RSK-0006Unified Government e-Services Platform
Possible critical findings in the pre-launch penetration test
A risk's detail, response, contingency and residual risk.
Risk statement
From cause to event to impact — with the preventive controls before the event and the contingency after it
Cause
Out-of-date open-source components in the integration layer that carries citizens’ personal data and civil records
Preventive controls
- Automated vulnerability scanning in the deployment pipeline
- An early penetration test on pre-production
2 / 2
Event
Possible critical findings in the pre-launch penetration test
Any critical finding, or more than five high findings
Contingency
A two-week vendor fix squad after the report
Impact
Security sign-off postponed and launch delayed by at least four weeks, with a risk of exposing citizens’ data
Assessment
The level before and after the response
Inherent
Residual
Exposure
SYP 15M
Residual
67% off the score
Score trend
Last six months
- Score
- Target residual
Escalation path
Escalation engine: a high risk unreviewed for 10 days notifies the PM, 15 the programme manager, 20 the PMO director
Last reviewed 8 days ago · Outside the engine — below «high»
Project manager
Current levelEng. Tarek Al-Mardini
Currently followed up here- 2
Programme manager
Eng. Lina Al-Attar
- 3
PMO director
Dr. Reem Al-Qabbani
- 4
Executive Council
Dr. Samer Al-Daqqar
By the PMO director’s decision
Mitigation plan
Each action with its owner and date — tick it off when complete
Automated vulnerability scanning in the deployment pipeline
Eng. Hussam ZeidanEng. Hussam ZeidanDirector, CybersecurityP-026hussam.zeidan@psa.gov.syIn progressIn 18 days2026-11-15An early penetration test on pre-production
Eng. Hussam ZeidanEng. Hussam ZeidanDirector, CybersecurityP-026hussam.zeidan@psa.gov.syNot startedIn 34 days2026-12-01
Trigger
Any critical finding, or more than five high findings
Contingency
A two-week vendor fix squad after the report