Standards & Compliance
Effective 1 April 2026. July 2026 re-audit confirmed all previously blocking items — 2FA login, NEC Health Check G1–G6 export, BIM interfacing IDs, and SDM OCR — are fully implemented. SCM Phase 1 MVP is operational.
Compliance Matrix
July 2026 Re-Audit Snapshot
All previously blocking items confirmed implemented. The following were completed ahead of the re-audit:
| Clause | Requirement | Implementation | Status |
|---|---|---|---|
| § 7.1.1 | Sequential electronic workflows circulating forms to designated users/groups | StatusMixin + ApprovalRecord | ✓ |
| § 7.1.2 | DRAFT → SUBMITTED → UNDER_REVIEW → APPROVED/REJECTED → CLOSED lifecycle | All six modules | ✓ |
| § 7.1.3 | Notifications to designated users on workflow transitions | Celery tasks — in-app + email | ✓ |
| § 7.2.1 | Capture text, numbers, date/time, locations, files, images, GPS | Typed Django fields; GPS via EXIF | ✓ |
| § 7.2.4 | All captured data extractable via API or Web Services | DRF serializers + iCWP XML export | ✓ |
| § 7.3.2 | Unique identifier stamped to all forms as DB attribute | Module prefix serial e.g. RISC-W-0001 | ✓ |
| § 7.3.6 | Users create drafts via web browser; stored as temporary records | status=DRAFT editable; not visible to reviewers | ✓ |
| § 7.3.7 | Submitted/approved records locked permanently | Non-draft records return 403 on edit | ✓ |
| § 7.4.7 | Photos captured via mobile camera, appended directly to forms | FileField + EXIF GPS extraction on upload | ✓ |
| § 7.4.8 | Photos auto-optimised/compressed; max 1 MB per photo | PIL resize + compression in model save() | ✓ |
| § 7.4.9 | Date, time, GPS stored as metadata; exportable to HK80 | EXIF extraction; HK80 conversion utility | ✓ |
| § 11.1.6 | BIM interfacing IDs (object / location / element) on forms; unified BIM lookup API | BIMInterfacingMixin on RISC, EW, CE, PMI, SDM Document | ✓ |
| Clause | Requirement | Implementation | Status |
|---|---|---|---|
| § 8.1.1 | Deploy smart construction applications for progress, safety, deformation, material, machinery, environment using AI, IoT, smart devices, drones | apps/scm IoT hub; vendor adapters | ✓ |
| § 8.1.2 | SCM data hub collects and consolidates data; real-time alerts via API and push/email | Ingest API + alert engine + Celery tasks | ✓ |
| § 8.1.3 | Key metrics in dashboards for continuous site monitoring | HTMX dashboard with 30s auto-refresh | ✓ |
| § 8.2.1.i–vi | Progress / Safety / Deformation / Material / Machinery / Environmental monitoring | 6 TelemetryEvent categories | ✓ |
| § 8.2.3 | Smart construction info in DBMS in textual/numerical/date+time/location format | PostgreSQL typed columns; no blob-only queryable data | ✓ |
| § 8.3.2.i | Metrics: number and details of unauthorised entries to restricted zones | SafetyAlert type=INTRUSION; count card on dashboard | ✓ |
| § 8.3.2.ii | Metrics: exceedance of Alert-Alarm-Action levels for deformation monitoring | SafetyAlert severity INFO/WARNING/CRITICAL → AAA | ✓ |
| § 8.3.3 | Store key event info; present in dashboard; enable photo/video stream retrieval | TelemetryEvent permanent store; media preview on detail view | ✓ |
| TC(W) 8/2025 fn. | SSSS CMP shall be amalgamated into DWSS SCM hub (mandatory from 1 Apr 2026) | apps/scm is the designated SSSS CMP | ✓ |
| Clause | Requirement | Implementation | Status |
|---|---|---|---|
| § 9.1.1 | SDM workflow-enabled system for processing, storage, and management of all formal project documentation | apps/sdm; distinct from § 7 operational forms | ✓ |
| § 9.1.3 | Enable registration, submission, approval, rejection, response via web browser; version tracking | DocumentVersion model; full web workflow | ✓ |
| § 9.3.1 | SDM automatically assigns unique identifier (folio number) at time of creation | folio_number auto-allocated via _allocate_folio_number() | ✓ |
| § 9.3.4 | Logical components: cabinets, drawers, folders per WBTC No. 19/93 | Cabinet, Drawer, Folder models exactly match WBTC 19/93 | ✓ |
| § 9.3.5 | Folio number auto-assigned, minimum 5-digit (00000–99999) | PositiveIntegerField; file_reference cached as Cabinet/Drawer/Folder/00001 | ✓ |
| § 9.4.2 | Freezing function — no unauthorised modification once frozen | Document.is_frozen blocks new DocumentVersion upload | ✓ |
| § 9.4.5 | OCR functionality to extract text; auto-populate metadata; full-text search | Tesseract OCR; PostgreSQL SearchVector | ✓ |
| § 9.6.3 | Action assignment to multiple staff; due date; re-assign | DocumentActionAssignment with M2M assignees | ✓ |
| § 9.7.2–7.5 | External reviewers invited via email; hyperlink requires authentication | ExternalReviewerInvite OTP token — no auth bypass | ✓ |
| § 9.8.9 | Complete version history: modifications with timestamps, user ID, reason | DocumentVersion.version_number + uploaded_at + change_note | ✓ |
| § 9.8.11 | Prevent deletion; allow authorised archiving per retention policies | No DeleteView; soft-archive via DocumentStatus.CLOSED | ✓ |
| § 9.9.1–9.9.2 | Link SDM documents to Workflow Management (§ 7) and SCM (§ 8) records | DocumentLinkRecord uses Django ContentType generic FK | ✓ |
Security Compliance
Authentication and account security hardened to align with TC(W) 8/2025 and HKSARG IT Security circular requirements.
Referenced Standards