedly raising IT-governance maturity and shortening the path to formal certification later.
Typically 4 to 8 weeks, depending on organisation size, number of sites, technical complexity and your availability. Multi-site engagements take longer overall, but the per-site unit cost drops.
Once a year is recommended, or right after a major system change. Common triggers include a new core system going live, cloud migration, mergers and acquisitions, and a compliance-target upgrade (for example, adding PCI-DSS).
The DPO standard requires both to be submitted together, so splitting them has limited value. In rare cases an organisation can run SRA first to identify risk, then SA six months later to verify the fixes, but this lengthens the time to compliance and isn't the preferred route.
Yes. UD's SRAA report maps directly to the DPO ISPG-SM01 standard in structure and content, ready to hand to DPO, a bureau, the board or an audit committee, or to serve as a compliance document in a government tender.
Yes. UD is listed on the DPO Standing Offer Agreement for Quality Professional Services (5th generation, SOA-QPS5) subcontractor panel. Government departments and funded bodies can engage UD for SRAA directly through a SOA-QPS5 contractor, with no separate procurement process.
Submit the form at the foot of the page, noting your organisation type, number of sites, application scope, compliance target (DPO, or also ISO 27001 / PCI-DSS / HKMA) and target completion date. A UD auditor will reply shortly to arrange a scoping meeting, after which we provide a formal quote.