SRAA Full name: Security Risk Assessment and Audit: What is the Government of Hong Kong assessing?

In Hong Kong, you'll never get away with one word: SRAA. Full name Security Risk Assessment and AidIn Chinese, it is called “Security risk assessment and audit” (also translated as “Security risk assessment and audit”). It's not a product of a manufacturer, it's...A mandatory set of security assessment and audit requirements established by the Hong Kong GovernmentAll government departments, departments/offices (B/Ds) and government-funded agencies are required to implement them and submit independent certification reports.

This set of requirements is based on the Office of Digital Policy Office, DPO, formerly OGCIO, Practice Guide for Security Risk Assessment & Audit (No. ISPG-SM01The accompanying documents also include Baseline IT Security Policy [S17] and IT Security Guidelines [G3]. The latest edition published in August 2026, v2.2A “SRAA Process and Delivery Baseline Check Sheet” was added.

De normatieve referenties zijn ook indicatief voor positionering: ISO/IEC 27000, 27001, 70002, 27005, ISO 31000:2018 risicobeheersingsrichtlijnen, en NISTIR 8286 (incorporating cybersecurity in underprise risk management (ERM)). Met andere woorden,SRAA is een overheidskader voor het lokaliseren van internationale normenIk weet het niet.

Onderscheid tussen SRA en SA

Veel mensen nemen SRAA als één ding, maar het is een combinatie van twee dingen die totaal anders zijn:

• Veiligheidsrisicobeoordeling (SRA)Identificatie, analyse, beoordeling van veiligheidsrisico's en identificatie van verwijderingsmaatregelen om de risico's tot een aanvaardbaar niveau te beperken. Het perspectief is:RisicoDe reikwijdte van de beoordeling is niet noodzakelijk gekoppeld aan het veiligheidsbeleid.
• Veiligheidscontrole (SA, beveiligingsaudit)Audit versus veiligheidsbeleid/normenNiveau van naleving, verify that existing protective measures are correctly implemented. The perspective is:NalevingIn tegenstelling tot S17, G3 of het eigen veiligheidsbeleid van de sector.

De ambtenaar gaf ons een vergelijkende tabel die het verschil heel duidelijk maakte:

• Kijk uit.: SRA is een risicoperspectief; SA is een nalevingsperspectief
• Executing PartySRAs can be assessed by the department itself (self-assessment) or by third parties;SA must be done by an independent third party
• Key deliverables:SRA surrenderRisk register + risk disposal measures;SA surrenderCompliance checklist
• Timing: new system in development life cycle (SDLC)BeginDo SRA; already online systems are regularly done throughout the life cycle, or when significant changes occur in the IT environment

Three of the most common misconceptions.

ISPG-SM01, from Version 2.0 (April 2024), has specifically clarified a few widely shared misconceptions that should have been heard in this business:

• Verkeerd begrepen: de SRA en SA moeten het samen doen, een "twee-in-één"-rapport opstellen.Fout. De aard van de twee is verschillend, evenals de eisen van de uitvoerende partij (SA moet een onafhankelijke derde zijn), die afzonderlijk kunnen worden gedaan.
• Misunderstanding 2: A SRAA activity can cover both risk identification and compliance checks in SDLC.Wrong. These are two different types of work.
• Misunderstanding three: SRAA is a leak scan or penetration test.The most wrong.Infiltration tests are just part of the technical gap test in the SRA.Not SRAA itself. Many of the consulting firms have misspelled out their service descriptions, saying that “SRAs usually include penetration testing”.

It's important to make this clear -- because if you're going to use the Oscillation Test to prepare SRAA, it's been in the direction of the beginning.

SRA How: Four Steps

De veiligheidsrisicobeoordeling op systeemniveau is gebaseerd op een hoofdlijn van vier stappen en eindigt met de depositie van het systeemrisicoregister:

Risicoidentificatie Ja. Risicoanalyse Ja. Risicobeoordeling Ja. Risicoverwijdering

De definitie van risico is eenvoudig:Risico = dreiging x hiaat x impactIk weet het niet. Bedreigingen kunnen afkomstig zijn van individuele, organisatorische of zelfs milieuomstandigheden, wat leidt tot ongeoorloofde toegang, informatievernietiging/verandering of ontkenning van diensten; mazen zijn zwakke punten of lacunes in het beveiligingssysteem die kunnen worden benut door bedreigingen.

The risk identification phase covers a wide range of areas, with 10 official items: human resources security, asset management, access control, passwords, physical and environmental security, operational security, communications security, system procurement development and maintenance, outsourced security, and business continuity IT security. The identification process is divided into two sub-processes:

• Erkenning van het informatiesysteem: alle informatiesystemen binnen het rechtsgebied, ongeacht de bron van middelen, worden verwijderd en geïmplementeerdLijst en waardering van activaI don't know. There are three categories of asset value - physical value (equipment/software/data/documentation/replacement cost of personnel), intangible value (goods, quality of service), information value (CIA III+ data classification).
• Risk scene recognition• Consider sources of risk, causes and events, threats and opportunities, loopholes and capabilities, changes in the internal and external environment, emerging risk indicators, nature and value of assets, consequences and impacts, knowledge limitations and reliability of information, time factors, etc.

The information collected during the identification is also specific: security needs and objectives; systems/network structures and scale-up maps; evidence of compliance with the physical environment of the rooms; open searchable information; physical assets; operating systems and network management systems; databases and documents; applications and server information; network protocols and services; access control measures; various operating processes; identification mechanisms; regulatory contract requirements; policy guidelines; system classification.

of whichSystem reviewFocus on: System files and logs, running processes, access control files, user lists, configuration settings, patch levels, encryption or authentication tools, web pipe tools, logs, or intrusion detection tools - while keeping an eye on any unusual activity such as an intrusion attempt.

Do it when necessary.Technical gap testingGap scanning, infiltration testing, configuration review, source scanning.Key premisesBefore doing so, the assessment team must agree with the department on the scope, possible impact, back/recovery process; if Tier 2 and above is involved, reference should be made to the Business Continuity Plan (BCP) and the Disaster Recovery Plan (DRP). Gap scans cover network layer detection/discovery, mainframe loophole testing, system/application (including Web) scans and verify that relevant security announcements issued by GovCERT.HK have been filled or compensated.

How to calculate risk: Level 3 matrix

Risk analysis to assessImpactandPossibleWe need to identify them.Existing controlsAnd assess their effectiveness. Controls fall into three categories: technical control (firewalls, encryption, malicious software, access control), physical control (CCTV, door-barrel, fire protection, physical data destruction), management control (emergency response plan, staff safety training, data privacy policy, disaster preparedness plan).

The analytical methods are qualitative and quantitative, and can also be used in matrix approaches. A practical formula is:

Risk level = impact x probability x system hierarchy (Tier)

Each take value 3-high / 2-m/ medium / 1-low, multiply range 1 to 27:18-27 High risk, 9-17 medium risk, 1-8 low riskI don't know. And...Different Tier systems have their own risk matrix.– Same "medium probability + high impact": Tier 1 counts risk, Tier 2 even if it's high risk, Tier 3 is more high risk. The higher the hierarchy of systems, the smaller the space for errors.

The government also gave two techniques:Based on past events(Reference to security incident reports, industry literature, historical leaks by service providers);Three-point estimation method(Three-Point Administration) which allows experts to give the most optimistic O, most likely M, and most pessimistic P values, respectively, with a triangulation of the average. If P and O are too far apart, M is more reliable, M can be weighted (e.g. four times weight).

SA How: Compliance

Security audits follow another line: compliance checks against S17 and departmental security policies through document reviews, site visits, multilevel interviews, panel discussions, questionnaires, etc. Audit scope mustSpecific and prior agreement with auditorsExamples officially given include Internet security, Intranet security, Tier 2 information systems, mainframe security, network server security (Web/mail server, etc.), network components and equipment (firewalls, routers), room security, network services (catalogue services, mail services, remote access), system documentation and records.

For sector-level or non-specific audits, it is common practice to audit the size and effectiveness of ISMs as defined in S17 or the organization-owned ISMs framework (policies/standards/procedures).

Delivery and 10 common activities

The official translation of the regular activity of the entire SRAA into 10, basically a road map of integrity:

1. Opening session: Recognition of coverage, objectives, deliverables
2. Project planning: Agreed delivery schedule and schedule
3. Get ready to check.: Confirmation of inspection forms with departments
4. Prepare for retreat/recovery: technical tests such as gap scanning, penetration testing, etc.
5. Asset identification and valuation: Identification and assessment of assets within agreed limits
6. Risk assessmentRisk identification Risk analysis Risk evaluation
7. Delivery of SRA report, risk disposal plan, system risk register
8. Reporting to managementResults and findings
9. VeiligheidscontroleReport on audit results
10. Data and results protection, follow-up plans, safeguards review, delivery of validation reports, closed loop reporting

You can see,Delivery is not a report.The SRA side-to-side risk register and disposal plan, SA side-to-side compliance checklists and audit reports and, finally, validation reports to confirm the overhaul results of each discovery for closure.

Who's gonna do it? What's gonna happen?

Independent third parties are hard to demand.— Security audits must be conducted by an independent third party and SRA recommendations must also be addressed to a third party. Officially, the duties of consultants/auditors are clearly defined: they have the necessary skills and expertise, they understand the impact of each tool,Before conducting hack tests, you must obtain written authorization from interested parties such as ISP and the police.Whether or not the test is successful, the report reflects the department ' s security policy and operational needs, identifies significant risks or non-conformities, reports immediately, and supports evidence on demand.

Data protection is another easily neglected point: large amounts of configuration and sensitive data are collected during the assessment process.Need to arrange for encryption tools and lockable cabinets at the planning stage; assessment tools will be controlled, operated only by team experts and removed immediately after they have been exhausted; assessment reports that are not authorized to visit prior to modification are themselves a direct threat, so the process and the final report will be strictly confidential; and, after completion, all information will be returned andWithdrawal of temporary access granted to auditorsI don't know.

The services are premised on: provision of documentation information such as network maps, operating manuals, access control lists, security policies/standards/guidelines/procedures; provision of peer support such as networks, firewalls, system management; and organization of site visits.

De follow-up is het waard.

There is an official statement:“The value of risk assessment and auditing is not in the recommendations themselves, but in their effective implementation.” Management is responsible for implementation when the recommendation is made; if the decision is not implemented, the corresponding risk must be assumed and fully justified. The follow-up is structured around three areas of concern: effectiveness, qualifications and timeliness of adaptation. High-risk items are found to be modified or reinforced as soon as possible and are ready for regression procedures.

What is the reference value for the non-Hong Kong region?

Although SRAA is a product of the Hong Kong system of government, its skeletons are common:Risk assessment “risk”, security audit” compliance, both separate, deliverable and closed loop verificationI don't know. This set of ideas and inland equivalents warranty assessments, ISO/IEC 27001 certifications are spiritually compatible - first clear the assets and then calculate the risks (impact x probability x system classification), then allocate the resources at risk and below, and finally use an independent audit to confirm compliance.

If your organization is setting up a security governance framework, the iterative loop of the SRAA assessment-disposal-audit-validation set is a very useful template. Especially that one."Risk register + disposal plan + validation report“The three sets are much more solid than the submission of only one permeability test report.

Safety is not an evaluation, but a closed loop that continues to overlap.