In many small and medium-sized social welfare organisations, IT has never been a standalone department. Instead, IT support is handled by colleagues on top of their other duties, with limited resources and manpower. However, as service models become increasingly digital, regulatory requirements continue to rise, and public expectations for personal data protection grow, cybersecurity is no longer just a technical issue, but an essential foundation for organisational governance and public trust.

Against this backdrop, The Church of United Brethren in Christ Social Service has been moving step by step from "limited IT support" towards a more systematic cybersecurity and digital management framework. In this interview, Mr. Kan Ming Yuk, Chief Executive, and Mr. Luk Chi Keung, IT Manager, of The Church of United Brethren in Christ Social Service shared how the organisation drives sustainable cybersecurity management according to its actual needs, despite limited resources.

1. One Incident That Prompted a Rethink of Cybersecurity

2. Choosing Palo Alto Networks: Centralised Management, Lighter Daily Workload

3. Partner SMARTS: Bridging the Gap for a Small Social Welfare Organisation

4. From Security Culture to Sustainable Development

One Incident That Prompted a Rethink of Cybersecurity

The turning point came from a real experience. Mr. Kan pointed out that social welfare organisations handle a large volume of personal data every day, and data protection is not just a technical matter but a basic responsibility to service users and the public.

"Taking the relevant measures does not mean incidents can be completely avoided; but without proper management, we would be failing the trust of our service users and the public."

He admitted that the organisation once experienced a data loss incident. Although it caused no impact, it prompted management to review existing arrangements, recognise areas for improvement in training, risk assessment and data protection processes, and confirm that minimum measures alone could no longer meet current management needs and responsibilities.

IT Manager Mr. Luk added that the organisation's IT work had previously been handled mainly by colleagues alongside their other duties, so systems could only maintain basic operations and the overall architecture could not be improved. The organisation therefore chose a pragmatic approach: upgrading infrastructure in phases based on actual needs, prioritising higher-risk areas, and gradually addressing past gaps.

Choosing Palo Alto Networks: Centralised Management, Lighter Daily Workload

After comparing several solutions, the organisation chose Palo Alto Networks, with the Cortex Cloud platform as its core security management tool.

Mr. Luk noted that the key factor was not whether the solution had the "most features", but whether it could effectively centralise the management of over a hundred devices with limited IT manpower, including many mobile devices used by staff working in the field.

With the Cortex Cloud platform, IT staff can view device security status, risk alerts and endpoint activity in a single interface, and follow up and respond immediately. This significantly reduces the time spent switching between systems, which is especially important for daily management. The solution is currently being rolled out as a pilot within the organisation, with plans to extend it to other units based on its results.

Partner SMARTS: Bridging the Gap for a Small Social Welfare Organisation

Throughout the planning and implementation process, partner SMARTS played an important coordinating and supporting role.

Mr. Kan pointed out that for small social welfare organisations with limited manpower and resources, the challenge often lies not in understanding what needs to be done, but in how to move forward step by step under real-world constraints.

SMARTS helped the organisation clarify its actual needs during the planning stage, and provided recommendations tailored to its situation on deployment methods, subscription arrangements and room for future expansion, allowing the solution to be rolled out in phases and easing the pressure of a one-off investment. It also helped management better understand the operational and risk considerations behind the technical arrangements, supporting the internal approval process and moving the plan forward.

However, for The Church of United Brethren in Christ Social Service, advancing cybersecurity goes beyond technical solutions; it also depends on colleagues' understanding and cooperation, as well as management's shared view of the responsibilities involved. Given the organisation's limited manpower and scale, Mr. Luk added that taking part in training and sharing sessions organised by HKCSS or partners SMARTS and Palo Alto Networks would help colleagues adopt new tools and risk management practices more naturally.

From Security Culture to Sustainable Development

Beyond policies and technical arrangements, The Church of United Brethren in Christ Social Service also values colleagues' understanding and acceptance of new measures. Mr. Kan noted that it is natural for staff to have questions about new arrangements at first, and this is in fact a valuable opportunity to raise cybersecurity awareness. Through clear policies and practical guidelines, the organisation is gradually extending information security from the policy level into everyday work culture, and encouraging colleagues to keep work devices separate from their personal lives to strengthen data protection and set clearer work boundaries.

With the Protection of Critical Infrastructures (Computer Systems) Ordinance now in effect, Mr. Kan pointed out that although the requirements put some pressure on smaller organisations, they also highlight that raising security standards has become an unavoidable responsibility. He stressed that a shift in management's mindset is crucial: only when the board and management see cybersecurity as a basic operating expense, just like paying electricity and water bills, can the whole process become sustainable.

For the organisation, cybersecurity is not the end goal, but the foundation for digital development. By gradually improving infrastructure and management processes and reducing unnecessary administrative and technical burdens, colleagues can spend more time on their services. The Church of United Brethren in Christ Social Service has chosen a "phased, pragmatic and sustainable" approach, building a security and digital management foundation that meets its actual needs with limited resources, and establishing longer-lasting, stronger trust with service users and the public.

To learn more about Palo Alto Networks products and how to strengthen your cybersecurity, please contact the SMARTS team.

Whatsapp: 90149735

email: cs-enquiry@smarts.hk

Website: https://www.smarts.hk/