Protecting a digital public service also means making sure people can still use it.
Security requirements need to account for how residents access a service, how reliably it operates and what happens when those needs change.
According to Rick Chan, Chief Systems Manager (Project Governance and Cybersecurity) of the Digital Policy Office (DPO) in the Hong Kong Special Administrative Region, these questions belong in the planning of a government project.
“The objective is to manage risks to an acceptable level while preserving service quality, accessibility and reliability,” he tells GovInsider.
Chan’s responsibilities include leading the formulation of government IT security policies and guidelines, driving community digital resilience initiatives and steering incident response through the Government Computer Emergency Response Team Hong Kong, or GovCERT.HK.
His team oversees the standards and execution of government cybersecurity initiatives, with work spanning protection within government, partnerships, community support and talent development.
Across digital projects, the aim is to make security part of how a public service is designed, delivered, and maintained.
Matching safeguards to the service
At the planning stage, new government IT systems are classified according to their criticality, exposure and potential impact on public services, he says.
This helps departments match security controls to the risks involved, directing staff, technical resources and budgets towards high-impact systems where protection is needed most.
Responsibility is assigned early too. Project leaders are designated at the outset, with high-risk or public-facing initiatives overseen by senior directorate officers.
Their role is to guide decisions, manage risk, and align the stakeholders involved, so that cybersecurity forms part of the project’s business objectives.
Before launching, systems must pass security checkpoints that include security risk assessments and audits, privacy impact assessments and independent third-party penetration testing, he says.
DPO introduced enhanced measures for large-scale and high-impact IT projects in August 2024, covering planning, development, pre-launch cybersecurity and stress testing.
But security checks must also consider the user experience.
User feedback and usability testing allow departments to identify accessibility barriers, he explains. Reviewing user experience alongside security metrics helps departments assess whether services remain accessible, convenient, and reliable.
“A well-designed security framework actively contributes to the reliability of digital public services.”
Helping departments apply common standards
Government departments differ in their digital maturity, which affects how they apply common security requirements.
DPO provides central support to help address technical gaps, he says.
In December 2024, it introduced a centralised cybersecurity health check platform to conduct regular and continuous checks on government websites and public-facing information systems.
The platform helps identify potential vulnerabilities, while threat intelligence sharing and targeted advisories from GovCERT.HK keep departments informed of emerging risks.
Security oversight continues after a service launches. Departments are required to maintain monitoring mechanisms, conduct routine system health checks, and undertake periodic security reviews.
DPO also conducts regular government-wide information security compliance audits.
These checks are complemented by annual attack and defence drills involving government bureaus, departments, and public organisations.
Simulated attacks take place on designated systems in production use in a strictly controlled environment, helping participants identify vulnerabilities and assess their defences.
Findings are then provided to the organisations for follow-up improvements, he says.
The drills complement ongoing monitoring and security reviews, helping departments identify weaknesses and improve their defences as threats evolve.
Making security part of everyday work
For Chan, successful cybersecurity integration also depends on how civil servants behave beyond formal project reviews.
Cybersecurity and defence should become “a shared culture and instinctive mindset embedded in every civil servant’s daily routine,” he says.
DPO uses different forms of training to reach staff at different levels of responsibility.
Thematic briefings for senior officials reinforce their role in governing digital risks, while regular, unannounced phishing simulations test staff members’ ability to recognise deceptive links and fraudulent communications.
DPO also works with the Civil Service College on cybersecurity seminars and has commissioned the Hong Kong Institute of Information Technology to design and organise the Certificate in Cybersecurity for the Public Sector course.
The aim is to build staff members’ skills and readiness alongside their awareness of threats.
AI adoption adds further considerations, particularly when services handle identity information or personal data.
Chan points to risks arising from AI’s autonomous capabilities and increasingly convincing generated content, which project teams need to identify and manage.
DPO has developed an Ethical Artificial Intelligence Framework and the Hong Kong Generative Artificial Intelligence Technical and Application Guideline to help departments assess risks when developing and applying AI.
Practical training on safe and responsible AI use also aims to prevent data leakage and operational mistakes, he says.
These efforts reinforce cybersecurity as a shared responsibility across government, from senior officials overseeing projects to staff using technology each day.
For Chan, the work continues through planning, launch and routine operation, with security and usability reviewed together so that protecting a service also supports the people who depend on it.
