SRAA and security risk assessment
Inventory systems and data, identify threats and control gaps, then record risk, evidence, ownership and remediation priority.
Cybersecurity
Independent third-party assessment · websites, systems, APIs and source code
Turn security risk into a fixable, verifiable action list
From scoping and testing to evidence and retest — for organisations that need independent audit evidence, including enterprises, schools, NGOs and healthcare bodies.
- Independent of the system developer — we do not assess systems we built; evidence can go straight to management or auditors
- From scoping through remediation retest — not a scanner dump, but a worklist that tracks through to closure
- Hong Kong since 2004 · 22 years
- 5,000+ projects delivered
- 204 published appsMobPage
- 1,230+ app-store reviewsMobPage
Clients include the Hospital Authority and public hospitals across Hong Kong, plus NGO, education, district and volunteer-service organisations.
App figures are from the MobPage division
At a glance
What does this service include?
From scoping and testing to evidence and retest — for organisations that need independent audit evidence, including enterprises, schools, NGOs and healthcare bodies.
- Typical scope
- From scoping through remediation retest — not a scanner dump, but a worklist that tracks through to closure · Services matched to risk and assurance needs · What you receive
- Delivery approach
- We clarify goals, current workflows, data, permissions and integrations before phased design, validation, rollout and handover. Final scope is confirmed during discovery.
SRAA：Security Risk Assessment and Audit
SRAA (Security Risk Assessment and Audit) is generally called 資訊保安風險評估及審計 in Hong Kong government documents. Government requirements call for an assessment and audit of departmental information systems every two years. Tender documents from some public bodies and funded organisations also require contractors to arrange SRAA.
Cybersecurity & risk assurance
Services matched to risk and assurance needs
We first clarify assets, data sensitivity and purpose, then choose the assessment depth. A scanner result is not treated as a substitute for professional review.
Web, API and penetration testing
Within a written, authorised scope, validate authentication, access control, input handling, data exposure and common attack surfaces.
Source code, dependency and secret scanning
Combine static analysis, third-party component risk and exposed credential or key checks to give developers actionable locations and directions.
Cloud and configuration review
Review exposure, TLS, security headers, access control, backups, logging and deployment configuration.
What you receive
The report is designed for decisions and remediation, not a dump of scanner output.
| Deliverable | Content | Use |
|---|---|---|
| Management summary | Scope, main risks, business impact and priorities | Decision-making and project ownership |
| Technical findings | Reproducible evidence, affected components and remediation guidance | Development, IT or supplier action |
| Risk register | Severity, owner, status and suggested timeline | Remediation and risk-acceptance tracking |
| Remediation retest | Revalidation of agreed findings | Confirm reduced risk or further action |
Four stages from authorisation to retest
Before testing, we document objectives, scope, timing, prohibited actions, contacts and data-handling expectations.
1
1. Scope and rules
Confirm assets, environments, test accounts, written authorisation, risk tolerance and emergency stop arrangements.
2
2. Assess and validate
Combine automated and human methods, retaining only evidence needed for remediation.
3
3. Report and remediation workshop
Explain risk, false-positive limits, practical priority and responsible parties.
4
4. Retest and close
Revalidate agreed items and record remediated, partly remediated, accepted or open status.
Methods and reference frameworks
The scope depends on the system and risk. The SRAA guide is published by the Hong Kong Government Digital Policy Office (DPO) / GovCERT. The link below opens the official original.
What we need to quote
- System name and purpose
- Number of websites or applications and their main functions
- Server, cloud and network scope
- Whether penetration testing and source-code scanning are required
- Applicable requirements, such as government guidelines or tender clauses
- Completion deadline and report language
How to judge whether a service fits
Ask for a clear scope, method, evidence, data handling and retest arrangement. No supplier should describe a point-in-time test as a guarantee of permanent security.
The usual steps are: 1. Confirm the scope, including systems, websites, servers and networks. 2. Confirm timing, such as before launch or annually, and the report format against the tender documents. 3. Arrange assessment and audit by auditors independent of the development and maintenance teams; they do not assess systems they developed themselves. 4. Fix findings and retest. 5. Submit the report and remediation records to the organisation. We can help plan the scope, arrange the audit and follow up remediation.
SRAA means Security Risk Assessment and Audit. It defines a scope, inventories assets, threats, controls and risks, and records evidence, priorities, ownership and follow-up status.
SRAA focuses on assets, threats, controls and an overall risk record. Penetration testing validates specific technical weaknesses inside an authorised scope. They complement each other but have different delivery goals.
Usually not. Scanning expands coverage and finds leads; human review confirms context, exploitability, business impact and false positives.
Yes, with written approval from the asset owner or authorised party and agreed environments, accounts, timing and prohibited actions.
No. An assessment reflects the agreed scope and point in time. Systems, dependencies, configurations and threats change, so remediation, monitoring and periodic review remain necessary.
Start by clarifying risk and deliverables
Share the system type, test environment, preferred timing and main compliance or business concerns; we will suggest an appropriate assessment mix.
Want someone to help review it? Apply for a free IT platform check.
Monthly capacity is limited. Applications are handled in order of receipt.