https://cyber.gc.ca/api/cccs/atom/v1/get?feed=guidance&lang=enGuidance, news and events2026-04-02T12:28:45Zhttps://cyber.gc.ca/en/guidance/cyber-security-privacy-risk-management/suggested-organizational-security-privacy-control-activity-profile-medium-impact-itsp10033-01<![CDATA[Suggested organizational security and privacy control and activity profile — Medium impact (ITSP.10.033-01)]]>2026-04-02T12:28:45Z

Alternate format: Cyber security and privacy risk management: A lifecycle approach - Suggested organizational security and privacy control and activity profile — Medium impact (ITSP.10.033-01) (PDF, 2.3 MB)

Foreword

Suggested organizational security and privacy control and activity profile — Medium impact (ITSP.10.033-01) is an UNCLASSIFIED publication issued under the authority of the Head, Canadian Centre for Cyber Security (Cyber Centre). This publication supersedes Annex 4A – Profile 1 (PROTECTED B / Medium Integrity / Medium Availability). For more information or to suggest amendments, email or phone our Contact Centre: contact@cyber.gc.ca, (613) 949-7048 or 1-833-CYBER-88.

Effective date

This publication takes effect on April 2, 2026.

Revision history

  1. First release: April 2, 2026

Overview

This publication is part of a series of guidelines published by the Canadian Centre for Cyber Security (the Cyber Centre) under Cyber security and privacy risk management: A lifecycle approach.

It suggests a selection of security and privacy controls, activities, and enhancements, together referred to as a “security and privacy control and activity profile.” Organizational security and privacy authorities can use this profile as a reference to create organization-specific profiles suitable for protecting the confidentiality, integrity and availability of medium-value organizational assets against non-state actors. This profile has been developed using the Security and privacy controls and assurance activities catalogue (ITSP.10.033).

The suggested controls and activities in this profile constitute a starting point and need to be tailored to the business, technical, and threat and risk context of each department’s business activities and supporting information systems. The controls and activities were selected based on industry and governmental security and privacy best practices. They also consider certain threat assumptions, derived from Cyber Centre’s analysis of the threat environment faced by information systems in the documented business context. This profile does not address sophisticated state actors’ capabilities, but the assumptions are described in more detail in Section 2.3 Threat context.

This profile is a tool to assist security and privacy practitioners in their efforts to protect information systems in compliance with applicable Government of Canada (GC) legislation and Treasury Board of Canada Secretariat (TBS) policies, directives and standards.

When developing their organizational security and privacy control and activity profiles, organizational security and privacy authorities are responsible for ensuring compliance with all security and privacy requirements of GC regulations and TBS policy instruments applicable to their business activities, as well with as any other contractual obligations.

Table of contents

List of tables

1 Introduction

A security control, also known as a safeguard, is a legal, administrative, operational or technical element of a system that protects the confidentiality, integrity or availability of a business activity or asset and the information it relies on to satisfy security requirements and mitigate cyber security risk. A privacy control is a legal, administrative, operational or technical element of a system implemented at the organizational or system level to mitigate privacy risks and ensure compliance with applicable privacy requirements.

An assurance activityFootnote 1 is a collection of tasks that increases the confidence that a security or privacy control is appropriately designed and implemented and is operating as intended. Assurance activities include tasks that aim to ensure that all security and privacy controls in a system’s design, implementation and operations are able to satisfy the business needs for security.

Security and privacy activities and controls are selected to satisfy security and privacy requirements levied on a system or organization. Security and privacy requirements are derived from applicable laws, Orders in Council, directives, regulations, policies, standards, and business needs to ensure the confidentiality, integrity and availability of information handled, stored or transmitted and to manage risks to individual privacy.

1.1 Purpose

This publication is part of a series of documents published by the Cyber Centre under Cyber security and privacy risk management: A lifecycle approach.

This publication suggests a selection of security and privacy controls, activities and enhancements, together referred to as a “security and privacy control and activity profile.” Organizational security and privacy authorities can use this profile as a reference to create organization-specific profiles suitable for protecting the confidentiality, integrity and availability of medium-value organizational assets against non-state threat actors. This profile has been developed using the Security and privacy controls and assurance activities catalogue (ITSP.10.033).

Organizational profiles help ensure that the security and privacy functions of organizational security and privacy programs can:

  • perform appropriate cyber security and privacy risk management activities
  • provide adequate direction to projects

It is important to note that a profile is only a baseline. It needs to be tailored according to an organization’s business needs for security and privacy based on the confidentiality, integrity and availability objectives of the organization.

1.2 Scope and applicability

The medium confidentiality, integrity and availability (medium impact) profile is primarily intended for use by GC departmentsFootnote 2 and agencies. Organizations from industry or academia seeking to protect at a medium confidentiality, integrity and availability level can use the medium profile and tailor the controls and activities according to their specific context.

The suggested security and privacy controls and activities in this profile constitute a starting point and need to be tailored to the business, technical, and threat and risk context of each organization’s business activities and supporting systems (as described in Section 2). The security and privacy controls and activities were selected based on industry and governmental security best practices, and under certain threat assumptions derived from the Cyber Centre’s analysis of the threat environment faced by information systems in the documented business context.

This profile does not provide details about implementing or utilizing these security and privacy controls and activities in an organization or its information systems. The Cyber Centre publications Organizational cyber security and privacy risk management activities (ITSP.10.036) and System lifecycle cyber security and privacy risk management activities (ITSP.10.037) provide more detailed guidance on these topics. They outline the recommended processes to adequately select, tailor and implement controls and assurance activities at the organization and system level, respectively.

Refer to the Cyber Centre’s website for additional cyber security guidance publications.

1.3 Audience

This publication is intended to serve a diverse audience, including:

  • individuals with system development responsibilities, including:
    • mission or business owners
    • program managers
    • system engineers
    • system security engineers
    • privacy practitioners
    • hardware and software developers
    • system integrators
    • acquisition or procurement officials or executives
  • individuals with logistical or disposition-related responsibilities, including:
    • program managers
    • procurement officials or executives
    • system integrators
    • property managers
  • individuals with security and privacy implementation and operations responsibilities, including:
    • mission or business owners
    • system owners
    • information custodians
    • system administrators
    • continuity planners
    • system security or privacy officers
  • individuals with security and privacy assessment and monitoring responsibilities, including:
    • auditors
    • system evaluators
    • control assessors
    • independent verifiers and validators
    • analysts
  • commercial entities, including industry partners, that produce component products and systems, create security and privacy technologies, or provide services or capabilities that support cyber security or privacy

In the GC, this publication is intended for the audience above, as well as for individuals who support departmental cyber security and privacy risk management activities, such as:

  • individuals with system, information security, privacy, or risk management and oversight responsibilities, including:
    • authorizing officials
    • chief information officers
    • chief security officers
    • senior officials in the department’s security governance
    • designated officials for cyber security
    • appropriate privacy officials or executives
  • individuals who participate in the definition, design, development, installation and operation of information systems, specifically:
    • authorizers
    • project managers
    • cyber security architects
    • cyber security engineers
    • cyber security assessors
    • members of cyber security operations groups

1.4 Publication taxonomy

This publication is part of a series of guidelines that fall under Cyber security and privacy risk management: A lifecycle approach. The documents in the series are as follows:

  • Overview, Cyber security and privacy risk management: A lifecycle approach (ITSP.10.035)
  • Organizational cyber security and privacy risk management activities (ITSP.10.036)
  • System lifecycle cyber security and privacy risk management activities (ITSP.10.037)
  • Security and privacy controls and assurance activities catalogue (ITSP.10.033)
  • Suggested organizational security and privacy control and activity profile—Medium impact (ITSP.10.033-01)
  • Assessment of security and privacy controls and assurance activities (ITSP.10.033-02)
 
Top of page 

2 Context and assumptions

This section characterizes the business, technical, and threat and risk contexts for which this security and privacy control and activity profile is suitable. When selecting this profile as a starting point, organizational security and privacy authorities (supported by security and privacy practitioners) will need to tailor it to create organization-specific security and privacy control and activity profiles that will be appropriate for their organization and business activities.

2.1 Business context

This profile is suitable for organizations using information systems to support a wide range of business activities of medium sensitivity and criticality involving medium-injury information.

In the GC, examples of such business activities include but are not limited to:

  • the delivery of social services
  • taxation
  • Receiver General functions
  • departmental finance and administration
  • human resources
  • public service pay and benefits
  • providing common and shared services to a broad client base

In industry, examples of such business activities include but are not limited to:

  • human resources
  • finance management
  • procurement
  • most health records processing
  • tax records

Organizations that are candidates for using this profile will perform business activities with a maximum security category of medium confidentiality, integrity and availability, as defined in Organizational cyber security and privacy risk management activities (ITSP.10.036). A compromise of the confidentiality of the information and of the integrity and availability of supporting assetsFootnote 3 is reasonably expected to cause a medium level of injury to non-national interests.

The intended maximum robustness level (RL) for controls and enhancements is RL3, and the intended maximum security assurance level (SAL) is SAL3, as defined in System lifecycle cyber security and privacy risk management activities (ITSP.10.037).

Below, Table 1 characterizes in greater detail suitable business contexts using confidentiality, integrity and availability objectives. It also includes examples of consequences of compromise, business processes and related information.

2.1.1 Compliance with Government of Canada legislation and Treasury Board of Canada Secretariat policy instruments

This profile has been created as a tool to assist security and privacy practitioners in their efforts to protect information systems in compliance with applicable GC legislation and TBS policies, directives and standards.

When developing departmental security and privacy control and activity profiles, departmental security and privacy authorities are responsible for ensuring compliance with all security requirements of GC regulations and TBS policy instruments applicable to their business activities, as well as any other contractual obligations.

Table 1: Characterization of applicable business contexts
Confidentiality objective
The business activities involve the processing, transmission and storage of information that needs to be adequately protected from unintentional disclosure.
Integrity and availability objective
The expected injury from compromise of the integrity and availability of assets is assessed as medium. Assets therefore need to be adequately protected from integrity and availability compromise.
Examples of injuries
  • Serious civil disorder or unrest
  • Physical pain, injury, trauma, hardship or illness to individuals
  • Psychological distress or trauma to individuals
  • Financial loss to individuals that affects their quality of life
  • Financial loss to Canadian companies that reduces their competitiveness
  • Inability to conduct criminal investigations or other impediments to effective law enforcement
  • Disruption of government business activities that would inconvenience Canadians
Examples of business processes
  • Payments of benefits to Canadians where disruption or delay could cause psychological harm to people
  • Financial and reporting processes where disruption could lead to financial losses to individuals or Canadian companies
  • Processing of large financial transactions and payments
  • Processes involving most health care records
Examples of information assets
  • Personal medical and financial information
  • Personal income tax information
  • Large financial transactions and payments
  • Information that could be used for criminal purposes (for example, false identity or impersonation)
  • Information about an individual’s eligibility for social benefits

2.2 Technical context

This profile is suitable for organizations operating in a wide range of environments. In general terms, organizational information systems to which this profile applies can be categorized based on their objective, as follows:

  • information systems providing online services (for example, internet-based) to organizational program or service recipients
  • information systems providing operational support services to organizational employees and contractors (for example, a corporate network)
  • information systems providing shared or common services within and outside of the organization

It is assumed that these information systems will be connected to other organizations and the Internet.

2.2.1 Security architectural approaches

The selection of security and privacy controls and activities documented in Section 4 was also influenced by the choice of security engineering best practices applied to the implementation of dependable information systems. This profile is meant to address the cyber security needs of a broad range of business activities, from daily office work to citizen-facing service delivery applications to common and shared service infrastructure support.

This profile is for a categorization of medium confidentiality, integrity, and availability, with an acceptance of risk from high tier threat actors (Td5, Td6 and Td7). It assumes connection to lower sensitivity networks (for example, the public internet) using commercial security products, such as a firewall. It suggests a balanced set of security and privacy controls and activities to reduce the risk that compromised internal elements of an information system could be used to easily compromise additional elements. This profile also suggests security and privacy controls and activities to detect, respond to and recover from security incidents. Many of these are operational controls and activities that a mature cyber security operations group should have in place, not only for security and privacy reasons, but also for the efficient and cost-effective daily management of information systems.

Although selecting security and privacy controls and activities is somewhat subjective, the Cyber Centre made considerable effort to include controls and activities that mitigate real threats and that can be implemented using readily available commercial-off-the-shelf (COTS) products. We excluded from this suggested profile those security and privacy controls and activities that specify a specialized or advanced capability not required for all information systems. Furthermore, this profile aims to achieve the appropriate balance between usability and security.

2.3 Threat context

This profile has been developed to protect organizational business activities from cyber security-related threats that are relevant to both business and technical contexts.

This profile aims to protect information systems, in addition to business activities. This approach is necessary as threats may be directed at GC technical assets for no other reason than to compromise and exploit them, irrespective of the type of business activities that these assets support.

For example, some threat actors are not interested in GC information or in disrupting GC business activities. Instead, they are interested in compromising GC information systems to perform illegal acts, such as:

  • storing illegal data (for example, images or movies) and covertly sharing that data with other criminals
  • performing denial-of-service attacks on commercial websites
  • extorting money
  • sending spam
  • infecting GC information systems with malware

The Cyber Centre has analyzed threat information from multiple sources, including TBS and departmental threat and incident reports, in addition to conducting its own analysis. As a result, this profile, when properly implemented (see Section 4), mitigates the risks from exposure to deliberate threat actors of categories Td1 to Td4, and accidental threats, including natural hazards, of categories Ta1 to Ta3, as defined in Table 2 and Table 3. As threat actor capabilities evolve, this profile will be updated to ensure that the selection of controls and activities is adjusted appropriately to mitigate new capabilities.

Before selecting and tailoring this profile, organizations must ensure that the threat context is applicable to their environment. If this profile is not suitable, organizations will need to create their own profile by considering the suite of security and privacy controls and activities documented in Security and privacy controls and assurance activities catalogue (ITSP.10.033). For more details on creating security and privacy control and activity profiles and organizational threat assessments, read Organizational cyber security and privacy risk management activities (ITSP.10.036).

Table 2: Applicable deliberate threat categories

Threat category Threat actor description Examples of increasing threat actor capabilities
Td1 Non-adversarial actor (for example, non-malicious unauthorized browsing, modification, or destruction of information due to lack of training, concern or attentiveness) Basic end user capabilities to access information systems and contents
Td2 Passive, casual adversary with minimal resources who is willing to take little risk (for example, listening, script kiddie)
  • Execution of a publicly available vulnerability scanner
  • Execution of scripts to attack servers
  • Attempts to randomly delete system files
  • Modification of configuration files settings
Td3 Adversary with minimal resources who is willing to take significant risk (for example, unsophisticated hackers)
  • Use of publicly available hacker tools to run various exploits
  • Insiders installing Trojans and key loggers on unprotected systems
  • Use of simple phishing attacks to compromise targets with malware
  • Execution of programs to crash computers and applications
Td4 Sophisticated adversary with moderate resources who is willing to take little risk (for example, organized crime, sophisticated hackers, international corporations)
  • Sophisticated use of publicly available hacker tools, including zero-day exploits
  • Ability to create own attack tools in software
  • Basic social engineering attacks
  • Ability to assemble hardware using COTS components to facilitate attacks
  • Phishing attacks to gain access to credit card or personal data
Table 3: Applicable accidental threat categories
Threat category: Ta1
Magnitude of events:
Minor accidental events (for example, tripping over a power cord, entering incorrect information)
Threat category: Ta2
Magnitude of events:
  • Moderate accidental events (for example, rendering a server inoperable, database corruption, releasing information to the wrong individual or organization)
  • Minor hardware or software failures (for example, hard disk failure)
  • Minor mechanical failures (for example, power failure within a section of a facility)
  • Minor natural hazards (for example, localized flooding or an earthquake compromising part of a facility)
Threat category: Ta3
Magnitude of events:
  • Serious inadvertent or accidental events (for example, cut facility telecommunications or power cables, fire in the facility, large-scale compromise of information)
  • Moderate mechanical failures (for example, long-term facility power failure)
  • Moderate natural hazards (for example, localized flooding or earthquake compromising a facility)

2.4 Relationship of security and privacy controls and activities to confidentiality, integrity and availability objectives

The selection of security and privacy controls and activities in this profile aims to ensure the appropriate mitigation of threats that could compromise the confidentiality, integrity or availability of assets supporting organizational business activities. This profile does not document the exact mapping between a security or privacy control or activity and the specific objectives it aims to fulfil. While some controls and activities map more clearly to a specific objective (for example, CP-7 Alternate Processing Site maps to an availability objective), most of them support more than one security objective. For example, most controls in the Access Control family support, either directly or indirectly, all 3 objectives of confidentiality, integrity and availability of assets. An adequate implementation of Access Control will mitigate a compromise where a threat actor:

  • exfiltrates sensitive documents containing personal information (confidentiality objective)
  • modifies documents or database records (integrity and usually availability objective)
  • tampers with the proper behaviour of a business application (integrity and possibly availability objective)
  • deletes database records (availability objective)
  • corrupts a business application to make it inoperable (availability objective)
 
Top of page 

3 Implementation guidance

Security and privacy controls and activities need to be implemented in a manner commensurate with the potential for threat and injury. This profile was developed under certain assumptions, as described in Section 2. Consequently, the controls and activities should be implemented with a medium level of effort and due diligence, as described in this section.

3.1 Security assurance

To meet the control and activity requirements documented in this profile, organizations must define the level of effort that will be invested in developing, documenting and assessing the implementation of the controls and activities.

Organizational cyber security and privacy risk management activities (ITSP.10.036) describes a suggested process to implement or update security and privacy controls and activities in this profile that relate to the management of cyber security risks and those that are not deployed as part of information systems. System lifecycle cyber security and privacy risk management activities (ITSP.10.037) provides guidance on the level of effort expected for the implementation of those common security and privacy controls and activities (for example, incident management, risk assessments, personnel screening program, physical security program).

System lifecycle cyber security and privacy risk management activities (ITSP.10.037) describes a suggested security and privacy engineering process that is useful to cost-effectively design, develop, test, install and operate dependable information systems that satisfy business needs for security and privacy. ITSP.10.037 provides guidance to project managers, security and privacy practitioners, security and privacy assessors, and authorizers on the expected level of effort for security and privacy engineering and assessment tasks to ensure that the cyber security implemented in information systems meets the objectives of this profile.

In the case of security and privacy controls and activities implemented for information systems, the appropriate level of effort for security and privacy engineering and assessment tasks is defined through security assurance requirements. These requirements are directed at the tasks that security and privacy control and activity designers, developers and implementers need to perform to increase confidence that the security engineering work and documentation produced is adequate. These tasks also ensure that controls and activities are implemented correctly, operating as intended and producing the desired outcome with respect to meeting the security objectives defined for the information systems. The Cyber Centre suggests that projects use SAL2, as defined in ITSP.10.037, to implement most of the security and privacy controls and activities in this profile.

For critical controls and activities, in particular those on the boundary of an information system and those facing greater threat actor capabilities, an adequate implementation will ensure that a greater level of effort has been applied to the design, development, testing, installation and operation of these controls and activities. The Cyber Centre suggests that projects use SAL3, as defined in ITSP.10.037, to implement the critical controls and activities in this profile. The criticality of a control or activity is dependent on the specific design of the information systems to which it is applied and must be determined by projects’ security and privacy practitioners.

Additionally, for assurance levels SAL1 to SAL3, any supplier involved in the design, development or operation of an information system should hold, as a minimum, a designated organization screening, as stipulated in ITSP.10.037.

Note that the level of assurance suggested to adequately implement this profile does not ensure adequate protection of an information system against the highest level of threat actor capabilities (that is, Td5, Td6 and Td7 threat actors that are highly skilled, highly motivated and well resourced).

ITSP.10.037 provides more detailed guidance for projects on security assurance requirements and the development, documentation and assessment tasks required to satisfy those requirements.

In addition, the Cyber Centre recommends that selected commercial products that perform security functionality should be evaluated to ensure that they function as required and are sufficiently resilient to identified threats. To facilitate this assurance process and ensure that products are evaluated against appropriate security requirements, the Cyber Centre provides a list of commercially available products evaluated against the Common Criteria (CC) program. The Cyber Centre has evaluated these products in partnership with certain commercial laboratoriesFootnote 4, and organizations can use them at their discretion. If organizations choose to leverage this list of Cyber Centre–assured products, procurement vehicles should specify that the selected security products be verified by the CC program against an appropriate security target or CC protection profileFootnote 5. The target or profile is either defined organizationally in security standards or determined by the project’s security practitioners to satisfy the requirements of sections 2 and 3. If the product contains a cryptographic module, then it must also be verified by the Cryptographic Module Validation ProgramFootnote 6 (CMVP), a joint program between the Cyber Centre and NIST. A database of validated cryptographic modules is hosted on the NIST website.

Format

The table in Section 4 provides the suggested set of security and privacy controls, activities and enhancements for this profile. For each control or activity, an ID is provided, along with:

  • the name of the control or activity
  • a list of suggested enhancements
  • a general description and implementation guidance notes
  • values for the placeholder parameters documented as part of each control or activity in the profile
  • additional notes regarding the controls, activities and enhancements in the context of this profile

The complete description of the security and privacy controls, activities, enhancements and placeholder parameters is available in Security and privacy controls and assurance activities catalogue (ITSP.10.033). The columns “Suggested placeholder values” and “Profile-specific notes” are usually empty. Your organization can use these columns as tools to tailor your profile.

To make it convenient for security and privacy practitioners to tailor or create their own organizational security and privacy control and activity profile, the Cyber Centre has created a spreadsheet containing the controls and activities provided in Section 4. Email contact@cyber.gc.ca to request a copy of this spreadsheet.

 
Top of page 

4 Suggested controls, activities, and enhancements

Suggested security and privacy controls, activities, and enhancements

 
Table 4.1: Access control
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
AC 01 Access control policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (1 or more): Organization-level; Mission/business process-level; System-level] access control policy that
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, jurisprudence, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the access control policy and the associated access controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the access control policy and procedures
  3. Review and update the current access control
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected C.1 C.2 frequency [at a frequency no longer than annually] NA
AC 02 Account management
  1. Define and document the types of accounts allowed and specifically prohibited for use within the system
  2. Assign account managers and data custodians
  3. Require [Assignment: organization-defined prerequisites and criteria] for group and role membership
  4. Specify:
    1. authorized users of the system
    2. group and role membership
    3. access authorizations (i.e., privileges) and [Assignment: organization-defined attributes (as required)] for each account
  5. Require approvals by [Assignment: organization-defined personnel or roles] for requests to create accounts
  6. Create, enable, modify, disable, and remove accounts in accordance with [Assignment: organization-defined policy, procedures, prerequisites, and criteria]
  7. Monitor the use of accounts
  8. Notify account managers and [Assignment: organization-defined personnel or roles] within:
    1. [Assignment: organization-defined time period] when accounts are no longer required or are dormant
    2. [Assignment: organization-defined time period] when users are terminated or transferred
    3. [Assignment: organization-defined time period] when system usage or need-to-know changes for an individual
  9. Authorize access to the system based on:
    1. a valid access authorization
    2. intended system usage
    3. [Assignment: organization-defined attributes (as required)]
  10. Periodically review accounts for compliance with account management requirements [Assignment: organization-defined frequency]
  11. Establish and implement a process for changing shared or group account authenticators (if deployed) when individuals are removed from the group
  12. Align account management processes with personnel termination and transfer processes
 Control Selected (J) frequency [at a frequency no longer than monthly] NA
AC 02(01) Account management Account management: Automated system account management
Support the management of system accounts using [Assignment: organization-defined automated mechanisms].		 Control Selected NA NA
AC 02(02) Account management Account management: Automated temporary and emergency account management
Automatically [Selection (one): remove; disable] temporary and emergency accounts after [Assignment: organization-defined time period for each type of account].		 Control Selected time period [not to exceed 48 hours after no longer being required] NA
AC 02(03) Account management Account management: Disable accounts
Disable accounts within [Assignment: organization-defined time period] when the accounts:
  1. have expired
  2. are no longer associated with a user or individual
  3. are in violation of organizational policy
  4. have been inactive for [Assignment: organization-defined time period]
 Control Selected a. b. time period [not to exceed 30 days]
c. time period [not to exceed 24 hours]		 NA
AC 02(04) Account management Account management: Automated audit actions
Automatically audit account creation, modification, enabling, disabling, and removal actions.		 Control Selected NA NA
AC 02(05) Account management Account management: Inactivity logout
Require that users log out when [Assignment: organization-defined time period of expected inactivity or description of when to log out].		 Control Selected NA NA
AC 02(06) Account management Account management: Dynamic privilege management
Implement [Assignment: organization-defined dynamic privilege management capabilities].		 Control Not selected NA NA
AC 02(07) Account management Account management: Privileged user accounts
  1. Establish and administer privileged user accounts in accordance with [Selection (one): a role-based access scheme; an attribute-based access scheme].
  2. Monitor privileged role or attribute assignments.
  3. Monitor changes to roles or attributes.
  4. Revoke access when privileged role or attribute assignments are no longer appropriate.
 Control Selected NA NA
AC 02(08) Account management Account management: Dynamic account management
Create, activate, manage, and deactivate [Assignment: organization-defined system accounts] dynamically.		 Control Not selected NA NA
AC 02(09) Account management Account management: Restrictions on use of shared and group accounts
Only permit the use of shared and group accounts that meet [Assignment: organization-defined conditions for establishing shared and group accounts].		 Control Not selected NA NA
AC 02(10) Account management Account management: Shared / group account credential termination
Withdrawn: Incorporated into AC-2K.		 Control Selected NA NA
AC 02(11) Account management Account management: Usage conditions
Enforce [Assignment: organization-defined circumstances and/or usage conditions] for [Assignment: organization-defined system accounts].		 Control Not selected NA NA
AC 02(12) Account management Account management: Account monitoring for atypical usage
  1. Monitor system accounts for [Assignment: organization-defined atypical usage].
  2. Report atypical usage of system accounts to [Assignment: organization-defined personnel or roles].
 Control Not selected NA NA
AC 02(13) Account management Account management: Disable accounts for high-risk individuals
Disable accounts of individuals within [Assignment: organization-defined time period] of discovery of [Assignment: organization-defined significant risks].		 Control Selected NA NA
AC 03 Access enforcement Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. Control Selected NA NA
AC 03(01) Access enforcement Access enforcement: Restricted access to privileged functions
Withdrawn: Incorporated into AC-06.		 NA NA NA NA
AC 03(02) Access enforcement Access enforcement: Dual authorization
Enforce dual authorization for [Assignment: organization-defined privileged commands and/or other organization-defined actions].		 Control Selected [1] privileged commands [creation and deletion of PKI officers and administrators accounts]
[2] actions [examples are: PKI changes to administrators and security officers; global administrator actions in cloud tenancies; domain administrator actions in single-forest systems]		 Organizations must assess which administrative actions are capable of creating the entire available Injury. These actions are candidates for dual authorization
AC 03(03) Access enforcement Access enforcement: Mandatory access control
Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy, and where the policy:
  1. is uniformly enforced across the covered subjects and objects within the system
  2. specifies that a subject that has been granted access to information is constrained from doing any of the following;
    1. passing the information to unauthorized subjects or objects
    2. granting its privileges to other subjects
    3. changing one or more security attributes (specified by the policy) on subjects, objects, the system, or system components
    4. choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects
    5. changing the rules governing access control
  3. specifies that [Assignment: organization-defined subjects] may explicitly be granted [Assignment: organization-defined privileges] such that they are not limited by any defined subset (or all) of the above constraints
 Control Not selected NA NA
AC 03(04) Access enforcement Access enforcement: Discretionary access control
Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy, and where the policy specifies that a subject that has been granted access to information can do one or more of the following:
  1. pass the information to any other subjects or objects
  2. grant its privileges to other subjects
  3. change security attributes on subjects, objects, the system, or the system’s components
  4. choose the security attributes to be associated with newly created or revised objects
  5. change the rules governing access control
 Control Selected NA Control enhancement (04) clarifies the Access Enforcement security control by detailing the policy that should be used for access enforcement to Protected B information. That is, while the system may be authorized to process PB, not all information will necessarily be PB. Therefore, DAC will be used to establish and enforce access controls over PB information to “need to know.”
Examples of DAC include Windows groups (at the file object level) and document management systems that allow document access permissions to be modified by the owner.
AC 03(05) Access enforcement Access enforcement: Security-relevant information
Prevent access to [Assignment: organization-defined security-relevant information] except during secure, non-operable system states.		 Control Not selected NA NA
AC 03(06) Access enforcement Access enforcement: Protection of user and system information
Withdrawn: Incorporated into MP-04 and SC-28.		 NA NA NA NA
AC 03(07) Access enforcement Access enforcement: Role-based access control
Enforce a role-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined roles and users authorized to assume such roles].		 Control Not selected NA NA
AC 03(08) Access enforcement Access enforcement: Revocation of access authorizations
Enforce the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on [Assignment: organization-defined rules governing the timing of revocations of access authorizations].		 Control Not selected NA NA
AC 03(09) Access enforcement Access enforcement: Controlled release
Release information outside of the system only if:
  1. the receiving [Assignment: organization-defined system or system component] provides [Assignment: organization-defined controls]
  2. [Assignment: organization-defined controls] are used to validate the appropriateness of the information designated for release
 Control Selected NA NA
AC 03(10) Access enforcement Access enforcement: Audited override of access control mechanisms
Employ an audited override of automated access control mechanisms under [Assignment: organization-defined conditions] by [Assignment: organization-defined roles].		 Control Not selected NA NA
AC 03(11) Access enforcement Access enforcement: Restrict access to specific information types
Restrict access to data repositories containing [Assignment: organization-defined information types].		 Control Not selected NA NA
AC 03(12) Access enforcement Access enforcement: Assert and enforce application access
  1. Require applications to assert, as part of the installation process, the access needed to the following system applications and functions: [Assignment: organization-defined system applications and functions].
  2. Provide an enforcement mechanism to prevent unauthorized access.
  3. Approve access changes after initial installation of the application.
 Control Not selected NA NA
AC 03(13) Access enforcement Access enforcement: Attribute-based access control
Enforce attribute-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined attributes to assume access permissions].		 Control Not selected NA NA
AC 03(14) Access enforcement Access enforcement: Individual access
Provide [Assignment: organization-defined mechanisms] to enable individuals to have access to the following elements of their personal information: [Assignment: organization-defined elements].		 Control Not selected NA NA
AC 03(15) Access enforcement Access enforcement: Discretionary and mandatory access control
  1. Enforce [Assignment: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy.
  2. Enforce [Assignment: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy.
 Control Not selected NA NA
AC 04 Information flow enforcement Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies]. Control Selected NA NA
AC 04(01) Information flow enforcement Information flow enforcement: Object security and privacy attributes
Use [Assignment: organization-defined security and privacy attributes] associated with [Assignment: organization-defined information, source, and destination objects] to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.		 Control Not selected NA NA
AC 04(02) Information flow enforcement Information flow enforcement: Processing domains
Use protected processing domains to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.		 Control Not selected NA NA
AC 04(03) Information flow enforcement Information flow enforcement: Dynamic information flow control
Enforce [Assignment: organization-defined information flow control policies].		 Control Not selected NA NA
AC 04(04) Information flow enforcement Information flow enforcement: Flow control of encrypted information
Prevent encrypted information from bypassing [Assignment: organization-defined information flow control mechanisms] by [Selection (one or more): decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; [Assignment: organization-defined procedure or method]].		 Control Not selected NA NA
AC 04(05) Information flow enforcement Information flow enforcement: Embedded data types
Enforce [Assignment: organization-defined limitations] on embedding data types within other data types.		 Control Not selected NA NA
AC 04(06) Information flow enforcement Information flow enforcement: Metadata
Enforce information flow control based on [Assignment: organization-defined metadata].		 Control Not selected NA NA
AC 04(07) Information flow enforcement Information flow enforcement: One-way flow mechanisms
Enforce one-way information flows through hardware-based flow control mechanisms.		 Control Not selected NA NA
AC 04(08) Information flow enforcement Information flow enforcement: Security and privacy policy filters
  1. Enforce information flow control using [Assignment: organization-defined security or privacy policy filters] as a basis for flow control decisions for [Assignment: organization-defined information flows].
  2. [Selection (one or more): Block; Strip; Modify; Quarantine] data after a filter processing failure in accordance with [Assignment: organization-defined security or privacy policy].
 Control Not selected NA NA
AC 04(09) Information flow enforcement Information flow enforcement: Human reviews
Enforce the use of human reviews for [Assignment: organization-defined information flows] under the following conditions: [Assignment: organization-defined conditions].		 Control Not selected NA NA
AC 04(10) Information flow enforcement Information flow enforcement: Enable and disable security or privacy policy filters
Provide the capability for privileged administrators to enable and disable [Assignment: organization-defined security or privacy policy filters] under the following conditions: [Assignment: organization-defined conditions].		 Control Not selected NA NA
AC 04(11) Information flow enforcement Information flow enforcement: Configuration of security or privacy policy filters
Provide the capability for privileged administrators to configure [Assignment: organization-defined security or privacy policy filters] to support different security or privacy policies.		 Control Not selected NA NA
AC 04(12) Information flow enforcement Information flow enforcement: Data type identifiers
When transferring information between different security domains, use [Assignment: organization-defined data type identifiers] to validate data essential for information flow decisions.		 Control Not selected NA NA
AC 04(13) Information flow enforcement Information flow enforcement: Decomposition into policy-relevant subcomponents
When transferring information between different security domains, decompose information into [Assignment: organization-defined policy-relevant subcomponents] for submission to policy enforcement mechanisms.		 Control Not selected NA NA
AC 04(14) Information flow enforcement Information flow enforcement: Security or privacy policy filter constraints
When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] requiring fully enumerated formats that restrict data structure and content.		 Control Not selected NA NA
AC 04(15) Information flow enforcement Information flow enforcement: Detection of unsanctioned information
When transferring information between different security domains, examine the information for the presence of [Assignment: organization-defined unsanctioned information] and prohibit the transfer of such information in accordance with the [Assignment: organization-defined security or privacy policy].		 Control Not selected NA NA
AC 04(16) Information flow enforcement Information flow enforcement: Information transfers on interconnected systems
Withdrawn: Incorporated into AC-04.		 NA NA NA NA
AC 04(17) Information flow enforcement Information flow enforcement: Domain authentication
Uniquely identify and authenticate source and destination points by [Selection (one or more): organization; system; application; service; individual] for information transfer.		 Control Not selected NA NA
AC 04(18) Information flow enforcement Information flow enforcement: Security attribute binding
Withdrawn: Incorporated into AC-16.		 NA NA NA NA
AC 04(19) Information flow enforcement Information flow enforcement: Validation of metadata
When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] on metadata.		 Control Not selected NA NA
AC 04(20) Information flow enforcement Information flow enforcement: Approved solutions
Employ [Assignment: organization-defined solutions in approved configurations] to control the flow of [Assignment: organization-defined information] across security domains.		 Control Not selected NA NA
AC 04(21) Information flow enforcement Information flow enforcement: Physical or logical separation of information flows
Separate information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations by types of information].		 Control Not selected NA NA
AC 04(22) Information flow enforcement Information flow enforcement: Access only
Provide access from a single device to computing platforms, applications, or data residing in multiple different security domains, while preventing information flow between the different security domains.		 Control Not selected NA NA
AC 04(23) Information flow enforcement Information flow enforcement: Modify non-releasable information
When transferring information between different security domains, modify non-releasable information by implementing [Assignment: organization-defined modification action].		 Control Not selected NA NA
AC 04(24) Information flow enforcement Information flow enforcement: Internal normalized format
When transferring information between different security domains, parse incoming data into an internal normalized format and regenerate the data to be consistent with its intended specification.		 Control Not selected NA NA
AC 04(25) Information flow enforcement Information flow enforcement: Data sanitization
When transferring information between different security domains, sanitize data to minimize [Selection (one or more): delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography encoded data; spillage of sensitive information] in accordance with [Assignment: organization-defined policy].		 Control Not selected NA NA
AC 04(26) Information flow enforcement Information flow enforcement: Audit filtering actions
When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.		 Control Not selected NA NA
AC 04(27) Information flow enforcement Information flow enforcement: Redundant/independent filtering mechanisms
When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.		 Control Not selected NA NA
AC 04(28) Information flow enforcement Information flow enforcement: Linear filter pipelines
When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.		 Control Not selected NA NA
AC 04(29) Information flow enforcement Information flow enforcement: Filter orchestration engines
When transferring information between different security domains, employ content filter orchestration engines to ensure that:
  1. Content filtering mechanisms successfully complete execution without errors; and
  2. Content filtering actions occur in the correct order and comply with [Assignment: organization-defined policy].
 Control Not selected NA NA
AC 04(30) Information flow enforcement Information flow enforcement: Filter mechanisms using multiple processes
When transferring information between different security domains, implement content filtering mechanisms using multiple processes.		 Control Not selected NA NA
AC 04(31) Information flow enforcement Information flow enforcement: Failed content transfer prevention
When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.		 Control Not selected NA NA
AC 04(32) Information flow enforcement Information flow enforcement: Process requirements for information transfer
When transferring information between different security domains, the process that transfers information between filter pipelines:
  1. does not filter message content
  2. validates filtering metadata
  3. ensures the content associated with the filtering metadata has successfully completed filtering
  4. transfers the content to the destination filter pipeline
 Control Not selected NA NA
AC 05 Separation of duties
  1. Identify and document [Assignment: organization-defined duties of individuals requiring separation].
  2. Define system access authorizations to support separation of duties.
 Control Selected NA NA
AC 06 Least privilege Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks. Control Selected NA NA
AC 06(01) Least privilege Least privilege: Authorize access to security functions
Authorize access for [Assignment: organization-defined individuals or roles] to:
  1. [Assignment: organization-defined security functions (deployed in hardware, software, and firmware)]
  2. [Assignment: organization-defined security-relevant information]
 Control Selected NA NA
AC 06(02) Least privilege Least privilege: Non-privileged access for non-security functions
Require that users of system accounts (or roles) with access to [Assignment: organization-defined security functions or security-relevant information] use non-privileged accounts or roles, when accessing non-security functions.		 Control Selected NA NA
AC 06(03) Least privilege Least privilege: Network access to privileged commands
Authorize network access to [Assignment: organization-defined privileged commands] only for [Assignment: organization-defined compelling operational needs] and document the rationale for such access in the security plan for the system.		 Control Not selected NA NA
AC 06(04) Least privilege Least privilege: Separate processing domains
Provide separate processing domains to enable finer-grained allocation of user privileges.		 Control Not selected NA NA
AC 06(05) Least privilege Least privilege: Privileged accounts
Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles].		 Control Selected NA NA
AC 06(06) Least privilege Least privilege: Privileged access by non-organizational users
Prohibit privileged access to the system by non-organizational users.		 Control Not selected NA NA
AC 06(07) Least privilege Least privilege: Review of user privileges
  1. Review [Assignment: organization-defined frequency] the privileges assigned to [Assignment: organization-defined roles or classes of users] to validate the need for such privileges.
  2. Reassign or remove privileges, if necessary, to correctly reflect organizational mission and business needs.
 Control Selected NA NA
AC 06(08) Least privilege Least privilege: Privilege levels for code execution
Prevent the following software from executing at higher privilege levels than users executing the software: [Assignment: organization-defined software].		 Control Not selected NA NA
AC 06(09) Least privilege Least privilege: Log use of privileged functions
Log the execution of privileged functions.		 Control Selected NA NA
AC 06(10) Least privilege Least privilege: Prohibit non-privileged users from executing privileged functions
Prevent non-privileged users from executing privileged functions.		 Control Selected NA NA
AC 07 Unsuccessful logon attempts
  1. Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts by a user during a [Assignment: organization-defined time period].
  2. Automatically [Selection (one or more): lock the account or node for an [Assignment: organization-defined time period]; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: organization-defined delay algorithm]; notify system administrator; take other [Assignment: organization-defined action]] when the maximum number of unsuccessful attempts is exceeded.
 Control Selected A. number [of a maximum of 5]
A. time period [period of at least 5 minutes]		 NA
AC 07(01) Unsuccessful logon attempts Unsuccessful logon attempts: automatic account lock
Withdrawn: Incorporated into AC-07.		 NA NA NA NA
AC 07(02) Unsuccessful logon attempts Unsuccessful logon attempts: Purge or wipe mobile device
Purge or wipe information from [Assignment: organization-defined mobile devices] based on [Assignment: organization-defined purging or wiping requirements and techniques] after [Assignment: organization-defined number] consecutive, unsuccessful device logon attempts.		 Control Not selected NA NA
AC 07(03) Unsuccessful logon attempts Unsuccessful logon attempts: Biometric attempt limiting
Limit the number of unsuccessful biometric logon attempts to [Assignment: organization-defined number].		 Control Not selected NA NA
AC 07(04) Unsuccessful logon attempts Unsuccessful logon attempts: Use of alternate authentication factor
  1. Allow the use of [Assignment: organization-defined authentication factors] that are different from the primary authentication factors after the number of organization-defined consecutive invalid logon attempts have been exceeded.
  2. Enforce a limit of [Assignment: organization-defined number] consecutive invalid logon attempts through use of the alternative factors by a user during a [Assignment: organization-defined time period].
 Control Not selected NA NA
AC 08 System use notification
  1. Display [Assignment: organization-defined system use notification message or banner] to users before granting access to the system that provides privacy and security notices consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines and state that:
    1. users are accessing a Government of Canada system
    2. system usage may be monitored, recorded, and subject to audit
    3. unauthorized use of the system is prohibited and subject to criminal and civil penalties
    4. the relevant Personal Information Bank reference, if applicable
    5. legal authority for the collection of personal information
    6. any legal or administrative consequences for refusing to provide the personal information
    7. the rights of access to, correction and protection of personal information
    8. how the information will be used
    9. the right to file a complaint to the Privacy Commissioner of Canada regarding the institution’s handling of the individual’s personal information
  2. Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system.
  3. For publicly accessible systems:
    1. display system use information [Assignment: organization-defined conditions], before granting further access to the publicly accessible system
    2. display references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities
    3. include a description of the authorized uses of the system
 Control Selected NA NA
AC 09 Previous logon notification Notify the user, upon successful logon to the system, of the date and time of the last logon. Control Not selected NA NA
AC 09(01) Previous logon notification Previous logon notification: Unsuccessful logons
Notify the user, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.		 Control Not selected NA NA
AC 09(02) Previous logon notification Previous logon notification: Successful and unsuccessful logons
Notify the user, upon successful logon, of the number of [Selection (one): successful logons; unsuccessful logon attempts; both] during [Assignment: organization-defined time period].		 Control Not selected NA NA
AC 09(03) Previous logon notification Previous logon notification: Notification of account changes
Notify the user, upon successful logon, of changes to [Assignment: organization-defined security-related characteristics or parameters of the user’s account] during [Assignment: organization-defined time period].		 Control Not selected NA NA
AC 09(04) Previous logon notification Previous logon notification: Additional logon information
Notify the user, upon successful logon, of the following additional information: [Assignment: organization-defined additional information].		 Control Not selected NA NA
AC 10 Concurrent session control Limit the number of concurrent sessions for each [Assignment: organization-defined account and/or account type] to [Assignment: organization-defined number]. Control Not selected NA NA
AC 11 Device lock
  1. Prevent further access to the system by [Selection (one or more): initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended].
  2. Retain the device lock until the user re-establishes access using established identification and authentication procedures.
 Control Selected NA NA
AC 11(01) Device lock Device lock: Pattern-hiding displays
Conceal, via the device lock, information previously visible on the display with a publicly viewable image.		 Control Selected NA NA
AC 12 Session termination Automatically terminate a user session after [Assignment: organization-defined conditions or trigger events requiring session disconnect]. Control Selected NA NA
AC 12(01) Session termination Session termination: User-initiated logouts
Provide a logout capability for user-initiated communications sessions whenever authentication is used to gain access to [Assignment: organization-defined information resources].		 Control Not selected NA NA
AC 12(02) Session termination Session termination: Termination message
Display an explicit logout message to users indicating the termination of authenticated communications sessions.		 Control Not selected NA NA
AC 12(03) Session termination Session termination: Timeout warning message
Display an explicit message to users indicating that the session will end in [Assignment: organization-defined time until end of session].		 Control Not selected NA NA
AC 13 Supervision and review — access control Withdrawn: Incorporated into AC-02 and AU-06. NA NA NA NA
AC 14 Permitted actions without identification or authentication
  1. Identify [Assignment: organization-defined user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions.
  2. Document and provide supporting rationale in the security plan for the system, user actions not requiring identification or authentication.
 Control Selected NA NA
AC 14(01) Permitted actions without identification or authentication Permitted actions without identification or authentication: Necessary uses
Withdrawn: Incorporated into AC-14.		 NA NA NA NA
AC 15 Automated marking Withdrawn: Incorporated into MP-03. NA NA NA NA
AC 16 Security and privacy attributes
  1. Provide the means to associate [Assignment: organization-defined types of security and privacy attributes] with [Assignment: organization-defined security and privacy attribute values] for information in storage, in process, and/or in transmission.
  2. Ensure that the attribute associations are made and retained with the information.
  3. Establish the following permitted security and privacy attributes from the attributes defined in AC-16A for [Assignment: organization-defined systems]: [Assignment: organization-defined security and privacy attributes].
  4. Determine the following permitted attribute values or ranges for each of the established attributes: [Assignment: organization-defined attribute values or ranges for established attributes].
  5. Audit changes to attributes.
  6. Review [Assignment: organization-defined security and privacy attributes] for applicability [Assignment: organization-defined frequency].
 Control Selected NA In the context of this profile, the objective of this control is to achieve consistent labeling of Protected B material to the maximum extent supported by available, automated mechanisms (for example, email system enforcing classification labels). Since not all information on the system will be sensitive, labeling will help prevent the accidental distribution of Protected B information by providing filter mechanisms with a differentiator.
AC 16(01) Security and privacy attributes Security and privacy attributes: Dynamic attribute association
Dynamically associate security and privacy attributes with [Assignment: organization-defined subjects and objects] in accordance with the following security and privacy policies as information is created and combined: [Assignment: organization-defined security and privacy policies].		 Control Not selected NA NA
AC 16(02) Security and privacy attributes Security and privacy attributes: Attribute value changes by authorized individuals
Provide authorized individuals (or processes acting on behalf of individuals) the capability to define or change the value of associated security and privacy attributes.		 Control Selected NA NA
AC 16(03) Security and privacy attributes Security and privacy attributes: Maintenance of attribute associations by system
Maintain the association and integrity of [Assignment: organization-defined security and privacy attributes] to [Assignment: organization-defined subjects and objects].		 Control Not selected NA NA
AC 16(04) Security and privacy attributes Security and privacy attributes: Association of attributes by authorized individuals
Provide the capability to associate [Assignment: organization-defined security and privacy attributes] with [Assignment: organization-defined subjects and objects] by authorized individuals (or processes acting on behalf of individuals).		 Control Not selected NA NA
AC 16(05) Security and privacy attributes Security and privacy attributes: Attribute displays on objects to be output
Display security and privacy attributes in human-readable form on each object that the system transmits to output devices to identify [Assignment: organization-defined special dissemination, handling, or distribution instructions] using [Assignment: organization-defined human-readable, standard naming conventions].		 Control Selected NA NA
AC 16(06) Security and privacy attributes Security and privacy attributes: Maintenance of attribute association
Require personnel to associate and maintain the association of [Assignment: organization-defined security and privacy attributes] with [Assignment: organization-defined subjects and objects] in accordance with [Assignment: organization-defined security and privacy policies].		 Control Not selected NA NA
AC 16(07) Security and privacy attributes Security and privacy attributes: Consistent attribute interpretation
Provide a consistent interpretation of security and privacy attributes transmitted between distributed system components.		 Control Not selected NA NA
AC 16(08) Security and privacy attributes Security and privacy attributes: Association techniques and technologies
Implement [Assignment: organization-defined techniques and technologies] in associating security and privacy attributes to information.		 Control Not selected NA NA
AC 16(09) Security and privacy attributes Security and privacy attributes: Attribute reassignment - regrading mechanisms
Change security and privacy attributes associated with information only via regrading mechanisms validated using [Assignment: organization-defined techniques or procedures].		 Control Not selected NA NA
AC 16(10) Security and privacy attributes Security and privacy attributes: Attribute configuration by authorized individuals
Provide authorized individuals the capability to define or change the type and value of security and privacy attributes available for association with subjects and objects.		 Control Not selected NA NA
AC 17 Remote access
  1. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed.
  2. Authorize each type of remote access to the system prior to allowing such connections.
 Control Selected NA NA
AC 17(01) Remote access Remote access: Monitoring and control
Employ automated mechanisms to monitor and control remote access methods.		 Control Selected NA NA
AC 17(02) Remote access Remote access: Protection of confidentiality and integrity using encryption
Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.		 Control Selected NA NA
AC 17(03) Remote access Remote access: Managed access control points
Route remote accesses through authorized and managed network access control points.		 Control Selected NA NA
AC 17(04) Remote access Remote access: Privileged commands and access
  1. Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assignment: organization-defined needs].
  2. Document the rationale for remote access in the security plan for the system.
 Control Selected NA NA
AC 17(05) Remote access Remote access: Monitoring for unauthorized connections
Withdrawn: Incorporated into SI-04.		 NA NA NA NA
AC 17(06) Remote access Remote access: Protection of mechanism information
Protect information about remote access mechanisms from unauthorized use and disclosure.		 Control Not selected NA NA
AC 17(07) Remote access Remote access: Additional protection for security function access
Withdrawn: Incorporated into AC-03(10).		 NA NA NA NA
AC 17(08) Remote access Remote access: Disable non-secure network protocols
Withdrawn: Incorporated into CM-07.		 NA NA NA NA
AC 17(09) Remote access Remote access: Disconnect or disable access
Provide the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period].		 Control Not selected NA NA
AC 17(10) Remote access Remote access: Authenticate remote commands
Implement [Assignment: organization-defined mechanisms] to authenticate [Assignment: organization-defined remote commands].		 Control Not selected NA NA
AC 17(400) Remote access Remote access: Privileged accounts remote access
Access to privileged account remotely is only done from dedicated management consoles.		 Control Selected NA NA
AC 18 Wireless access
  1. Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access.
  2. Authorize each type of wireless access to the system prior to allowing such connections.
 Control Selected NA NA
AC 18(01) Wireless access Wireless access: Authentication and encryption
Protect wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.		 Control Selected NA NA
AC 18(02) Wireless access Wireless access: Monitoring unauthorized connections
Withdrawn: Incorporated into SI-04.		 NA NA NA NA
AC 18(03) Wireless access Wireless access: Disable wireless networking
Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.		 Control Selected NA NA
AC 18(04) Wireless access Wireless access: Restrict configurations by users
Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.		 Control Selected NA NA
AC 18(05) Wireless access Wireless access: Antennas and transmission power levels
Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.		 Control Not selected NA NA
AC 19 Access control for mobile devices
  1. Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas.
  2. Authorize the connection of mobile devices to organizational systems.
 Control Selected NA NA
AC 19(01) Access control for mobile devices Access control for mobile devices: Use of mobile devices
Withdrawn: Incorporated into MP-07.		 NA NA NA NA
AC 19(02) Access control for mobile devices Access control for mobile devices: Use of personally owned mobile devices
Withdrawn: Incorporated into MP-07.		 NA NA NA NA
AC 19(03) Access control for mobile devices Access control for mobile devices: Use of mobile devices with no identifiable owner
Withdrawn: Incorporated into MP-07.		 NA NA NA NA
AC 19(04) Access control for mobile devices Access control for mobile devices: Restrictions for classified information
  1. Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official.
  2. Enforce the following restrictions on individuals permitted by the authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information:
    1. connection of unclassified mobile devices to classified systems is prohibited
    2. connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official
    3. use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited
    4. unclassified mobile devices and the information stored on those devices are subject to random reviews and inspections by [Assignment: organization-defined security officials], and if classified information is found, the incident handling policy is followed
  3. Restrict the connection of classified mobile devices to classified systems in accordance with [Assignment: organization-defined security policies].
 Control Not selected NA NA
AC 19(05) Access control for mobile devices Access control for mobile devices: Full device or container-based encryption
Employ [Selection: full-device encryption; container-based encryption] to protect the confidentiality and integrity of information on [Assignment: organization-defined mobile devices].		 Control Selected NA NA
AC 19(400) Access control for mobile devices Access control for mobile devices: Wireless devices
Withdrawn: Moved to SC-42(400).		 NA NA NA NA
AC 20 Use of external systems
  1. [Selection (one or more): Establish [Assignment: organization-defined terms and conditions]; Identify [Assignment: organization-defined controls asserted to be implemented on external systems]], consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to:
    1. access the system from external systems
    2. process, store, or transmit organization-controlled information using external systems
  2. Prohibit the use of [Assignment: organizationally-defined types of external systems].
 Control Selected NA NA
AC 20(01) Use of external systems Use of external systems: Limits on authorized use
Permit authorized individuals to use an external system to access the system or to process, store, or transmit organization-controlled information only after:
  1. verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans
  2. retention of approved system connection or processing agreements with the organizational entity hosting the external system
 Control Selected NA NA
AC 20(02) Use of external systems Use of external systems: Portable storage devices - restricted use
Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems using [Assignment: organization-defined restrictions].		 Control Selected NA NA
AC 20(03) Use of external systems Use of external systems: Non-organizationally owned systems - restricted use
Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [Assignment: organization-defined restrictions].		 Control Not selected NA NA
AC 20(04) Use of external systems Use of external systems: Network accessible storage devices - restricted use
Prohibit the use of [Assignment: organization-defined network accessible storage devices] in external systems.		 Control Selected NA NA
AC 20(05) Use of external systems Use of external information systems: Portable storage devices - prohibited use
Prohibit the use of organization-controlled portable storage devices by authorized individuals on external systems.		 Control Not selected NA NA
AC 21 Information sharing
  1. Enable authorized users to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [Assignment: organization-defined information sharing circumstances where user discretion is required].
  2. Employ [Assignment: organization-defined automated mechanisms or manual processes] to assist users in making information sharing and collaboration decisions.
 Control Selected NA NA
AC 21(01) Information sharing Information sharing: Automated decision support
Employ [Assignment: organization-defined automated mechanisms] to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.		 Control Not selected NA NA
AC 21(02) Information sharing Information sharing: Information search and retrieval
Implement information search and retrieval services that enforce [Assignment: organization-defined information sharing restrictions].		 Control Not selected NA NA
AC 21(400) Information sharing Information sharing: Information sharing agreement
Ensure through written agreements the appropriate safeguarding of sensitive information shared with external public-sector entities and organizations.		 Control Selected NA GC specific
AC 21(401) Information sharing Information sharing: Information sharing arrangement
Ensure through written arrangements the appropriate safeguarding of sensitive information shared between and within federal institutions.		 Control Selected NA GC specific
AC 22 Publicly accessible content
  1. Designate individuals authorized to make information publicly accessible;
  2. Train authorized individuals to ensure that publicly accessible information does not contain non-public information;
  3. Review the proposed content of information prior to posting onto the publicly accessible system to ensure that non-public information is not included.
  4. Review the content on the publicly accessible system for non-public information [Assignment: organization-defined frequency] and remove such information, if discovered.
 Control Selected NA NA
AC 23 Data mining protection Employ [Assignment: organization-defined data mining prevention and detection techniques] for [Assignment: organization-defined data storage objects] to detect and protect against unauthorized data mining. Control Not selected NA NA
AC 24 Access control decisions [Selection: Establish procedures; Implement mechanisms] to ensure [Assignment: organization-defined access control decisions] are applied to each access request prior to access enforcement. Control Not selected NA NA
AC 24(01) Access control decisions Access control decisions: Transmit access authorization information
Transmit [Assignment: organization-defined access authorization information] using [Assignment: organization-defined controls] to [Assignment: organization-defined systems] that enforce access control decisions.		 Control Not selected NA NA
AC 24(02) Access control decisions Access control decisions: No user or process identity
Enforce access control decisions based on [Assignment: organization-defined security or privacy attributes] that do not include the identity of the user or process acting on behalf of the user.		 Control Not selected NA NA
AC 25 Reference monitor Implement a reference monitor for [Assignment: organization-defined access control policies] that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured. Control Not selected NA NA
 
Top of page 
 
Table 4.2: Awareness and training
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
AT 01 Awareness and training policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] awareness and training policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, jurisprudence, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the awareness and training policy and procedures.
  3. Review and update the current awareness and training:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
AT 02 Literacy training and awareness
  1. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):
    1. as part of initial training for new users and [Assignment: organization-defined frequency] thereafter
    2. when required by system changes or following [Assignment: organization-defined events]
  2. Employ the following techniques to increase the security and privacy awareness of system users [Assignment: organization-defined awareness techniques].
  3. Update literacy training and awareness content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
  4. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.
 Control Selected NA NA
AT 02(01) Literacy training and awareness Literacy training and awareness: Practical exercises
Provide practical exercises in literacy training that simulate events and incidents.		 Control Not selected NA NA
AT 02(02) Literacy training and awareness Literacy training and awareness: Insider threat
Provide literacy training on recognizing and reporting potential indicators of insider threat.		 Control Selected NA NA
AT 02(03) Literacy training and awareness Literacy training and awareness: Social engineering and mining
Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.		 Control Selected NA NA
AT 02(04) Literacy training and awareness Literacy training and awareness: Suspicious communications and anomalous system behaviour
Provide literacy training on recognizing suspicious communications and anomalous behaviour in organizational systems using [Assignment: organization-defined indicators of malicious code].		 Control Not selected NA NA
AT 02(05) Literacy training and awareness Literacy training and awareness: Advanced persistent threat
Provide literacy training on the advanced persistent threat.		 Control Not selected NA NA
AT 02(06) Literacy training and awareness Literacy training and awareness: Cyber threat environment
  1. Provide literacy training on the cyber threat environment.
  2. Reflect current cyber threat information in system operations.
 Control Not selected NA NA
AT 03 Role-based training
  1. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignment: organization-defined roles and responsibilities]:
    1. before authorizing access to the system, information, or performing assigned duties, and [Assignment: organization-defined frequency] thereafter
    2. when required by system changes
  2. Update role-based training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
  3. Incorporate lessons learned from internal or external security incidents or breaches into role-based training.
 Control Selected NA NA
AT 03(01) Role-based training Role-based training: Environmental controls
Provide [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of environmental controls.		 Control Not selected NA NA
AT 03(02) Role-based training Role-based training: Physical security controls
Provide [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of physical security controls.		 Control Not selected NA NA
AT 03(03) Role-based training Role-based training: Practical exercises
Provide practical exercises in security and privacy training that reinforce training objectives.		 Control Not selected NA NA
AT 03(04) Role-based training Role-based training: Suspicious communications and anomalous system behaviour
Withdrawn: Moved to AT-02(04).		 NA NA NA NA
AT 03(05) Role-based training Role-based training: Handling personal information
Provide [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of personal information handling and transparency controls.		 Control Not selected NA NA
AT 04 Training records
  1. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training.
  2. Retain individual training records for [Assignment: organization-defined time period].
 Control Selected NA NA
AT 05 Contacts with security groups and associations Withdrawn: Incorporated into PM-15. NA NA NA NA
AT 06 Training feedback Provide feedback on organizational training results to the following personnel [Assignment: organization-defined frequency]: [Assignment: organization-defined personnel]. Control Not selected NA NA
 
Top of page 
 
Table 4.3: Audit and accountability
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
AU 01 Audit and accountability policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] audit and accountability policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the audit and accountability policy and procedures.
  3. Review and update the current audit and accountability:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
AU 02 Event logging
  1. Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: organization-defined event types that the system is capable of logging].
  2. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged.
  3. Specify the following event types for logging within the system: [Assignment: organization-defined event types (subset of the event types defined in AU-02A.) along with the frequency of (or situation requiring) logging for each identified event type].
  4. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents.
  5. Review and update the event types selected for logging [Assignment: organization-defined frequency].
 Control Selected NA NA
AU 02(01) Event logging Event logging: Compilation of audit records from multiple sources
Withdrawn: Incorporated into AU-12.		 NA NA NA NA
AU 02(02) Event logging Event logging: Selection of audit events by component
Withdrawn: Incorporated into AU-12.		 NA NA NA NA
AU 02(03) Event logging Event logging: Reviews and updates
Withdrawn: Incorporated into AU-02.		 NA NA NA NA
AU 02(04) Event logging Event logging: Privileged functions
Withdrawn: Incorporated into AC-06(09).		 NA NA NA NA
AU 03 Content of audit records Ensure that audit records contain information that establishes the following:
  1. what type of event occurred
  2. when the event occurred
  3. where the event occurred
  4. source of the event
  5. outcome of the event
  6. identity of any individuals, subjects, objects or entities associated with the event
 Control Selected NA NA
AU 03(01) Content of audit records Content of audit records: Additional audit information
Generate audit records containing the following additional information: [Assignment: organization-defined additional information].		 Control Selected NA NA
AU 03(02) Content of audit records Content of audit records: Centralized management of planned audit record content
Withdrawn: Incorporated into PL-09.		 NA NA NA NA
AU 03(03) Content of audit records Content of audit records: Limit personal information elements
Limit personal information contained in audit records to the following elements identified in the privacy impact assessment: [Assignment: organization-defined elements].		 Control Not selected NA NA
AU 04 Audit log storage capacity Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements]. Control Selected NA NA
AU 04(01) Audit log storage capacity Audit log storage capacity: Transfer to alternate storage
Transfer audit logs [Assignment: organization-defined frequency] to a different system, system component, or media other than the system or system component conducting the logging.		 Control Selected NA NA
AU 05 Response to audit logging process failures
  1. Alert [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] in the event of an audit logging process failure.
  2. Take the following additional actions: [Assignment: organization-defined additional actions].
 Control Selected NA NA
AU 05(01) Response to audit logging process failures Response to audit logging process failures: Storage capacity warning
Provide a warning to [Assignment: organization-defined personnel, roles, and/or locations] within [Assignment: organization-defined time period] when allocated audit log storage volume reaches [Assignment: organization-defined percentage] of repository maximum audit log storage capacity.		 Control Selected NA NA
AU 05(02) Response to audit logging process failures Response to audit logging process failures: Real-time alerts
Provide an alert within [Assignment: organization-defined real-time period] to [Assignment: organization-defined personnel, roles, and/or locations] when the following audit failure events occur: [Assignment: organization-defined audit logging failure events requiring real-time alerts].		 Control Not selected NA NA
AU 05(03) Response to audit logging process failures Response to audit logging process failures: Configurable traffic volume thresholds
Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity and [Selection: reject; delay] network traffic above those thresholds.		 Control Not selected NA NA
AU 05(04) Response to audit logging process failures Response to audit logging process failures: Shutdown on failure
Invoke a [Selection (one): full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available] in the event of [Assignment: organization-defined audit logging failures], unless an alternate audit logging capability exists.		 Control Not selected NA NA
AU 05(05) Response to audit logging process failures Response to audit logging process failures: Alternate audit logging capability
Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements [Assignment: organization-defined alternate audit logging functionality].		 Control Not selected NA NA
AU 06 Audit record review, analysis, and reporting
  1. Review and analyze system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
  2. Report findings to [Assignment: organization-defined personnel or roles].
  3. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
 Control Selected NA NA
AU 06(01) Audit record review, analysis, and reporting Audit record review, analysis, and reporting: Automated process integration
Integrate audit record review, analysis, and reporting processes using [Assignment: organization-defined automated mechanisms].		 Control Selected NA NA
AU 06(02) Audit record review, analysis, and reporting Audit record review, analysis, and reporting: Automated security alerts
Withdrawn: Incorporated into SI-04.		 NA NA NA NA
AU 06(03) Audit record review, analysis, and reporting Audit record review, analysis, and reporting: Correlate audit record repositories
Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.		 Control Selected NA NA
AU 06(04) Audit record review, analysis, and reporting Audit record review, analysis, and reporting: Central review and analysis
Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.		 Control Selected NA NA
AU 06(05) Audit record review, analysis, and reporting Audit record review, analysis, and reporting: Integrated analysis of audit records
Integrate analysis of audit records with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; [Assignment: organization-defined data/information collected from other sources]] to further enhance the ability to identify inappropriate or unusual activity.		 Control Not selected NA NA
AU 06(06) Audit record review, analysis, and reporting Audit record review, analysis, and reporting: Correlation with physical monitoring
Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.		 Control Not selected NA NA
AU 06(07) Audit record review, analysis, and reporting Audit record review, analysis, and reporting: Permitted actions
Specify the permitted actions for each [Selection (one or more): system process; role; user] associated with the review, analysis, and reporting of audit record information.		 Control Not selected NA NA
AU 06(08) Audit record review, analysis, and reporting Audit record review, analysis, and reporting: Full text analysis of privileged commands
Perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedicated to that analysis.		 Control Not selected NA NA
AU 06(09) Audit record review, analysis, and reporting Audit record review, analysis, and reporting: Correlation with information from nontechnical sources
Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.		 Control Not selected NA NA
AU 06(10) Audit record review, analysis, and reporting Audit record review, analysis, and reporting: Audit level adjustment
Withdrawn: Incorporated into AU-06.		 NA NA NA NA
AU 07 Audit record reduction and report generation Provide and implement an audit record reduction and report generation capability that:
  1. supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents
  2. does not alter the original content or time ordering of audit records
 Control Selected NA NA
AU 07(01) Audit record reduction and report generation Audit record reduction and report generation: Automatic processing
Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: organization-defined fields within audit records].		 Control Selected NA NA
AU 07(02) Audit record reduction and report generation Audit record reduction and report generation: Automatic sort and search
Withdrawn: Incorporated into AU-07(01).		 NA NA NA NA
AU 08 Time stamps
  1. Use internal system clocks to generate time stamps for audit records.
  2. Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and that use Coordinated Universal Time (UTC), have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.
 Control Selected NA NA
AU 08(01) Time stamps Time stamps: Synchronization with authoritative time source
Withdrawn: Moved to SC-45(01).		 NA NA NA NA
AU 08(02) Time stamps Time stamps: Secondary authoritative time source
Withdrawn: Moved to SC-45(02).		 NA NA NA NA
AU 09 Protection of audit information
  1. Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
  2. Alert [Assignment: organization-defined personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.
 Control Selected NA NA
AU 09(01) Protection of audit information Protection of audit information: Hardware write-once media
Write audit trails to hardware-enforced, write-once media.		 Control Not selected NA NA
AU 09(02) Protection of audit information Protection of audit information: Store on separate physical systems or components
Store audit records [Assignment: organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited.		 Control Selected NA NA
AU 09(03) Protection of audit information Protection of audit information: Cryptographic protection
Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.		 Control Not selected NA NA
AU 09(04) Protection of audit information Protection of audit information: Access by subset of privileged users
Authorize access to management of audit logging functionality to only [Assignment: organization-defined subset of privileged users or roles].		 Control Selected NA NA
AU 09(05) Protection of audit information Protection of audit information: Dual authorization
Enforce dual authorization for [Selection (one or more): movement; deletion] of [Assignment: organization-defined audit information].		 Control Not selected NA NA
AU 09(06) Protection of audit information Protection of audit information: Read-only access
Authorize read-only access to audit information to [Assignment: organization-defined subset of privileged users or roles].		 Control Selected NA NA
AU 09(07) Protection of audit information Protection of audit information: Store on component with different operating system
Store audit information on a component running a different operating system than the system or component being audited.		 Control Not selected NA NA
AU 10 Non-repudiation Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: organization-defined actions to be covered by non-repudiation]. Control Not selected NA NA
AU 10(01) Non-repudiation Non-repudiation: Association of identities
  1. Bind the identity of the information producer with the information to [Assignment: organization-defined strength of binding].
  2. Provide the means for authorized individuals to determine the identity of the producer of the information.
 Control Not selected NA NA
AU 10(02) Non-repudiation Non-repudiation: Validate binding of information producer identity
  1. Validate the binding of the information producer identity to the information at [Assignment: organization-defined frequency].
  2. Perform [Assignment: organization-defined actions] in the event of a validation error.
 Control Not selected NA NA
AU 10(03) Non-repudiation Non-repudiation: Chain of custody
Maintain reviewer or releaser credentials within the established chain of custody for information reviewed or released.		 Control Not selected NA NA
AU 10(04) Non-repudiation Non-repudiation: Validate binding of information reviewer identity
  1. Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [Assignment: organization-defined security domains].
  2. Perform [Assignment: organization-defined actions] in the event of a validation error.
 Control Not selected NA NA
AU 10(05) Non-repudiation Non-repudiation: Digital signatures
Withdrawn: Incorporated into SI-07.		 NA NA NA NA
AU 11 Audit record retention Retain audit records for [Assignment: organization-defined time period consistent with records retention policy] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements. Control Selected NA NA
AU 11(01) Audit record retention Audit record retention: Long-term retrieval capability
Employ [Assignment: organization-defined measures] to ensure that long-term audit records generated by the system can be retrieved.		 Control Not selected NA NA
AU 12 Audit record generation
  1. Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-02A on [Assignment: organization-defined system components].
  2. Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system.
  3. Generate audit records for the event types defined in AU-02C that include the audit record content defined in AU-03.
 Control Selected NA NA
AU 12(01) Audit record generation Audit record generation: System-wide and time-correlated audit trail
Compile audit records from [Assignment: organization-defined system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance for the relationship between time stamps of individual records in the audit trail].		 Control Selected NA NA
AU 12(02) Audit record generation Audit record generation: Standardized formats
Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.		 Control Not selected NA NA
AU 12(03) Audit record generation Audit record generation: Changes by authorized individuals
Provide and implement the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds].		 Control Not selected NA NA
AU 12(04) Audit record generation Audit record generation: Query parameter audits of personal information
Provide and implement the capability for auditing the parameters of user query events for data sets containing personal information.		 Control Not selected NA NA
AU 13 Monitoring for information disclosure
  1. Monitor [Assignment: organization-defined open-source information and/or information sites] [Assignment: organization-defined frequency] for evidence of unauthorized disclosure of organizational information.
  2. If an information disclosure is discovered:
    1. notify [Assignment: organization-defined personnel or roles]
    2. take the following additional actions: [Assignment: organization-defined additional actions]
 Control Not selected NA NA
AU 13(01) Monitoring for information disclosure Monitoring for information disclosure: Use of automated tools
Monitor open-source information and information sites using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
AU 13(02) Monitoring for information disclosure Monitoring for information disclosure: Review of monitored sites
Review the list of open-source information sites being monitored [Assignment: organization-defined frequency].		 Control Not selected NA NA
AU 13(03) Monitoring for information disclosure Monitoring for information disclosure: Unauthorized replication of information
Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner.		 Control Not selected NA NA
AU 14 Session audit
  1. Provide and implement the capability for [Assignment: organization-defined users or roles] to [Selection (one or more): record; view; hear; log] the content of a user session under [Assignment: organization-defined circumstances].
  2. Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines.
 Control Not selected NA NA
AU 14(01) Session audit Session audit: System start-up Initiate session audits automatically at system start-up. Control Not selected NA NA
AU 14(02) Session audit Session audit: Capture/record and log content
Withdrawn: Incorporated into AU-14.		 NA NA NA NA
AU 14(03) Session audit Session audit: Remote viewing and listening
Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time.		 Control Not selected NA NA
AU 15 Alternate audit capability Withdrawn: Moved to AU-05(05). NA NA NA NA
AU 16 Cross-organizational audit logging Employ [Assignment: organization-defined methods] for coordinating [Assignment: organization-defined audit information] among external organizations when audit information is transmitted across organizational boundaries. Control Not selected NA NA
AU 16(01) Cross-organizational audit logging Cross-organizational audit logging: Identity preservation
Preserve the identity of individuals in cross-organizational audit trails.		 Control Not selected NA NA
AU 16(02) Cross-organizational audit logging Cross-organizational audit logging: Sharing of audit information
Provide cross-organizational audit information to [Assignment: organization-defined organizations] based on [Assignment: organization-defined cross-organizational sharing agreements].		 Control Not selected NA NA
AU 16(03) Cross-organizational audit logging Cross-organizational audit logging: Disassociability
Implement [Assignment: organization-defined measures] to disassociate individuals from audit information transmitted across organizational boundaries.		 Control Not selected NA NA
 
Top of page 
 
Table 4.4: Assessment, authorization, and monitoring
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
CA 01 Assessment, authorization, and monitoring policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] assessment, authorization, and monitoring policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, jurisprudence, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures.
  3. Review and update the current assessment, authorization, and monitoring:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
CA 02 Control assessments
  1. Select the appropriate assessor or assessment team for the type of assessment to be conducted.
  2. Develop a control assessment plan that describes the scope of the assessment including:
    1. controls and control enhancements under assessment
    2. assessment procedures to be used to determine control effectiveness
    3. assessment environment, assessment team, and assessment roles and responsibilities
  3. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment.
  4. Assess the controls in the system and its environment of operation [Assignment: organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements.
  5. Produce a control assessment report, Privacy Impact Assessment or Privacy Protocol that documents the results of the assessment.
  6. Provide the results of the control assessment to [Assignment: organization-defined individuals or roles].
 Activity Selected NA NA
CA 02(01) Control assessments Control assessments: Independent assessors
Employ independent assessors or assessment teams to conduct control assessments.		 Activity Selected NA NA
CA 02(02) Control assessments Control assessments: Specialized assessments
Include as part of control assessments, [Assignment: organization-defined frequency], [Selection: announced; unannounced], [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: organization-defined other forms of assessment]].		 Activity Not selected NA NA
CA 02(03) Control assessments Control assessments: Leveraging results from external organizations
Leverage the results of control assessments performed by [Assignment: organization-defined external organization(s)] on [Assignment: organization-defined system] when the assessment meets [Assignment: organization-defined requirements].		 Activity Not selected NA NA
CA 03 Information exchange
  1. Approve and manage the exchange of information between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; information sharing agreements; information sharing arrangements; service level agreements; user agreements; nondisclosure agreements; [Assignment: organization-defined type of agreement]].
  2. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated.
  3. Review and update the agreements [Assignment: organization-defined frequency].
 Control Selected NA NA
CA 03(01) Information exchange Information exchange: Unclassified national security system connections
Withdrawn: Moved to SC-07(25).		 NA NA NA NA
CA 03(02) Information exchange Information exchange: Classified national security system connections
Withdrawn: Moved to SC-07(26).		 NA NA NA NA
CA 03(03) Information exchange Information exchange: Unclassified non-national security system connections
Withdrawn: Moved to SC-07(27).		 NA NA NA NA
CA 03(04) Information exchange Information exchange: Connections to public networks
Withdrawn: Moved to SC-07(28).		 NA NA NA NA
CA 03(05) Information exchange Information exchange: Restrictions on external system connections
Withdrawn: Moved to SC-07(05).		 NA NA NA NA
CA 03(06) Information exchange Information exchange: Transfer authorizations
Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.		 Control Not selected NA NA
CA 03(07) Information exchange Information exchange: Transitive information exchanges
  1. Identify transitive (downstream) information exchanges with other systems through the systems identified in CA-03A.
  2. Take measures to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.
 Control Not selected NA NA
CA 04 Security certification Withdrawn: Incorporated into CA-02. NA NA NA NA
CA 05 Plan of action and milestones
  1. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system.
  2. Update existing plan of action and milestones [Assignment: organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.
 Activity Selected NA NA
CA 05(01) Plan of action and milestones Plan of action and milestones: Automation support for accuracy and currency
Ensure the accuracy, currency, and availability of the plan of action and milestones for the system using [Assignment: organization-defined automated mechanisms].		 Activity Not selected NA NA
CA 06 Authorization
  1. Assign a senior official as the authorizing official or custodian for the system.
  2. Assign a senior official as the authorizing official or custodian for common controls available for inheritance by organizational systems.
  3. Ensure that the authorizing official or custodian for the system, before commencing operations:
    1. accepts the use of common controls inherited by the system
    2. authorizes the system to operate
  4. Ensure that the authorizing official or custodian for common controls authorizes the use of those controls for inheritance by organizational systems.
  5. Update the authorizations [Assignment: organization-defined frequency].
 Control Selected NA NA
CA 06(01) Authorization Authorization: joint authorization — Intra-organization
Employ a joint authorization process for the system that includes multiple authorizing officials from the same organization conducting the authorization.		 Control Not selected NA NA
CA 06(02) Authorization Authorization: joint authorization — Inter-organization
Employ a joint authorization process for the system that includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.		 Control Not selected NA NA
CA 07 Continuous monitoring Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:
  1. establishing the following system-level metrics to be monitored: [Assignment: organization-defined system-level metrics]
  2. establishing [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessment of control effectiveness
  3. ongoing control assessments in accordance with the continuous monitoring strategy
  4. ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy
  5. correlation and analysis of information generated by control assessments and monitoring
  6. response actions to address results of the analysis of control assessment and monitoring information
  7. reporting the security and privacy status of the system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency]
 Control Selected NA NA
CA 07(01) Continuous monitoring Continuous monitoring: Independent assessment
Employ independent assessors or assessment teams to monitor the controls in the system on an ongoing basis.		 Control Selected NA NA
CA 07(02) Continuous monitoring Continuous monitoring: Types of assessments
Withdrawn: Incorporated into CA-02.		 NA NA NA NA
CA 07(03) Continuous monitoring Continuous monitoring: Trend analyses
Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data.		 Control Not selected NA NA
CA 07(04) Continuous monitoring Continuous monitoring: Risk monitoring
Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes the following:
  1. effectiveness monitoring
  2. compliance monitoring
  3. change monitoring
 Control Selected NA NA
CA 07(05) Continuous monitoring Continuous monitoring: Consistency analysis
Employ the following actions to validate that policies are established and implemented controls are operating in a consistent manner: [Assignment: organization-defined actions].		 Control Not selected NA NA
CA 07(06) Continuous monitoring Continuous monitoring: Automation support for monitoring
Ensure the accuracy, currency, and availability of monitoring results for the system using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
CA 08 Penetration testing Conduct penetration testing [Assignment: organization-defined frequency] on [Assignment: organization-defined systems or system components]. Control Not selected NA NA
CA 08(01) Penetration testing Penetration testing: Independent penetration testing agent or team
Employ an independent penetration testing agent or team to perform penetration testing on the system or system components.		 Control Not selected NA NA
CA 08(02) Penetration testing Penetration testing: Red team exercises
Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises].		 Control Not selected NA NA
CA 08(03) Penetration testing Penetration testing: Facility penetration testing
Employ a penetration testing process that includes [Assignment: organization-defined frequency] [Selection (one or more): announced; unannounced] attempts to bypass or circumvent controls associated with physical access points to the facility.		 Control Not selected NA NA
CA 09 Internal system connections
  1. Authorize internal connections of [Assignment: organization-defined system components or classes of components] to the system.
  2. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated.
  3. Terminate internal system connections after [Assignment: organization-defined conditions].
  4. Review [Assignment: organization-defined frequency] the continued need for each internal connection.
 Control Selected NA NA
CA 09(01) Internal system connections Internal system connections: Compliance checks
Perform security and privacy compliance checks on constituent system components prior to the establishment of the internal connection.		 Control Selected NA NA
 
Top of page 
 
Table 4.5: Configuration management
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
CM 01 Configuration management policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] configuration management policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the configuration management policy and the associated configuration management controls.
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the configuration management policy and procedures.
  3. Review and update the current configuration management:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
CM 02 Baseline configuration
  1. Develop, document, and maintain under configuration control, a current baseline configuration of the system.
  2. Review and update the baseline configuration of the system:
    1. [Assignment: organization-defined frequency]
    2. when required due to [Assignment: organization-defined circumstances]
    3. when system components are installed or upgraded
 Control Selected NA NA
CM 02(01) Baseline configuration Baseline configuration: Reviews and updates
Withdrawn: Incorporated into CM-02.		 NA NA NA NA
CM 02(02) Baseline configuration Baseline configuration: Automation support for accuracy and currency
Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: organization-defined automated mechanisms].		 Control Selected NA NA
CM 02(03) Baseline configuration Baseline configuration: Retention of previous configurations
Retain [Assignment: organization-defined number] of previous versions of baseline configurations of the system to support rollback.		 Control Selected NA NA
CM 02(04) Baseline configuration Baseline configuration: Unauthorized software
Withdrawn: Incorporated into CM-07(04).		 NA NA NA NA
CM 02(05) Baseline configuration Baseline configuration: Authorized software
Withdrawn: Incorporated into CM-07(05).		 NA NA NA NA
CM 02(06) Baseline configuration Baseline configuration: Development and test environments
Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration.		 Control Selected NA NA
CM 02(07) Baseline configuration Baseline configuration: Configure systems and components for high-risk areas
  1. Issue [Assignment: organization-defined systems or system components] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to be of significant risk.
  2. Apply the following controls to the systems or components when the individuals return from travel: [Assignment: organization-defined controls].
 Control Selected NA NA
CM 03 Configuration change control
  1. Determine and document the types of changes to the system that are configuration-controlled.
  2. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses.
  3. Document configuration change decisions associated with the system.
  4. Implement approved configuration-controlled changes to the system.
  5. Retain records of configuration-controlled changes to the system for [Assignment: organization-defined time period].
  6. Monitor and review activities associated with configuration-controlled changes to the system.
  7. Coordinate and provide oversight for configuration change control activities through [Assignment: organization-defined configuration change control element] that convenes [Selection (one or more): [Assignment: organization-defined frequency]; when [Assignment: organization-defined configuration change conditions]].
 Control Selected NA NA
CM 03(01) Configuration change control Configuration change control: Automated documentation, notification, and prohibition of changes
Use [Assignment: organization-defined automated mechanisms] to:
  1. document proposed changes to the system
  2. notify [Assignment: organization-defined approval authorities] of proposed changes to the system and request change approval
  3. highlight proposed changes to the system that have not been approved or disapproved within [Assignment: organization-defined time period]
  4. prohibit changes to the system until designated approvals are received
  5. document all changes to the system
  6. notify [Assignment: organization-defined personnel] when approved changes to the system are completed
 Control Not selected NA NA
CM 03(02) Configuration change control Configuration change control: Testing, validation, and documentation of changes
Test, validate, and document changes to the system before finalizing the implementation of the changes.		 Control Selected NA NA
CM 03(03) Configuration change control Configuration change control: Automated change implementation
Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
CM 03(04) Configuration change control Configuration change control: Security and privacy representatives
Require [Assignment: organization-defined security and privacy representatives] to be members of the [Assignment: organization-defined configuration change control element].		 Control Selected NA NA
CM 03(05) Configuration change control Configuration change control: Automated security response
Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: [Assignment: organization-defined security responses].		 Control Not selected NA NA
CM 03(06) Configuration change control Configuration change control: Cryptography management
Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: [Assignment: organization-defined controls].		 Control Not selected NA NA
CM 03(07) Configuration change control Configuration change control: Review system changes
Review changes to the system [Assignment: organization-defined frequency] or when [Assignment: organization-defined circumstances] to determine whether unauthorized changes have occurred.		 Control Not selected NA NA
CM 03(08) Configuration change control Configuration change control: Prevent or restrict configuration changes
Prevent or restrict changes to the configuration of the system under the following circumstances: [Assignment: organization-defined circumstances].		 Control Not selected NA NA
CM 04 Impact analyses Analyze changes to the system to determine potential security and privacy impacts prior to change implementation. Control Selected NA NA
CM 04(01) Impact analyses Impact analyses: Separate test environments
Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.		 Control Selected NA NA
CM 04(02) Impact analyses Impact analyses: Verification of controls
After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements for the system.		 Control Selected NA NA
CM 05 Access restrictions for change Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system. Control Selected NA NA
CM 05(01) Access restrictions for change Access restrictions for change: Automated access enforcement and audit records
  1. Enforce access restrictions using [Assignment: organization-defined automated mechanisms].
  2. Automatically generate audit records of the enforcement actions.
 Control Not selected NA NA
CM 05(02) Access restrictions for change Access restrictions for change: Review system changes
Withdrawn: Incorporated into CM-03(07).		 Control NA NA NA
CM 05(03) Access restrictions for change Access restrictions for change: Signed components
Withdrawn: Moved to CM-14.		 NA NA NA NA
CM 05(04) Access restrictions for change Access restrictions for change: Dual authorization
Enforce dual authorization for implementing changes to [Assignment: organization-defined system components and system-level information].		 Control Not selected NA NA
CM 05(05) Access restrictions for change Access restrictions for change: Privilege limitation for production and operation
  1. Limit privileges to change system components and system-related information within a production or operational environment.
  2. Review and re-evaluate privileges [Assignment: organization-defined frequency].
 Control Not selected NA NA
CM 05(06) Access restrictions for change Access restrictions for change: Limit library privileges
Limit privileges to change software resident within software libraries.		 Control Not selected NA NA
CM 05(07) Access restrictions for change Access restrictions for change: Automatic implementation of security safeguards
Withdrawn: Incorporated into SI-07.		 NA NA NA NA
CM 06 Configuration settings
  1. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organization-defined common secure configurations].
  2. Implement the configuration settings.
  3. Identify, document, and approve any deviations from established configuration settings for [Assignment: organization-defined system components] based on [Assignment: organization-defined operational requirements].
  4. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.
 Control Selected NA NA
CM 06(01) Configuration settings Configuration settings: Automated management, application, and verification
Manage, apply, and verify configuration settings for [Assignment: organization-defined system components] using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
CM 06(02) Configuration settings Configuration settings: Respond to unauthorized changes
Take the following actions in response to unauthorized changes to [Assignment: organization-defined configuration settings]: [Assignment: organization-defined actions].		 Control Not selected NA NA
CM 06(03) Configuration settings Configuration settings: Unauthorized change detection
Withdrawn: Incorporated into SI-07.		 NA NA NA NA
CM 06(04) Configuration settings Configuration settings: Conformance demonstration
Withdrawn: Incorporated into CM-04.		 NA NA NA NA
CM 07 Least functionality
  1. Configure the system to provide only [Assignment: organization-defined mission essential capabilities].
  2. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].
 Control Selected NA NA
CM 07(01) Least functionality Least functionality: Periodic review
  1. Review the system [Assignment: organization-defined frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services.
  2. Disable or remove [Assignment: organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure].
 Control Selected NA NA
CM 07(02) Least functionality Least functionality: Prevent program execution
Prevent program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions]; rules authorizing the terms and conditions of software program usage].		 Control Selected NA NA
CM 07(03) Least functionality Least functionality: Registration compliance
Ensure compliance with [Assignment: organization-defined registration requirements for functions, ports, protocols, and services].		 Control Not selected NA NA
CM 07(04) Least functionality Least functionality: Unauthorized software - deny-by-exception
  1. Identify [Assignment: organization-defined software programs not authorized to execute on the system].
  2. Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system.
  3. Review and update the list of unauthorized software programs [Assignment: organization-defined frequency].
 Control Not selected NA NA
CM 07(05) Least functionality Least functionality: Authorized software - allow-by-exception
  1. Identify [Assignment: organization-defined software programs authorized to execute on the system].
  2. Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system.
  3. Review and update the list of authorized software programs [Assignment: organization-defined frequency].
 Control Selected NA NA
CM 07(06) Least functionality Least functionality: Confined environments with limited privileges
Require that the following user-installed software execute in a confined physical or virtual machine environment with limited privileges: [Assignment: organization-defined user-installed software].		 Control Not selected NA NA
CM 07(07) Least functionality Least functionality: Code execution in protected environment
Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of [Assignment: organization-defined personnel or roles] when such code is:
  1. obtained from sources with limited or no warranty
  2. without the provision of source code
 Control Not selected NA NA
CM 07(08) Least functionality Least functionality: Binary or machine executable code
  1. Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code.
  2. Allow exceptions only for compelling mission or operational requirements and with the approval of the authorizing official.
 Control Not selected NA NA
CM 07(09) Least functionality Least functionality: Prohibiting the use of unauthorized hardware
  1. Identify [Assignment: organization-defined hardware components authorized for system use].
  2. Prohibit the use or connection of unauthorized hardware components.
  3. Review and update the list of authorized hardware components [Assignment: organization-defined frequency].
 Control Not selected NA NA
CM 08 System component inventory
  1. Develop and document an inventory of system components that:
    1. accurately reflects the system
    2. includes all components within the system
    3. does not include duplicate accounting of components or components assigned to any other system
    4. is at the level of granularity deemed necessary for tracking and reporting
    5. includes the following information to achieve system component accountability: [Assignment: organization-defined information deemed necessary to achieve effective system component accountability]
  2. Review and update the system component inventory [Assignment: organization-defined frequency].
 Control Selected NA NA
CM 08(01) System component inventory System component inventory: Updates during installations and removals
Update the inventory of system components as part of component installations, removals, and system updates.		 Control Selected NA NA
CM 08(02) System component inventory System component inventory: Automated maintenance
Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
CM 08(03) System component inventory System component inventory: Automated unauthorized component detection
  1. Detect the presence of unauthorized hardware, software, and firmware components within the system using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency].
  2. Take the following actions when unauthorized components are detected: [Selection (one or more): disable network access by such components; isolate the components; notify [Assignment: organization-defined personnel or roles]].
 Control Selected NA NA
CM 08(04) System component inventory System component inventory: Accountability information
Include in the system component inventory information, a means for identifying by [Selection (one or more): name; position; role], individuals responsible and accountable for administering those components.		 Control Selected NA NA
CM 08(05) System component inventory System component inventory: No duplicate accounting of components
Withdrawn: Incorporated into CM-08.		 NA NA NA NA
CM 08(06) System component inventory System component inventory: Assessed configurations and approved deviations
Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.		 Control Selected NA NA
CM 08(07) System component inventory System component inventory: Centralized repository
Provide a centralized repository for the inventory of system components.		 Control Not selected NA NA
CM 08(08) System component inventory System component inventory: Automated location tracking
Support the tracking of system components by geographic location using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
CM 08(09) System component inventory System component inventory: Assignment of components to systems
  1. Assign system components to a system.
  2. Receive an acknowledgement from [Assignment: organization-defined personnel or roles] of this assignment.
 Control Not selected NA NA
CM 09 Configuration management plan Develop, document, and implement a configuration management plan for the system that:
  1. addresses roles, responsibilities, and configuration management processes and procedures
  2. establishes a process for identifying configuration items throughout the system development lifecycle and for managing the configuration of the configuration items
  3. defines the configuration items for the system and places the configuration items under configuration management
  4. is reviewed and approved by [Assignment: organization-defined personnel or roles]
  5. protects the configuration management plan from unauthorized disclosure and modification
 Control Selected NA NA
CM 09(01) Configuration management plan Configuration management plan: Assignment of responsibility
Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.		 Control Not selected NA NA
CM 10 Software usage restrictions
  1. Use software and associated documentation in accordance with contract agreements and copyright laws.
  2. Track the use of software and associated documentation protected by quantity licenses to control copying and distribution.
  3. Control and document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.
 Control Selected NA NA
CM 10(01) Software usage restrictions Software usage restrictions: Open-source software
Establish the following restrictions on the use of open-source software: [Assignment: organization-defined restrictions].		 Control Not selected NA NA
CM 11 User-installed software
  1. Establish [Assignment: organization-defined policies] governing the installation of software by users.
  2. Enforce software installation policies through the following methods: [Assignment: organization-defined methods].
  3. Monitor policy compliance [Assignment: organization-defined frequency].
 Control Selected NA NA
CM 11(01) User-installed software User-installed software: Alerts for unauthorized installations
Withdrawn: Incorporated into CM-08(03).		 NA NA NA NA
CM 11(02) User-installed software User-installed software: Software installation with privileged status
Allow user installation of software only with explicit privileged status.		 Control Selected NA NA
CM 11(02) User-installed software User-installed software: Automated enforcement and monitoring
Enforce and monitor compliance with software installation policies using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
CM 12 Information location
  1. Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored.
  2. Identify and document the users who have access to the system and system components where the information is processed and stored.
  3. Document changes to the location (i.e., system or system components) where the information is processed and stored.
 Control Selected NA NA
CM 12(01) Information location Information location: Automated tools to support information location
Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect organizational information and individual privacy.		 Control Selected NA NA
CM 13 Data action mapping Develop and document a map of system data actions. Control Not selected NA NA
CM 14 Signed components Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization. Control Not selected NA NA
 
Top of page 
 
Table 4.6: Contingency planning
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
CP 01 Contingency planning policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] contingency planning policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, jurisprudence, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the contingency planning policy and the associated contingency planning controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the contingency planning policy and procedures.
  3. Review and update the current contingency planning:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
CP 02 Contingency plan
  1. Develop a contingency plan for the system that:
    1. identifies essential mission and business functions and associated contingency requirements
    2. provides recovery objectives, restoration priorities, and metrics
    3. addresses contingency roles, responsibilities, assigned individuals with contact information
    4. addresses maintaining essential mission and business functions despite a system disruption, compromise, or failure
    5. addresses eventual, full system restoration without deterioration of the controls originally planned and implemented
    6. addresses the integrity of the data held within the system, including personal information
    7. addresses the impact, injury, or consequence of a system compromise, including with respect to personal information
    8. addresses the sharing of contingency information
    9. is reviewed and approved by [Assignment: organization-defined personnel or roles]
  2. Distribute copies of the contingency plan to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements].
  3. Ensure individuals with responsibilities review the contingency plan and understand their roles.
  4. Coordinate contingency planning activities with incident handling activities.
  5. Review the contingency plan for the system [Assignment: organization-defined frequency].
  6. Update the contingency plan to address changes to the organization, system, or environment of operation and problems encountered during contingency plan implementation, execution, or testing.
  7. Communicate contingency plan changes to [Assignment: organization-defined key contingency personnel (identified by name and/or by role) and organizational elements].
  8. Incorporate lessons learned from contingency plan testing, training, or actual contingency activities into contingency testing and training.
  9. Protect the contingency plan from unauthorized disclosure and modification.
 Control Selected NA NA
CP 02(01) Contingency plan Contingency plan: Coordinate with related plans
Coordinate contingency plan development with organizational elements responsible for related plans.		 Control Selected NA NA
CP 02(02) Contingency plan Contingency plan: Capacity planning
Conduct capacity planning so that necessary capacity for information processing, telecommunications, and environmental support exists during contingency operations.		 Control Selected NA NA
CP 02(03) Contingency plan Contingency plan: Resume mission and business functions
Plan for the resumption of [Selection (one): all; essential] mission and business functions within [Assignment: organization-defined time period] of contingency plan activation.		 Control Selected NA NA
CP 02(04) Contingency plan Contingency plan: Resume all missions / business functions
Withdrawn: Incorporated into CP-02(03).		 NA NA NA NA
CP 02(05) Contingency plan Contingency plan: Continue mission and business functions
Plan for the continuance of [Selection (one): all; essential] mission and business functions with minimal or no loss of operational continuity and sustain that continuity until full system restoration at primary processing and/or storage sites.		 Control Not selected NA NA
CP 02(06) Contingency plan Contingency plan: Alternate processing and storage site
Plan for the transfer of [Selection (one): all; essential] mission and business functions to alternate processing and/or storage sites with minimal or no loss of operational continuity and sustain that continuity through system restoration to primary processing and/or storage sites.		 Control Not selected NA NA
CP 02(07) Contingency plan Contingency plan: Coordinate with external service providers
Coordinate the contingency plan with the contingency plans of external service providers to ensure that contingency requirements can be satisfied.		 Control Not selected NA NA
CP 02(08) Contingency plan Contingency plan: Identify critical assets
Identify critical system assets supporting [Selection (one): all; essential] mission and business functions.		 Control Selected NA NA
CP 03 Contingency training
  1. Provide contingency training to system users consistent with assigned roles and responsibilities:
    1. within [Assignment: organization-defined time period] of assuming a contingency role or responsibility
    2. when required by system changes
    3. [Assignment: organization-defined frequency] thereafter
  2. Review and update contingency training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
 Control Selected NA NA
CP 03(01) Contingency training Contingency training: Simulated events
Incorporate simulated events into contingency training to facilitate effective response by personnel in crisis situations.		 Control Not selected NA NA
CP 03(02) Contingency training Contingency training: Mechanisms used in training environments
Employ mechanisms used in operations to provide a more thorough and realistic contingency training environment.		 Control Not selected NA NA
CP 04 Contingency plan testing
  1. Test the contingency plan for the system [Assignment: organization-defined frequency] using the following tests to determine the effectiveness of the plan and the readiness to execute the plan: [Assignment: organization-defined tests].
  2. Review the contingency plan test results.
  3. Initiate corrective actions, if needed.
 Control Selected NA NA
CP 04(01) Contingency plan testing Contingency plan testing: Coordinate with related plans
Coordinate contingency plan testing with organizational elements responsible for related plans.		 Control Selected NA NA
CP 04(02) Contingency plan testing Contingency plan testing: Alternate processing site
Test the contingency plan at the alternate processing site to:
  1. familiarize contingency personnel with the facility and available resources
  2. evaluate the capabilities of the alternate processing site to support contingency operations
 Control Not selected NA NA
CP 04(03) Contingency plan testing Contingency plan testing: Automated testing
Test the contingency plan using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
CP 04(04) Contingency plan testing Contingency plan testing: Full recovery and reconstitution
Include a full recovery and reconstitution of the system to a known state as part of contingency plan testing.		 Control Not selected NA NA
CP 04(05) Contingency plan testing Contingency plan testing: Self-challenge
Employ [Assignment: organization-defined mechanisms] to [Assignment: organization-defined system or system component] to disrupt and adversely affect the system or system component.		 Control Not selected NA NA
CP 05 Contingency plan update Withdrawn: Incorporated into CP-02. NA NA NA NA
CP 06 Alternate storage site
  1. Establish an alternate storage site, including necessary agreements to permit the storage and retrieval of system backup information.
  2. Ensure that the alternate storage site provides controls equivalent to that of the primary site.
 Control Selected NA NA
CP 06(01) Alternate storage site Alternate storage site: Separation from primary site
Identify an alternate storage site that is sufficiently separated from the primary storage site to reduce susceptibility to the same threats.		 Control Selected NA NA
CP 06(02) Alternate storage site Alternate storage site: Recovery time and recovery point objectives
Configure the alternate storage site to facilitate recovery operations in accordance with recovery time and recovery point objectives.		 Control Not selected NA NA
CP 06(03) Alternate storage site Alternate storage site: Accessibility
Identify potential accessibility problems to the alternate storage site in the event of an area-wide disruption or disaster and outline explicit mitigation actions.		 Control Selected NA NA
CP 07 Alternate processing site
  1. Establish an alternate processing site, including necessary agreements to permit the transfer and resumption of [Assignment: organization-defined system operations] for essential mission and business functions within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] when the primary processing capabilities are unavailable.
  2. Make available at the alternate processing site the equipment and supplies required to transfer and resume operations or put contracts in place to support delivery to the site within the organization-defined time period for transfer and resumption.
  3. Provide controls at the alternate processing site that are equivalent to those at the primary site.
 Control Selected NA NA
CP 07(01) Alternate processing site Alternate processing site: Separation from primary site
Identify an alternate processing site that is sufficiently separated from the primary processing site to reduce susceptibility to the same threats.		 Control Selected NA NA
CP 07(02) Alternate processing site Alternate processing site: Accessibility
Identify potential accessibility problems to alternate processing sites in the event of an area-wide disruption or disaster and outlines explicit mitigation actions.		 Control Selected NA NA
CP 07(03) Alternate processing site Alternate processing site: Priority of service
Develop alternate processing site agreements that contain priority of service provisions in accordance with availability requirements (including recovery time objectives).		 Control Selected NA NA
CP 07(04) Alternate processing site Alternate processing site: Preparation for use
Prepare the alternate processing site so that the site can serve as the operational site supporting essential mission and business functions.		 Control Selected NA NA
CP 07(05) Alternate processing site Alternate processing site: Equivalent information security safeguards
Withdrawn: Incorporated into CP-07.		 NA NA NA NA
CP 07(06) Alternate processing site Alternate processing site: Inability to return to primary site
Plan and prepare for circumstances that preclude returning to the primary processing site.		 Control Selected NA NA
CP 08 Telecommunications services Establish alternate telecommunications services, including necessary agreements to permit the resumption of [Assignment: organization-defined system operations] for essential mission and business functions within [Assignment: organization-defined time period] when the primary telecommunications capabilities are unavailable at either the primary or alternate processing or storage sites. Control Selected NA NA
CP 08(01) Telecommunications services Telecommunications services: Priority of service provisions
  1. Develop primary and alternate telecommunications service agreements that contain priority-of-service provisions in accordance with availability requirements (including recovery time objectives).
  2. Request priority access for dialing (see Industry Canada’s Priority Access for Dialing: telecommunications services in times of crisis) via Innovation, Science and Economic Development Canada (ISED) for all telecommunications services used for national security emergency preparedness if the primary and/or alternate telecommunications services are provided by a common carrier.
 Control Selected NA NA
CP 08(02) Telecommunications services Telecommunications services: Single points of failure
Obtain alternate telecommunications services to reduce the likelihood of sharing a single point of failure with primary telecommunications services.		 Control Selected NA NA
CP 08(03) Telecommunications services Telecommunications services: Separation of primary and alternate providers
Obtain alternate telecommunications services from providers that are separated from primary service providers to reduce susceptibility to the same threats.		 Control Selected NA NA
CP 08(04) Telecommunications services Telecommunications services: Provider contingency plan
  1. Require primary and alternate telecommunications service providers to have contingency plans.
  2. Review provider contingency plans to ensure that the plans meet organizational contingency requirements.
  3. Obtain evidence of contingency testing and training by providers [Assignment: organization-defined frequency].
 Control Not selected NA NA
CP 08(05) Telecommunications services Telecommunications services: Alternate telecommunication service testing
Test alternate telecommunication services [Assignment: organization-defined frequency].		 Control Selected NA NA
CP 09 System backup
  1. Conduct backups of user-level information contained in [Assignment: organization-defined system components] [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives].
  2. Conduct backups of system-level information contained in the system [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives].
  3. Conduct backups of system documentation, including security- and privacy-related documentation [Assignment: organization-defined frequency consistent with recovery time and recovery point objectives].
  4. Protect the confidentiality, integrity, and availability of backup information.
  1. The organization determines retention periods for essential business information and archived backups.
 Control Selected NA NA
CP 09(01) System backup System backup: Testing for reliability and integrity
Test backup information [Assignment: organization-defined frequency] to verify media reliability and information integrity.		 Control Selected NA NA
CP 09(02) System backup System backup: Test restoration using sampling
Use a sample of backup information in the restoration of selected system functions as part of contingency plan testing.		 Control Not selected NA NA
CP 09(03) System backup System backup: Separate storage for critical information
Store backup copies of [Assignment: organization-defined critical system software and other security-related information] in a separate facility or in a fire rated container that is not collocated with the operational system.		 Control Selected NA NA
CP 09(04) System backup System backup: Protection from unauthorized modification
Withdrawn: Incorporated into CP-09.		 NA NA NA NA
CP 09(05) System backup System backup: Transfer to alternate storage site
Transfer system backup information to the alternate storage site [Assignment: organization-defined time period and transfer rate consistent with the recovery time and recovery point objectives].		 Control Selected NA NA
CP 09(06) System backup System backup: Redundant secondary system
Conduct system backup by maintaining a redundant secondary system that is not collocated with the primary system and that can be activated without loss of information or disruption to operations.		 Control Not selected NA NA
CP 09(07) System backup System backup: Dual authorization for deletion or destruction
Enforce dual authorization for the deletion or destruction of [Assignment: organization-defined backup information].		 Control Selected NA NA
CP 09(08) System backup System backup: Cryptographic protection
Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of [Assignment: organization-defined backup information].		 Control Selected NA NA
CP 10 System recovery and reconstitution Provide for the recovery and reconstitution of the system to a known state within [Assignment: organization-defined time period consistent with recovery time and recovery point objectives] after a disruption, compromise, or failure. Control Selected NA NA
CP 10(01) System recovery and reconstitution System recovery and reconstitution: Contingency plan testing
Withdrawn: Incorporated into CP-04.		 NA NA NA NA
CP 10(02) System recovery and reconstitution System recovery and reconstitution: Transaction recovery
Implement transaction recovery for systems that are transaction-based.		 Control Selected NA NA
CP 10(03) System recovery and reconstitution System recovery and reconstitution: Compensating security controls
Withdrawn: Addressed through tailoring procedures.		 NA NA NA NA
CP 10(04) System recovery and reconstitution System recovery and reconstitution: Restore within time period
Provide the capability to restore system components within [Assignment: organization-defined restoration time periods] from configuration-controlled and integrity-protected information representing a known, operational state for the components.		 Control Selected NA NA
CP 10(05) System recovery and reconstitution System recovery and reconstitution: Failover capability
Withdrawn: Incorporated into SI-13.		 NA NA NA NA
CP 10(06) System recovery and reconstitution System recovery and reconstitution: Component protection
Protect system components used for recovery and reconstitution.		 Control Selected NA NA
CP 11 Alternate communications protocols Provide the capability to employ [Assignment: organization-defined alternative communications protocols] in support of maintaining continuity of operations. Control Not selected NA NA
CP 12 Safe mode When [Assignment: organization-defined conditions] are detected, enter a safe mode of operation with [Assignment: organization-defined restrictions of safe mode of operation]. Control Not selected NA NA
CP 13 Alternative security mechanisms Employ [Assignment: organization-defined alternative or supplemental security mechanisms] for satisfying [Assignment: organization-defined security functions] when the primary means of implementing the security function is unavailable or compromised. Control Not selected NA NA
 
Top of page 
 
Table 4.7: Identification and authentication
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
IA 01 Identification and authentication policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] identification and authentication (IA) policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, jurisprudence, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the identification and authentication policy and the associated identification and authentication controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the identification and authentication policy and procedures.
  3. Review and update the current identification and authentication:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
IA 02 Identification and authentication (organizational users) Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users. Control Selected NA NA
IA 02(01) Identification and authentication (organizational users) Identification and authentication (organizational users): Strong MFA to privileged accounts
Implement strong multi-factor authentication for access to privileged accounts.		 Control Selected NA NA
IA 02(02) Identification and authentication (organizational users) Identification and authentication (organizational users): MFA to non-privileged accounts
Implement multi-factor authentication for access to non-privileged accounts.		 Control Selected NA NA
IA 02(03) Identification and authentication (organizational users) Identification and authentication (organizational users): Local access to privileged accounts
Withdrawn: Incorporated into IA-02(01).		 NA NA NA NA
IA 02(04) Identification and authentication (organizational users) Identification and authentication (organizational users): Local access to non-privileged accounts
Withdrawn: Incorporated into IA-02(02).		 NA NA NA NA
IA 02(05) Identification and authentication (organizational users) Identification and authentication (organizational users): Individual authentication with group authentication
When shared accounts or authenticators are employed, require users to be individually authenticated before granting access to the shared accounts or resources.		 Control Not selected NA NA
IA 02(06) Identification and authentication (organizational users) Identification and authentication (organizational users): Access to accounts - separate device
Implement MFA for [Selection (one or more): local; network; remote] access to [Selection (one or more): privileged accounts; non-privileged accounts] such that:
  1. one of the factors is provided by a device separate from the system gaining access
  2. the device meets [Assignment: organization-defined strength of mechanism requirements]
 Control Not selected NA NA
IA 02(07) Identification and authentication (organizational users) Identification and authentication (organizational users): Network access to non-privileged accounts - separate device
Withdrawn: Incorporated into IA-02(06).		 NA NA NA NA
IA 02(08) Identification and authentication (organizational users) Identification and authentication (organizational users): Access to accounts - replay resistant
Implement replay-resistant authentication mechanisms for access to [Selection (one or more): privileged accounts; non-privileged accounts].		 Control Selected NA NA
IA 02(09) Identification and authentication (organizational users) Identification and authentication (organizational users): Network access to non-privileged accounts - replay resistant
Withdrawn: Incorporated into IA-02(08).		 NA NA NA NA
IA 02(10) Identification and authentication (organizational users) Identification and authentication (organizational users): Single sign-on
Provide a single sign-on capability for [Assignment: organization-defined system accounts and services].		 Control Selected NA NA
IA 02(11) Identification and authentication (organizational users) Identification and authentication (organizational users): Remote access - separate device
Withdrawn: Incorporated into IA-02(06).		 NA NA NA NA
IA 02(12) Identification and authentication (organizational users) Identification and authentication (organizational users): Use of hardware token GC-issued PKI-based credentials
Accept and electronically verify GC-issued hardware token PKI-based credentials.		 Control Not selected NA NA
IA 02(13) Identification and authentication (organizational users) Identification and authentication (organizational users): Out-of-band authentication
Implement the following out-of-band authentication mechanisms under [Assignment: organization-defined conditions]: [Assignment: organization-defined out-of-band authentication].		 Control Not selected NA NA
IA 02(400) Identification and authentication (organizational users) Identification and authentication (organizational users): Multi-factor authentication for remote access to privileged accounts
Withdrawn: Incorporated into IA-02(01) and IA-02(06).		 NA NA NA NA
IA 03 Device identification and authentication Uniquely identify and authenticate [Assignment: organization-defined devices and/or types of devices] before establishing a [Selection (one or more): local; remote; network] connection. Control Selected NA NA
IA 03(01) Device identification and authentication Device identification and authentication: Cryptographic bidirectional authentication
Authenticate [Assignment: organization-defined devices and/or types of devices] before establishing [Selection (one or more): local; remote; network] connection using bidirectional authentication that is cryptographically based.		 Control Not selected NA NA
IA 03(02) Device identification and authentication Device identification and authentication: Cryptographic bidirectional network authentication
Withdrawn: Incorporated into IA-03 (01).		 NA NA NA NA
IA 03(03) Device identification and authentication Device identification and authentication: Dynamic address allocation
  1. Where addresses are allocated dynamically, standardize dynamic address allocation lease information and the lease duration assigned to devices in accordance with [Assignment: organization-defined lease information and lease duration].
  2. Audit lease information when assigned to a device.
 Control Not selected NA NA
IA 03(04) Device identification and authentication Device identification and authentication: Device attestation
Handle device identification and authentication based on attestation by [Assignment: organization-defined configuration management process].		 Control Not selected NA NA
IA 04 Identifier management Manage system identifiers by:
  1. receiving authorization from [Assignment: organization-defined personnel or roles] to assign an individual, group, role, service, or device identifier
  2. selecting an identifier that identifies an individual, group, role, service, or device
  3. assigning the identifier to the intended individual, group, role, service, or device
  4. preventing reuse of identifiers for [Assignment: organization-defined time period]
 Control Selected NA NA
IA 04(01) Identifier management Identifier management: Prohibit account identifiers as public identifiers
Prohibit the use of system account identifiers that are the same as public identifiers for individual accounts.		 Control Not selected NA NA
IA 04(02) Identifier management Identifier management: Supervisor authorization
Withdrawn: Incorporated into IA-12(01).		 NA NA NA NA
IA 04(03) Identifier management Identifier management: Multiple forms of certification
Withdrawn: Incorporated into IA-12(02).		 NA NA NA NA
IA 04(04) Identifier management Identifier management: Identify user status
Manage individual identifiers by uniquely identifying each individual as [Assignment: organization-defined characteristic identifying individual status].		 Control Selected NA NA
IA 04(05) Identifier management Identifier management: Dynamic management
Manage individual identifiers dynamically in accordance with [Assignment: organization-defined dynamic identifier policy].		 Control Not selected NA NA
IA 04(06) Identifier management Identifier management: Cross-organization management
Coordinate with the following external organizations for cross-organization management of identifiers: [Assignment: organization-defined external organizations].		 Control Not selected NA NA
IA 04(07) Identifier management Identifier management: In-person registration
Withdrawn: Incorporated into IA-12(04).		 NA NA NA NA
IA 04(08) Identifier management Identifier management: Pairwise pseudonymous identifiers
Generate pairwise pseudonymous identifiers.		 Control Not selected NA NA
IA 04(09) Identifier management Identifier management: Attribute maintenance and protection
Maintain the attributes for each uniquely identified individual, device, or service in [Assignment: organization-defined protected central storage].		 Control Not selected NA NA
IA 04(400) Identifier management Identifier management: Biometrics protection
Maintain adequate protection for biometrics in accordance with privacy regulations.		 Control Not selected NA NA
IA 04(401) Identifier management Identifier management: Biometrics integrity
Ensure the integrity of collected biometrics.		 Control Not selected NA NA
IA 05 Authenticator management Manage system authenticators by:
  1. verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator
  2. establishing initial authenticator content for any authenticators issued by the organization
  3. ensuring that authenticators have sufficient strength of mechanism for their intended use
  4. establishing and implementing administrative procedures for initial authenticator distribution, for lost or compromised or damaged authenticators, and for revoking authenticators
  5. changing default authenticators prior to first use
  6. changing or refreshing authenticators [Assignment: organization-defined time period by authenticator type] or when [Assignment: organization-defined events] occur
  7. protecting authenticator content from unauthorized disclosure and modification
  8. requiring individuals to take, and having devices implement, specific controls to protect authenticators
  9. changing authenticators for group or role accounts when membership to those accounts changes
 Control Selected NA NA
IA 05(01) Authenticator management Authenticator management: Password-based authentication
For password-based authentication:
  1. maintain a list of commonly used, expected, or compromised passwords and update the list [Assignment: organization-defined frequency] and when organizational passwords are suspected to have been compromised directly or indirectly
  2. when users create or update passwords, verify that the passwords are not found on the list of commonly used, expected, or compromised passwords in IA-05(01)a
  3. transmit passwords only over cryptographically protected channels
  4. store passwords using an approved salted key derivation function, preferably using a keyed hash
  5. require immediate selection of a new password upon account recovery
  6. allow user selection of long passwords and passphrases, including spaces and all printable characters
  7. employ automated tools to assist the user in selecting strong password authenticators
  8. enforce the following composition and complexity rules: [Assignment: organization-defined composition and complexity rules]
 Control Selected NA NA
IA 05(02) Authenticator management Authenticator management: Public key-based authentication
  1. For public key-based authentication:
    1. enforce authorized access to the corresponding private key
    2. map the authenticated identity to the account of the individual or group
  2. When public key infrastructure (PKI) is used:
    1. validate certificates by constructing and verifying a certification path to an accepted trust anchor, including checking certificate status information
    2. implement a local cache of revocation data to support path discovery and validation
 Control Selected NA NA
IA 05(03) Authenticator management Authenticator management: In-person or trusted third-party registration
Withdrawn: Incorporated into IA-12(04).		 NA NA NA NA
IA 05(04) Authenticator management Authenticator management: Automated support for password strength determination
Withdrawn: Incorporated into IA-05(01).		 NA NA NA NA
IA 05(05) Authenticator management Authenticator management: Change authenticators prior to delivery
Require developers and installers of system components to provide unique authenticators or change default authenticators prior to delivery and installation.		 Control Not selected NA NA
IA 05(06) Authenticator management Authenticator management: Protection of authenticators
Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.		 Control Selected NA NA
IA 05(07) Authenticator management Authenticator management: No embedded unencrypted static authenticators
Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage.		 Control Selected NA NA
IA 05(08) Authenticator management Authenticator management: Multiple system accounts
Implement [Assignment: organization-defined security controls] to manage the risk of compromise due to individuals having accounts on multiple systems.		 Control Selected NA NA
IA 05(09) Authenticator management Authenticator management: Federated credential management
Use the following external organizations to federate credentials: [Assignment: organization-defined external organizations].		 Control Selected [SSC] NA
IA 05(10) Authenticator management Authenticator management: Dynamic credential binding
Bind identities and authenticators dynamically using the following rules: [Assignment: organization-defined binding rules].		 Control Not selected NA NA
IA 05(11) Authenticator management Authenticator management: Hardware token-based authentication
Withdrawn: Incorporated into IA-02(01) and IA-02(02).		 NA NA NA NA
IA 05(12) Authenticator management Authenticator management: Biometric authentication performance
For biometric-based authentication, employ mechanisms that satisfy the following biometric quality requirements [Assignment: organization-defined biometric quality requirements].		 Control Not selected NA NA
IA 05(13) Authenticator management Authenticator management: Expiration of cached authenticators
Prohibit the use of cached authenticators after [Assignment: organization-defined time period].		 Control Selected NA NA
IA 05(14) Authenticator management Authenticator management: Managing content of PKI trust stores
For PKI-based authentication, employ an organization-wide methodology for managing the content of PKI trust stores installed across all platforms, including networks, operating systems, browsers, and applications.		 Control Selected NA NA
IA 05(15) Authenticator management Authenticator management: Identity, credential and authentication assurance levels compliant products and services
Use only products and services for identity, credential, authentication and access management that are compliant with the required assurance levels.		 Control Not selected NA NA
IA 05(16) Authenticator management Authenticator management: In-person or trusted external party authenticator issuance
Require that the issuance of [Assignment: organization-defined types of and/or specific authenticators] be conducted [Selection (one): in person; by a trusted external party] before [Assignment: organization-defined registration authority] with authorization by [Assignment: organization-defined personnel or roles].		 Control Not selected NA NA
IA 05(17) Authenticator management Authenticator management: Presentation attack detection for biometric authenticators
Employ presentation attack detection mechanisms for biometric-based authentication.		 Control Not selected NA NA
IA 05(18) Authenticator management Authenticator management: Password managers
  1. Employ [Assignment: organization-defined password managers] to generate and manage passwords.
  2. Protect the passwords using [Assignment: organization-defined controls].
 Control Not selected NA NA
IA 06 Authentication feedback Obscure feedback of authentication information during the authentication process to protect the information from possible exploitation and use by unauthorized individuals. Control Selected NA NA
IA 07 Cryptographic module authentication Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Orders in Council, directives, policies, regulations, standards, and guidelines for such authentication. Control Selected NA NA
IA 08 Identification and authentication (non-organizational users) Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users. Control Selected NA NA
IA 08(01) Identification and authentication (non-organizational users) Identification and authentication (non-organizational users): Acceptance of PKI-based credentials from other agencies
Accept and electronically verify PKI-based credentials from other GC departments and agencies.		 Control Selected NA NA
IA 08(02) Identification and authentication (non-organizational users) Identification and authentication (non-organizational users): Acceptance of external authenticators
  1. Accept only external authenticators that are compliant with ITSP.30.031-appropriate level of assurance.
  2. Document and maintain a list of accepted external authenticators.
 Control Selected NA NA
IA 08(03) Identification and authentication (non-organizational users) Identification and authentication (non-organizational users): Use of federal identity, credential, and access management (FICAM)-approved products Withdrawn: Incorporated into IA-08(02) and specific to the US. NA NA NA NA
IA 08(04) Identification and authentication (non-organizational users) Identification and authentication (non-organizational users): Use of defined profiles
Conform to the following profiles for identity management [Assignment: organization-defined identity management profiles].		 Control Selected NA NA
IA 08(05) Identification and authentication (non-organizational users) Identification and authentication (non-organizational users): Acceptance of personal identity verification (PIV)-I credentials
Accept and verify federated or PKI credentials that meet [Assignment: organization-defined policy].		 Control Not selected NA NA
IA 08(06) Identification and authentication (non-organizational users) Identification and authentication (non-organizational users): Disassociability
Implement the following measures to disassociate user attributes or identifier assertion relationships among individuals, credential service providers, and relying parties: [Assignment: organization-defined measures].		 Control Not selected NA NA
IA 08(400) Identification and authentication (non-organizational users) Identification and authentication (non-organizational users): Identity and credential assurance
Withdrawn: Incorporated into IA-05(15).		 NA NA NA NA
IA 09 Service identification and authentication Uniquely identify and authenticate [Assignment: organization-defined system services and applications] before establishing communications with devices, users, or other services or applications. Control Not selected NA NA
IA 09(01) Service identification and authentication Service identification and authentication: Information exchange
Withdrawn: Incorporated into IA-09.		 NA NA NA NA
IA 09(02) Service identification and authentication Service identification and authentication: Transmission of decisions
Withdrawn: Incorporated into IA-09.		 NA NA NA NA
IA 10 Adaptive authentication Require individuals accessing the system to employ [Assignment: organization-defined supplemental authentication techniques or mechanisms] under specific [Assignment: organization-defined circumstances or situations]. Control Not selected NA NA
IA 11 Re-authentication Require users to re-authenticate when [Assignment: organization-defined circumstances or situations requiring re-authentication]. Control Selected NA NA
IA 12 Identity proofing
  1. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines.
  2. Resolve user identities to a unique individual.
  3. Collect, validate, and verify identity evidence.
 Control Selected NA NA
IA 12(01) Identity proofing Identity proofing: Supervisor authorization
Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.		 Control Not selected NA NA
IA 12(02) Identity proofing Identity proofing: Identity evidence
Require evidence of individual identification be presented to the registration authority.		 Control Selected NA NA
IA 12(03) Identity proofing Identity proofing: Identity evidence validation and verification
Require that the presented identity evidence be validated and verified through [Assignment: organizational defined methods of validation and verification].		 Control Selected NA NA
IA 12(04) Identity proofing Identity proofing: In-person validation and verification
Require that the validation and verification of identity evidence be conducted in person before a designated registration authority.		 Control Selected NA NA
IA 12(05) Identity proofing Identity proofing: Address confirmation Require that a [Selection (one): registration code; notice of proofing] be delivered through an out-of-band channel to verify the users address (physical or digital) of record. Control Selected NA This control is recommended for users external to the organization.
IA 12(06) Identity proofing Identity proofing: Accept externally proofed identities
Accept externally proofed identities at [Assignment: organization-defined identity assurance level].		 Control Not selected NA NA
IA 13 Identity providers and authorization servers Employ identity providers and authorization servers to manage user, device, and non-person entity (NPE) identities, attributes, and access rights supporting authentication and authorization decisions in accordance with [Assignment: organization-defined identification and authentication policy] using [Assignment: organization-defined mechanisms]. Control Not selected NA NA
IA 13(01) Identity providers and authorization servers Identity providers and authorization servers: Protection of cryptographic keys
Cryptographic keys that protect access tokens are generated, managed, and protected from disclosure and misuse.		 Control Not selected NA NA
IA 13(02) Identity providers and authorization servers Identity providers and authorization servers: Verification of identity assertions and access tokens
The source and integrity of identity assertions and access tokens are verified before granting access to system and information resources.		 Control Not selected NA NA
IA 13(03) Identity providers and authorization servers Identity providers and authorization servers: Token management
In accordance with [Assignment: organization-defined identification and authentication policy], assertions and access tokens are:
  1. generated
  2. issued
  3. refreshed
  4. revoked
  5. time-restricted
  6. audience-restricted
 Control Not selected NA NA
 
Top of page 
 
Table 4.8: Incident response
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
IR 01 Incident response policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] incident response policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the incident response policy and the associated incident response controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the incident response policy and procedures.
  3. Review and update the current incident response:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
IR 02 Incident response training
  1. Provide incident response training to system users consistent with assigned roles and responsibilities:
    1. within [Assignment: organization-defined time period] of assuming an incident response role or responsibility or acquiring system access
    2. when required by system changes
    3. [Assignment: organization-defined frequency] thereafter
  2. Review and update incident response training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
 Control Selected NA NA
IR 02(01) Incident response training Incident response training: Simulated events
Incorporate simulated events into incident response training to facilitate the required response by personnel in crisis situations.		 Control Not selected NA NA
IR 02(02) Incident response training Incident response training: Automated training environments
Provide an incident response training environment using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
IR 02(03) Incident response training Incident response training: Privacy breach
Provide incident response training on how to identify and respond to a privacy breach, including the organization’s process for reporting a privacy breach.		 Control Not selected NA NA
IR 03 Incident response testing Test the effectiveness of the incident response capability for the system [Assignment: organization-defined frequency] using the following tests: [Assignment: organization-defined tests]. Control Selected NA NA
IR 03(01) Incident response testing Incident response testing: Automated testing
Test the incident response capability using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
IR 03(02) Incident response testing Incident response testing: Coordination with related plans
Coordinate incident response testing with organizational elements responsible for related plans.		 Control Selected NA NA
IR 03(03) Incident response testing Incident response testing: Continuous improvement
Use qualitative and quantitative data from testing to:
  1. determine the effectiveness of incident response processes
  2. continuously improve incident response processes
  3. provide incident response measures and metrics that are accurate, consistent, and in a reproducible format
  4. identify trends to facilitate the identification of underlying patterns with respect to information-handling practices to prevent further breaches
 Control Not selected NA NA
IR 04 Incident handling
  1. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;
  2. Coordinate incident handling activities with contingency planning activities;
  3. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and
  4. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.
 Control Selected NA NA
IR 04(01) Incident handling Incident handling: Automated incident handling processes
Support the incident handling process using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
IR 04(02) Incident handling Incident handling: Dynamic reconfiguration
Include the following types of dynamic reconfiguration for [Assignment: organization-defined system components] as part of the incident response capability: [Assignment: organization-defined types of dynamic reconfiguration].		 Control Not selected NA NA
IR 04(03) Incident handling Incident handling: Continuity of operations
Identify [Assignment: organization-defined classes of incidents] and take the following actions in response to those incidents to ensure continuation of organizational mission and business functions: [Assignment: organization-defined actions to take in response to classes of incidents].		 Control Selected NA NA
IR 04(04) Incident handling Incident handling: Information correlation
Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.		 Control Not selected NA NA
IR 04(05) Incident handling Incident handling: Automatic disabling of system
Implement a configurable capability to automatically disable the system if [Assignment: organization-defined security violations] are detected.		 Control Not selected NA NA
IR 04(06) Incident handling Incident handling: Insider threats
Implement an incident handling capability for incidents involving insider threats.		 Control Not selected NA NA
IR 04(07) Incident handling Incident handling: insider threats - Intra-organization coordination
Coordinate an incident handling capability for insider threats that includes the following organizational entities [Assignment: organization-defined entities].		 Control Not selected NA NA
IR 04(08) Incident handling Incident handling: Correlation with external organizations
Coordinate with [Assignment: organization-defined external organizations] to correlate and share [Assignment: organization-defined incident information] to achieve a cross-organization perspective on incident awareness and more effective incident responses.		 Control Selected [SSC, TBS, Cyber Centre] NA
IR 04(09) Incident handling Incident handling: Dynamic response capability
Employ [Assignment: organization-defined dynamic response capabilities] to respond to incidents.		 Control Selected NA NA
IR 04(10) Incident handling Incident handling: Supply chain coordination
Coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain.		 Control Not selected NA NA
IR 04(11) Incident handling Incident handling: Integrated incident response team
Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in [Assignment: organization-defined time period].		 Control Not selected NA NA
IR 04(12) Incident handling Incident handling: Malicious code and forensic analysis
Analyze malicious code and/or other residual artifacts remaining in the system after the incident.		 Control Not selected NA NA
IR 04(13) Incident handling Incident handling: Behaviour analysis
Analyze anomalous or suspected adversarial behaviour in or related to [Assignment: organization-defined environments or resources].		 Control Not selected NA NA
IR 04(14) Incident handling Incident handling: Security operations center
Establish and maintain a security operations center.		 Control Not selected NA NA
IR 04(15) Incident handling Incident handling: Public relations, reputation repair, and notification
  1. Manage public relations associated with an incident.
  2. Employ measures to repair the reputation of the organization.
  3. If applicable, notify individuals whose personal information has been compromised.
 Control Not selected NA NA
IR 05 Incident monitoring Track and document incidents. Control Selected NA NA
IR 05(01) Incident monitoring Incident monitoring: Automated tracking, data collection, and analysis
Track incidents and collect and analyze incident information using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
IR 06 Incident reporting
  1. Require personnel to report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period].
  2. Report incident information to [Assignment: organization-defined authorities].
 Control Selected NA NA
IR 06(01) Incident reporting Incident reporting: Automated reporting
Report incidents using [Assignment: organization-defined automated mechanisms].		 Control Selected NA NA
IR 06(02) Incident reporting Incident reporting: Vulnerabilities related to incidents
Report system vulnerabilities associated with reported incidents to [Assignment: organization-defined personnel or roles].		 Control Selected NA NA
IR 06(03) Incident reporting Incident reporting: Supply chain coordination
Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.		 Control Selected NA NA
IR 07 Incident response assistance Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents. Control Selected NA NA
IR 07(01) Incident response assistance Incident response assistance: Automation support for availability of information and support
Increase the availability of incident response information and support using [Assignment: organization-defined automated mechanisms].		 Control Selected NA NA
IR 07(02) Incident response assistance Incident response assistance: Coordination with external providers
  1. Establish a direct, cooperative relationship between the organization’s incident response capability and external providers of a system protection capability.
  2. Identify organizational incident response team members to the external providers.
 Control Not selected NA NA
IR 08 Incident response plan
  1. Develop an incident response plan that:
    1. provides the organization with a roadmap for implementing its incident response capability
    2. describes the structure and organization of the incident response capability
    3. provides a high-level approach for how the incident response capability fits into the overall organization
    4. meets the unique requirements of the organization which relate to mission, size, structure, and functions
    5. defines reportable incidents
    6. provides metrics for measuring the incident response capability within the organization
    7. defines the resources and management support needed to effectively maintain and mature an incident response capability
    8. addresses the sharing of incident information
    9. is reviewed and approved by [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency]
    10. explicitly designates responsibility for incident response to [Assignment: organization-defined entities, personnel, or roles]
  2. Distribute copies of the incident response plan to [Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements].
  3. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing.
  4. Communicate incident response plan changes to [Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements].
  5. Protect the incident response plan from unauthorized disclosure and modification.
 Activity Selected NA NA
IR 08(01) Incident response plan Incident response plan: Privacy breaches
For privacy breaches involving personal information, include the following in the incident response plan:
  1. a process to determine if notice to individuals or other organizations, including oversight organizations, is needed
  2. an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms
  3. identification of applicable privacy requirements
 Activity Not selected NA NA
IR 09 Information spillage response Respond to information spills by:
  1. assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills
  2. identifying the specific information involved in the system contamination
  3. alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill
  4. isolating the contaminated system or system component
  5. eradicating the information from the contaminated system or component
  6. identifying other systems or system components that may have been subsequently contaminated
  7. performing the following additional actions: [Assignment: organization-defined actions]
 Control Not selected NA This control should be selected by GC departments and agencies that have systems categorized higher than Protected B.
IR 09(01) Information spillage response Information spillage response: Responsible personnel
Withdrawn: Incorporated into IR-09.		 NA NA NA NA
IR 09(02) Information spillage response Information spillage response: Training
Provide information spillage response training [Assignment: organization-defined frequency].		 Control Not selected NA This control should be selected by GC departments and agencies that have systems categorized higher than Protected B.
IR 09(03) Information spillage response Information spillage response: Post-spill operations
Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: [Assignment: organization-defined procedures].		 Control Not selected NA This control should be selected by GC departments and agencies that have systems categorized higher than Protected B.
IR 09(04) Information spillage response Information spillage response: Exposure to unauthorized personnel
Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignment: organization-defined controls].		 Control Not selected NA This control should be selected by GC departments and agencies that have systems categorized higher than Protected B.
IR 10 Integrated information security analysis team Withdrawn: Moved to IR-04(11). Control NA NA NA
 
Top of page 
 
Table 4.9: Maintenance
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
MA 01 System maintenance policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] maintenance policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the maintenance policy and the associated maintenance controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the maintenance policy and procedures.
  3. Review and update the current maintenance:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
MA 02 Controlled maintenance
  1. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements.
  2. Approve and monitor all maintenance activities, whether performed onsite or remotely and whether the system or system components are serviced onsite or removed to another location.
  3. Require that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for offsite maintenance, repair, or replacement.
  4. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for offsite maintenance, repair, or replacement: [Assignment: organization-defined information].
  5. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions.
  6. Include the following information in organizational maintenance records: [Assignment: organization-defined information].
 Control Selected NA NA
MA 02(01) Controlled maintenance Controlled maintenance: Record content
Withdrawn: Incorporated into MA-02.		 NA NA NA NA
MA 02(02) Controlled maintenance Controlled maintenance: Automated maintenance activities
  1. Schedule, conduct, and document maintenance, repair, and replacement actions for the system using [Assignment: organization-defined automated mechanisms].
  2. Produce up-to-date, accurate, and complete records of all maintenance, repair, and replacement actions requested, scheduled, in process, and completed.
 Control Not selected NA NA
MA 03 Maintenance tools
  1. Approve, control, and monitor the use of system maintenance tools.
  2. Review previously approved system maintenance tools [Assignment: organization-defined frequency].
 Control Selected NA NA
MA 03(01) Maintenance tools Maintenance tools: Inspect tools
Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.		 Control Selected NA NA
MA 03(02) Maintenance tools Maintenance tools: Inspect media
Check media containing diagnostic and test programs for malicious code before the media are used in the system.		 Control Selected NA NA
MA 03(03) Maintenance tools Maintenance tools: Prevent unauthorized removal
Prevent the unauthorized removal of maintenance equipment containing organizational or personal information by:
  1. verifying that no organizational or personal information is contained on the equipment
  2. sanitizing or destroying the equipment
  3. retaining the equipment within the facility
  4. obtaining an exemption from [Assignment: organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility
 Control Selected NA NA
MA 03(04) Maintenance tools Maintenance tools: Restricted tool use
Restrict the use of maintenance tools to authorized personnel only.		 Control Not selected NA NA
MA 03(05) Maintenance tools Maintenance tools: Execution with privilege
Monitor the use of maintenance tools that execute with increased privilege.		 Control Not selected NA NA
MA 03(06) Maintenance tools Maintenance tools: Software updates and patches
Inspect maintenance tools to ensure the latest software updates and patches are installed.		 Control Not selected NA NA
MA 04 Non-local maintenance
  1. Approve and monitor non-local maintenance and diagnostic activities.
  2. Allow the use of non-local maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system.
  3. Employ strong authentication in the establishment of non-local maintenance and diagnostic sessions.
  4. Maintain records for non-local maintenance and diagnostic activities.
  5. Terminate session and network connections when non-local maintenance is completed.
 Control Selected NA NA
MA 04(01) Non-local maintenance Non-local maintenance: Logging and review
  1. Log [Assignment: organization-defined audit events] for non-local maintenance and diagnostic sessions.
  2. Review the audit records of the maintenance and diagnostic sessions to detect anomalous behavior.
 Control Selected NA NA
MA 04(02) Non-local maintenance Non-local maintenance: Document non-local maintenance
Withdrawn: Incorporated into MA-01 and MA-04.		 NA NA NA NA
MA 04(03) Non-local maintenance Non-local maintenance: Comparable security and sanitization
  1. Require that non-local maintenance and diagnostic services be performed from a system that implements a security capability comparable to the capability implemented on the system being serviced.
  2. Remove the component to be serviced from the system prior to non-local maintenance or diagnostic services; sanitize the component (for organizational information); and, after the service is performed, inspect and sanitize the component (for potentially malicious software) before reconnecting the component to the system.
 Control Selected NA NA
MA 04(04) Non-local maintenance Non-local maintenance: Authentication and separation of maintenance sessions
Protect non-local maintenance sessions by:
  1. employing [Assignment: organization-defined authenticators that are replay resistant]
  2. separating the maintenance sessions from other network sessions with the system by either:
    1. physically separated communications paths
    2. logically separated communications paths
 Control Selected NA NA
MA 04(05) Non-local maintenance Non-local maintenance: Approvals and notifications
  1. Require the approval of each non-local maintenance session by [Assignment: organization-defined personnel or roles].
  2. Notify the following personnel or roles of the date and time of planned non-local maintenance: [Assignment: organization-defined personnel or roles].
 Control Not selected NA NA
MA 04(06) Non-local maintenance Non-local maintenance: Cryptographic protection
Implement the following cryptographic mechanisms to protect the integrity and confidentiality of non-local maintenance and diagnostic communications: [Assignment: organization-defined cryptographic mechanisms].		 Control Selected NA NA
MA 04(07) Non-local maintenance Non-local maintenance: Disconnect verification
Verify session and network connection termination after the completion of non-local maintenance and diagnostic sessions.		 Control Not selected NA NA
MA 05 Maintenance personnel
  1. Establish a process for maintenance personnel authorization and maintain a list of authorized maintenance organizations or personnel.
  2. Verify that non-escorted personnel performing maintenance on the system possess the required access authorizations.
  3. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
 Control Selected NA NA
MA 05(01) Maintenance personnel Maintenance personnel: Individuals without appropriate access
  1. Implement procedures for the use of maintenance personnel that lack appropriate security clearances, that include the following requirements:
    1. maintenance personnel who do not have the needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified
    2. prior to initiating maintenance or diagnostic activities by personnel who do not have the needed access authorizations, clearances, or formal access approvals, all volatile information storage components within the system are sanitized and all non-volatile storage media are removed or physically disconnected from the system and secured
  2. Develop and implement [Assignment: organization-defined alternate controls] in the event a system component cannot be sanitized, removed, or disconnected from the system.
 Control Selected NA NA
MA 05(02) Maintenance personnel Maintenance personnel: Security clearances for classified systems
Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information possess security clearances and formal access approvals for at least the highest classification level and for compartments of information on the system.		 Control Not selected NA NA
MA 05(03) Maintenance personnel Maintenance personnel: Citizenship requirements for classified systems
Verify that personnel performing maintenance and diagnostic activities on a system processing, storing, or transmitting classified information are Canadian citizens.		 Control Not selected NA NA
MA 05(04) Maintenance personnel Maintenance personnel: Foreign nationals
Ensure that:
  1. foreign nationals with appropriate security clearances are used to conduct maintenance and diagnostic activities on classified systems only when the systems are jointly owned and operated by Canadian and foreign allied governments, or owned and operated solely by foreign allied governments
  2. approvals, consents, and detailed operational conditions regarding the use of foreign nationals to conduct maintenance and diagnostic activities on classified systems are fully documented within memoranda of agreement
 Control Not selected NA NA
MA 05(05) Maintenance personnel Maintenance personnel: Non-system maintenance
Ensure that non-escorted personnel performing maintenance activities not directly associated with the system but in the physical proximity of the system, have required access authorizations.		 Control Not selected NA NA
MA 06 Timely maintenance Obtain maintenance support and/or spare parts for [Assignment: organization-defined system components] within [Assignment: organization-defined time period] of failure. Control Selected NA NA
MA 06(01) Timely maintenance Timely maintenance: Preventive maintenance
Perform preventive maintenance on [Assignment: organization-defined system components] at [Assignment: organization-defined time intervals].		 Control Not selected NA NA
MA 06(02) Timely maintenance Timely maintenance: Predictive maintenance
Perform predictive maintenance on [Assignment: organization-defined system components] at [Assignment: organization-defined time intervals].		 Control Not selected NA NA
MA 06(03) Timely maintenance Timely maintenance: Automated support for predictive maintenance
Transfer predictive maintenance data to a maintenance management system using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
MA 07 Field maintenance Restrict or prohibit field maintenance on [Assignment: organization-defined systems or system components] to [Assignment: organization-defined trusted maintenance facilities]. Control Not selected NA NA
 
Top of page 
 
Table 4.10: Media protection
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
MP 01 Media protection policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] media protection policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the media protection policy and the associated media protection controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the media protection policy and procedures.
  3. Review and update the current media protection:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
MP 02 Media access Restrict access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles]. Control Selected NA NA
MP 02(01) Media access Media access: Automated restricted access
Withdrawn: Incorporated into MP-04(02).		 NA NA NA NA
MP 02(02) Media access Media access: Cryptographic protection
Withdrawn: Incorporated into SC-28(01).		 NA NA NA NA
MP 03 Media marking
  1. Mark system media indicating the distribution limitations, handling caveats, and applicable security markings (if any) of the information.
  2. Exempt [Assignment: organization-defined types of system media] from marking if the media remain within [Assignment: organization-defined controlled areas].
 Control Selected NA NA
MP 04 Media storage
  1. Physically control and securely store [Assignment: organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined controlled areas].
  2. Protect system media types defined in MP-04A until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
 Control Selected NA NA
MP 04(01) Media storage Media storage: Cryptographic protection
Withdrawn: Incorporated into SC-28(01).		 NA NA NA NA
MP 04(02) Media storage Media storage: Automated restricted access
Restrict access to media storage areas and log access attempts and access granted using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
MP 05 Media transport
  1. Protect and control [Assignment: organization-defined types of system media] during transport outside of controlled areas using [Assignment: organization-defined controls].
  2. Maintain accountability for system media during transport outside of controlled areas.
  3. Document activities associated with the transport of system media.
  4. Restrict the activities associated with the transport of system media to authorized personnel.
 Control Selected NA NA
MP 05(01) Media transport Media transport: Protection outside of controlled areas
Withdrawn: Incorporated into MP-05.		 NA NA NA NA
MP 05(02) Media transport Media transport: Documentation of activities
Withdrawn: Incorporated into MP-05.		 NA NA NA NA
MP 05(03) Media transport Media transport: Custodians
Employ an identified custodian during transport of system media outside of controlled areas.		 Control Not selected NA NA
MP 05(04) Media transport Media transport: Cryptographic protection
Withdrawn: Incorporated into SC-28(01).		 NA NA NA NA
MP 06 Media sanitization
  1. Sanitize [Assignment: organization-defined system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined sanitization techniques and procedures].
  2. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
 Control Selected NA NA
MP 06(01) Media sanitization Media sanitization: Review, approve, track, document, and verify
Review, approve, track, document, and verify media sanitization and disposal actions.		 Control Not selected NA NA
MP 06(02) Media sanitization Media sanitization: Equipment testing
Test sanitization equipment and procedures [Assignment: organization-defined frequency] to ensure that the intended sanitization is being achieved.		 Control Not selected NA NA
MP 06(03) Media sanitization Media sanitization: Non-destructive techniques
Apply non-destructive sanitization techniques to portable storage devices prior to connecting such devices to the system under the following circumstances: [Assignment: organization-defined circumstances requiring sanitization of portable storage devices].		 Control Selected NA NA
MP 06(04) Media sanitization Media sanitization: Protected information
Withdrawn: Incorporated into MP-06.		 NA NA NA NA
MP 06(05) Media sanitization Media sanitization: Classified information
Withdrawn: Incorporated into MP-06.		 NA NA NA NA
MP 06(06) Media sanitization Media sanitization: Media destruction
Withdrawn: Incorporated into MP-06.		 NA NA NA NA
MP 06(07) Media sanitization Media sanitization: Dual authorization
Enforce dual authorization for the sanitization of [Assignment: organization-defined system media].		 Control Not selected NA NA
MP 06(08) Media sanitization Media sanitization: Remote purging or wiping of information
Provide the capability to purge or wipe information from [Assignment: organization-defined systems or system components] [Selection: remotely; under the following conditions: [Assignment: organization-defined conditions]].		 Control Selected [lost, stolen, upon termination of employment] NA
MP 07 Media use
  1. [Selection (one): Restrict; Prohibit] the use of [Assignment: organization-defined types of system media] on [Assignment: organization-defined systems or system components] using [Assignment: organization-defined controls].
  2. Prohibit the use of portable storage devices in organizational systems when such devices have no identifiable owner.
 Control Selected NA NA
MP 07(01) Media use Media use: Prohibit use without owner
Withdrawn: Incorporated into MP-07.		 NA NA NA NA
MP 07(02) Media use Media use: Prohibit use of sanitization-resistant media
Prohibit the use of sanitization-resistant media in organizational systems.		 Control Not selected NA NA
MP 08 Media downgrading
  1. Establish [Assignment: organization-defined system media downgrading process] that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information.
  2. Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information.
  3. Identify [Assignment: organization-defined system media requiring downgrading].
  4. Downgrade the identified system media using the established process.
 Control Selected NA NA
MP 08(01) Media downgrading Media downgrading: Documentation of process
Document system media downgrading actions.		 Control Not selected NA NA
MP 08(02) Media downgrading Media downgrading: Equipment testing
Test downgrading equipment and procedures [Assignment: organization-defined frequency] to ensure that downgrading actions are being achieved.		 Control Not selected NA NA
MP 08(03) Media downgrading Media downgrading: Protected information
Downgrade system media containing protected information prior to public release.		 Control Selected NA NA
MP 08(04) Media downgrading Media downgrading: Classified information
Downgrade system media containing classified information prior to release to individuals without required access authorizations.		 Control Not selected NA NA
 
Top of page 
 
Table 4.11: Physical and environmental protection
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
PE 01 Physical and environmental protection policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] physical and environmental protection policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the physical and environmental protection policy and the associated physical and environmental protection controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures
  3. Review and update the current physical and environmental protection:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
PE 02 Physical access authorizations
  1. Develop, approve, and maintain a list of individuals with authorized access to the facility where the system resides.
  2. Issue authorization credentials for facility access.
  3. Review the access list detailing authorized facility access by individuals [Assignment: organization-defined frequency].
  4. Remove individuals from the facility access list when access is no longer required.
 Control Selected NA NA
PE 02(01) Physical access authorizations Physical access authorizations: Access by position and role
Authorize physical access to the facility where the system resides based on position or role.		 Control Not selected NA NA
PE 02(02) Physical access authorizations Physical access authorizations: Two forms of identification
Require two forms of identification from the following forms of identification for visitor access to the facility where the system resides: [Assignment: organization-defined list of acceptable forms of identification].		 Control Not selected NA NA
PE 02(03) Physical access authorizations Physical access authorizations: Restrict unescorted access
Restrict unescorted access to the facility where the system resides to personnel with [Selection (one or more): security clearances for all information contained within the system; formal access authorizations for all information contained within the system; need for access to all information contained within the system; [Assignment: organization-defined physical access authorizations]].		 Control Not selected NA NA
PE 02(400) Physical access authorizations Physical access authorizations: Identification card requirements
Ensure identification cards meet requirements prior to issuance.		 Control Selected NA NA
PE 03 Physical access control
  1. Enforce physical access authorizations at [Assignment: organization-defined entry and exit points to the facility where the system resides] by:
    1. verifying individual access authorizations before granting access to the facility
    2. controlling ingress and egress to the facility using [Selection (one or more): [Assignment: organization-defined physical access control systems or devices]; guards].
  2. Maintain physical access audit logs for [Assignment: organization-defined entry or exit points].
  3. Control access to areas within the facility designated as publicly accessible by implementing the following controls: [Assignment: organization-defined physical access controls].
  4. Escort visitors and control visitor activity [Assignment: organization-defined circumstances requiring visitor escorts and control of visitor activity].
  5. Secure keys, access cards, combinations, safes, cipher locks, and other physical access devices.
  6. Inventory [Assignment: organization-defined physical access devices] every [Assignment: organization-defined frequency].
  7. Change combinations and keys [Assignment: organization-defined frequency] and/or when keys are lost, or combinations are compromised, or when individuals possessing the keys or combinations are transferred or terminated.
  8. Remove the access card identifier from the access list or database [Assignment: organization-defined frequency] when the access card is lost, misplaced, stolen, or when the individual possessing the card is transferred or terminated.
 Control Selected NA According to the TBS Policy on Government Security and RCMP GCPSG-006 Access Management Guide, access to sensitive information and areas must be limited. A physical Operations Zone is the minimum required where sensitive GC information is processed or stored. A TRA must be performed to ensure the appropriate level of physical security to protect Protected B information and information systems processing and storing PB data. This zone is an area where access is limited to personnel who work there and to properly-escorted visitors by an employee with a valid reliability status; it must be indicated by a recognizable perimeter and monitored periodically.
PE 03(01) Physical access control Physical access control: System access
Enforce physical access authorizations to the system in addition to the physical access controls for the facility at [Assignment: organization-defined physical spaces containing one or more components of the system].		 Control Not selected NA NA
PE 03(02) Physical access control Physical access control: Facility and systems
Perform security checks [Assignment: organization-defined frequency] at the physical perimeter of the facility or system for exfiltration of information or removal of system components.		 Control Not selected NA NA
PE 03(03) Physical access control Physical access control: Continuous guards
Employ guards to control [Assignment: organization-defined physical access points] to the facility where the system resides 24 hours per day, 7 days per week.		 Control Not selected NA NA
PE 03(04) Physical access control Physical access control: Lockable casings
Use lockable physical casings to protect [Assignment: organization-defined system components] from unauthorized physical access.		 Control Not selected NA NA
PE 03(05) Physical access control Physical access control: Tamper protection
Employ [Assignment: organization-defined anti-tamper technologies] to [Selection (one or more): detect; prevent] physical tampering or alteration of [Assignment: organization-defined hardware components] within the system.		 Control Not selected NA NA
PE 03(06) Physical access control Physical access control: Facility penetration testing
Withdrawn: Incorporated into CA-08.		 NA NA NA NA
PE 03(07) Physical access control Physical access control: Physical barriers
Limit access using physical barriers.		 Control Not selected NA NA
PE 03(08) Physical access control Physical access control: Access control vestibules
Employ access control vestibules at [Assignment: organization-defined locations within the facility].		 Control Not selected NA NA
PE 03(400) Physical access control Physical access control: Security inspections
Conduct security inspections in facilities where sensitive or valuable information or assets are handled or stored, or in facilities supporting critical services or activities.		 Control Selected NA GC specific.
PE 04 Access control for transmission Control physical access to [Assignment: organization-defined system distribution and transmission lines] within organizational facilities using [Assignment: organization-defined security controls]. Control Selected NA NA
PE 05 Access control for output devices Control physical access to output from [Assignment: organization-defined output devices] to prevent unauthorized individuals from obtaining the output. Control Selected NA NA
PE 05(01) Access control for output devices Access control for output devices: Access to output by authorized individuals
Withdrawn: Incorporated into PE-05.		 NA NA NA NA
PE 05(02) Access control for output devices Access control for output devices: Link to individual identity
Link individual identity to receipt of output from output devices.		 Control Not selected NA NA
PE 05(03) Access control for output devices Access control for output devices: Marking output devices
Withdrawn: Incorporated into PE-22.		 NA NA NA NA
PE 06 Monitoring physical access
  1. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents.
  2. Review physical access logs [Assignment: organization-defined frequency] and upon occurrence of [Assignment: organization-defined events or potential indications of events].
  3. Coordinate results of reviews and investigations with the organizational incident response capability.
 Control Selected NA NA
PE 06(01) Monitoring physical access Monitoring physical access: Intrusion alarms and surveillance equipment
Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment.		 Control Selected NA NA
PE 06(02) Monitoring physical access Monitoring physical access: Automated intrusion recognition and responses
Recognize [Assignment: organization-defined classes or types of intrusions] and initiate [Assignment: organization-defined response actions] using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
PE 06(03) Monitoring physical access Monitoring physical access: Video surveillance
  1. Employ video surveillance of [Assignment: organization-defined operational areas].
  2. Review video recordings [Assignment: organization-defined frequency].
  3. Retain video recordings for [Assignment: organization-defined time period].
 Control Not selected NA NA
PE 06(04) Monitoring physical access Monitoring physical access: Monitoring physical access to systems
Monitor physical access to the system in addition to the physical access monitoring of the facility at [Assignment: organization-defined physical spaces containing one or more components of the system].		 Control Not selected NA NA
PE 07 Visitor control Withdrawn: Incorporated into PE-02 and PE-03. NA NA NA NA
PE 08 Visitor access records
  1. Maintain visitor access records to the facility where the system resides for [Assignment: organization-defined time period].
  2. Review visitor access records [Assignment: organization-defined frequency].
  3. Report anomalies in visitor access records to [Assignment: organization-defined personnel].
 Control Selected NA NA
PE 08(01) Visitor access records Visitor access records: Automated records maintenance and review
Maintain and review visitor access records using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
PE 08(02) Visitor access records Visitor access records: Physical access records
Withdrawn: Incorporated into PE-02.		 NA NA NA NA
PE 08(03) Visitor access records Visitor access records: limit personal information elements
Limit personal information contained in visitor access records to the following elements identified in the privacy risk assessment: [Assignment: organization-defined elements].		 Control Not selected NA NA
PE 09 Power equipment and cabling Protect power equipment and power cabling for the system from damage and destruction. Activity Selected NA NA
PE 09(01) Power equipment and cabling Power equipment and cabling: Redundant cabling
Employ redundant power cabling paths that are physically separated by [Assignment: organization-defined distance].		 Control Not selected NA NA
PE 09(02) Power equipment and cabling Power equipment and cabling: Automatic voltage controls
Employ automatic voltage controls for [Assignment: organization-defined critical system components].		 Control Not selected NA NA
PE 10 Emergency shutoff
  1. Provide the capability of shutting off power to [Assignment: organization-defined system or individual system components] in emergency situations.
  2. Place emergency shutoff switches or devices in [Assignment: organization-defined location by system or system component] to facilitate access for authorized personnel.
  3. Protect emergency power shutoff capability from unauthorized activation.
 Control Selected NA NA
PE 10(01) Emergency shutoff Emergency shutoff: Accidental / unauthorized activation
Withdrawn: Incorporated into PE-10.		 NA NA NA NA
PE 11 Emergency power Provide an uninterruptible power supply to facilitate [Selection (one or more): an orderly shutdown of the system; transition of the system to long-term alternate power] in the event of a primary power source loss. Control Selected NA NA
PE 11(01) Emergency power Emergency power: Alternate power supply - minimal operational capability
Provide an alternate power supply for the system that is activated [Selection (one): manually; automatically] and that can maintain minimally required operational capability in the event of an extended loss of the primary power source.		 Control Not selected NA NA
PE 11(02) Emergency power Emergency power: Alternate power supply - self-contained
Provide an alternate power supply for the system that is activated [Selection (one): manually; automatically] and that is:
  1. self-contained
  2. not reliant on external power generation
  3. capable of maintaining [Selection (one): minimally required operational capability; full operational capability] in the event of an extended loss of the primary power source
 Control Not selected NA NA
PE 12 Emergency lighting Employ and maintain automatic emergency lighting for the system that activates in the event of a power outage or disruption and that covers emergency exits and evacuation routes within the facility. Control Selected NA NA
PE 12(01) Emergency lighting Emergency lighting: Essential missions and business functions
Provide emergency lighting for all areas within the facility supporting essential mission and business functions.		 Control Not selected NA NA
PE 13 Fire protection Employ and maintain fire detection and suppression systems that are supported by an independent energy source. Control Selected NA NA
PE 13(01) Fire protection Fire protection: Detection systems - automatic activation and notification
Employ fire detection systems that activate automatically and notify [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders] in the event of a fire.		 Control Selected NA NA
PE 13(02) Fire protection Fire protection: Suppression systems - automatic activation and notification
  1. Employ fire suppression systems that activate automatically and notify [Assignment: organization-defined personnel or roles] and [Assignment: organization-defined emergency responders].
  2. Employ an automatic fire suppression capability when the facility is not staffed on a continuous basis.
 Control Not selected NA NA
PE 13(03) Fire protection Fire protection: Automatic fire suppression
Withdrawn: Incorporated into PE-13(02).		 NA NA NA NA
PE 13(04) Fire protection Fire protection: Inspections
Ensure that the facility undergoes [Assignment: organization-defined frequency] fire protection inspections by authorized and qualified inspectors and identified deficiencies are resolved within [Assignment: organization-defined time period].		 Control Selected NA NA
PE 13(400) Fire protection Fire protection: Emergency services
Ensure that firefighting water capacity and effective response times of emergency services are considered when developing safeguarding strategies.		 Control Selected NA GC specific
PE 14 Environmental controls
  1. Maintain [Selection (one or more): temperature; humidity; pressure; radiation; [Assignment: organization-defined environmental control]] levels within the facility where the system resides at [Assignment: organization-defined acceptable levels].
  2. Monitor environmental control levels [Assignment: organization-defined frequency].
 Control Selected NA NA
PE 14(01) Environmental controls Environmental controls: Automatic controls
Employ the following automatic environmental controls in the facility to prevent fluctuations potentially harmful to the system: [Assignment: organization-defined automatic environmental controls].		 Control Not selected NA NA
PE 14(02) Environmental controls Environmental controls: Monitoring with alarms and notifications
Employ environmental control monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment to [Assignment: organization-defined personnel or roles].		 Control Not selected NA NA
PE 15 Water damage protection Protect the system from damage resulting from water leakage by providing master shutoff or isolation valves that are accessible, working properly, and known to key personnel. Control Selected NA NA
PE 15(01) Water damage protection Water damage protection: Automation support
Detect the presence of water near the system and alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
PE 16 Delivery and removal
  1. Authorize and control [Assignment: organization-defined types of system components] entering and exiting the facility.
  2. Maintain records of the system components.
 Control Selected NA NA
PE 17 Alternate work site
  1. Determine and document the [Assignment: organization-defined alternate work sites] allowed for use by employees.
  2. Employ the following controls at alternate work sites: [Assignment: organization-defined controls].
  3. Assess the effectiveness of controls at alternate work sites.
  4. Provide a means for employees to communicate with information security and privacy personnel in case of incidents.
 Control Selected NA NA
PE 18 Location of system components Position system components within the facility to minimize potential damage from [Assignment: organization-defined physical and environmental hazards] and to minimize the opportunity for unauthorized access. Control Not selected NA NA
PE 18(01) Location of system components Location of system components: Facility site
Withdrawn: Moved to PE-23.		 NA NA NA NA
PE 19 Information leakage Protect the system from information leakage due to electromagnetic signals emanations. Control Not selected NA NA
PE 19(01) Information leakage Information leakage: National emissions policies and procedures
Protect system components, associated data communications, and networks in accordance with national emissions security (EMSEC) policies and procedures based on the security category or classification of the information.		 Control Not selected NA NA
PE 20 Asset monitoring and tracking Employ [Assignment: organization-defined asset location technologies] to track and monitor the location and movement of [Assignment: organization-defined assets] within [Assignment: organization-defined controlled areas]. Control Not selected NA NA
PE 21 Electromagnetic pulse protection Employ [Assignment: organization-defined protective measures] against electromagnetic pulse damage for [Assignment: organization-defined systems and system components]. Control Not selected NA NA
PE 22 Component marking Mark [Assignment: organization-defined system hardware components] indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component. Control Not selected NA NA
PE 23 Facility location
  1. Plan the location or site of the facility where the system resides considering physical and environmental hazards.
  2. For existing facilities, consider the physical and environmental hazards in the organizational risk management strategy.
 Control Not selected NA NA
PE 400 Remote and telework environments
  1. Assess physical security of remote or telework environments.
  2. Apply appropriate protection and storage requirements for information and assets.
  3. Use approved security equipment and electronic devices in accordance with the categorization of material.
 Control Selected NA GC specific.
PE 400(01) Remote and telework environments Remote and telework environments: Physical information and assets storage
Store physical information and assets in accordance with RCMP guidance and departmentally established security practices.		 Control Selected NA GC specific.
PE 400(02) Remote and telework environments Remote and telework environments: International remote/telework
Allow requests for remote/telework from international locations only under exceptional circumstances.		 Control Selected NA GC specific.
PE 401 Security operations centre Establish and maintain a Security Operations Centre (SOC) to protect the organization’s people, property, assets, and information, through physical and technical surveillance and monitoring. Control Selected NA NA
 
Top of page 
 
Table 4.12: Planning
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
PL 01 Security planning policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] planning policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, jurisprudence, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the planning policy and the associated planning controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the planning policy and procedures.
  3. Review and update the current planning:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
PL 02 System security and privacy plans
  1. Develop security and privacy plans for the system that:
    1. are consistent with the organization’s enterprise architecture
    2. explicitly define the constituent system components
    3. describe the operational context of the system in terms of mission and business processes
    4. identify the individuals that fulfill system roles and responsibilities
    5. identify the information types processed, stored, and transmitted by the system
    6. provide the security categorization of the system, including supporting rationale
    7. describe any specific threats to the system that are of concern to the organization
    8. provide the results of a privacy risk assessment for systems handling personal information
    9. describe the operational environment for the system and any dependencies on or connections to other systems or system components
    10. provide an overview of the security and privacy requirements for the system
    11. identify any relevant control baselines or overlays, if applicable
    12. describe the controls in place or planned for meeting the security and privacy requirements, including a rationale for any tailoring decisions
    13. include risk determinations for security and privacy architecture and design decisions
    14. include security- and privacy-related activities affecting the system that require planning and coordination with [Assignment: organization-defined individuals or groups]
    15. are reviewed and approved by the authorizing official or designated representative prior to plan implementation
    1. document the business purposes for the processing of personal information
    2. define retention and disposition standards for personal information stored within the system
  2. Distribute copies of the plans and communicate subsequent changes to the plans to [Assignment: organization-defined personnel or roles].
  3. Review the plans [Assignment: organization-defined frequency].
  4. Update the plans to address changes to the system and environment of operation or problems identified during plan implementation or control assessments.
  5. Protect the plans from unauthorized disclosure and modification.
 Activity Selected NA NA
PL 02(01) System security and privacy plans System security and privacy plans: Concept of operations
Withdrawn: Incorporated into PL-07.		 NA NA NA NA
PL 02(02) System security and privacy plans System security and privacy plans: Functional architecture
Withdrawn: Incorporated into PL-08.		 NA NA NA NA
PL 02(03) System security and privacy plans System security and privacy plans: Plan / coordinate
Withdrawn: Incorporated into PL-02.		 NA NA NA NA
PL 03 System security plan update Withdrawn: Incorporated into PL-02. NA NA NA NA
PL 04 Rules of behaviour
  1. Establish and provide to individuals requiring access to the system the rules that describe their responsibilities and expected behaviour for information and system usage, security, and privacy.
  2. Receive a documented acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the system.
  3. Review and update the rules of behaviour [Assignment: organization-defined frequency].
  4. Require individuals who have acknowledged a previous version of the rules of behaviour to read and re-acknowledge [Selection (one or more): [Assignment: organization-defined frequency]; when the rules are revised or updated].
 Activity Selected NA NA
PL 04(01) Rules of behaviour Rules of behaviour: Social media and external site/ application usage restriction
Include in the rules of behaviour restrictions on:
  1. use of social media, social networking sites, and external sites/applications
  2. posting organizational information on public websites
  3. use of organization-provided identifiers (for example, email addresses) and authentication secrets (for example, passwords) for creating accounts on external sites/applications
 Activity Selected NA NA
PL 05 Privacy impact assessment Withdrawn: Incorporated into RA-08. NA NA NA NA
PL 06 Security-related activity planning Withdrawn: Incorporated into PL-02. NA NA NA NA
PL 07 Concepts of operation
  1. Develop a Concept of Operations (CONOPS) for the system describing how the organization intends to operate the system from the perspective of information security and privacy.
  2. Review and update the CONOPS [Assignment: organization-defined frequency].
 Activity Not selected NA NA
PL 08 Security and privacy architectures
  1. Develop security and privacy architectures for the system that describe:
    1. the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information
    2. the requirements and approach to be taken for handling personal information to minimize any privacy risk to individuals
    3. how the architectures are integrated into and support the enterprise architecture
    4. any assumptions about, and dependencies on, external systems and services
  2. Review and update the architectures [Assignment: organization-defined frequency] to reflect changes in the enterprise architecture.
  3. Reflect planned architecture changes in security and privacy plans, CONOPS, criticality analysis, organizational procedures, and procurements and acquisitions.
 Activity Selected NA NA
PL 08(01) Security and privacy architectures Security and privacy architectures: Defence-in-depth
Design the security and privacy architectures for the system using a defence-in-depth approach that:
  1. allocates [Assignment: organization-defined controls] to [Assignment: organization-defined locations and architectural layers]
  2. ensures that the allocated controls operate in a coordinated and mutually reinforcing manner
 Activity Not selected NA NA
PL 08(02) Security and privacy architectures Security and privacy architectures: Supplier diversity
Require that [Assignment: organization-defined controls] allocated to [Assignment: organization-defined locations and architectural layers] are obtained from different suppliers.		 Activity Not selected NA NA
PL 09 Central management Centrally manage [Assignment: organization-defined controls and related processes]. Control Not selected NA NA
PL 10 Baseline selection Select a control baseline for the system. Activity Selected NA NA
PL 11 Baseline tailoring Tailor the selected control baseline by applying specified tailoring actions. Activity Selected NA NA
 
Top of page 
 
Table 4.13: Program management
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
PM 01 Information security program plan
  1. Develop and disseminate an organization-wide information security program plan that:
    1. provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements
    2. includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance
    3. reflects the coordination among organizational entities responsible for information security
    4. is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and Canada
  2. Review and update the organization-wide information security program plan [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
  3. Protect the information security program plan from unauthorized disclosure and modification.
 Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 02 Information security program leadership role Appoint a senior official in the department’s security governance with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program. Control Deployed organization-wide. Not associated with baseline. NA NA
PM 03 Information security and privacy resources
  1. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement.
  2. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, Orders in Council, directives, policies, regulations, standards.
  3. Make the planned information security and privacy resources available for expenditure.
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 04 Plan of action and milestones process
  1. Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems:
    1. are developed and maintained
    2. document the remedial information security, privacy, and supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and Canada
    3. are reported in accordance with established reporting requirements
  2. Review plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
 Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 05 System and program inventory Develop and update [Assignment: organization-defined frequency] an inventory of organizational systems and programs. Control Deployed organization-wide. Not associated with baseline. NA NA
PM 05(01) System and program inventory System and program inventory: Inventory of personal information
Establish, maintain, and update [Assignment: organization-defined frequency] an inventory of all systems, programs, applications, and projects that process personal information.		 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 06 Measures of performance Develop, monitor, and report on the results of information security and privacy measures of performance. Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 07 Enterprise architecture Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and Canada. Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 07(01) Enterprise architecture Enterprise architecture: Offloading
Offload [Assignment: organization-defined non-essential functions or services] to other systems, system components, or an external provider.		 Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 08 Critical infrastructure plan Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan. Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 09 Risk management strategy
  1. Develop a comprehensive strategy to manage the:
    1. security risks to organizational operations and assets, individuals, other organizations, and Canada associated with the operation and use of organizational systems
    2. privacy risks to individuals resulting from the authorized handling of personal information
  2. Implement the risk management strategy consistently across the organization.
  3. Review and update the risk management strategy [Assignment: organization-defined frequency] or as required, to address organizational changes.
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 10 Authorization process
  1. Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes.
  2. Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process.
  3. Integrate the authorization processes into an organization-wide risk management program.
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 11 Mission and business process definition
  1. Define organizational mission and business processes with consideration for information security and privacy protection and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and Canada.
  2. Determine information protection and personal information handling needs arising from the defined mission and business processes.
  3. Review and revise the mission and business processes [Assignment: organization-defined frequency].
 Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 12 Insider threat program Implement an insider threat program that includes a cross-discipline insider threat incident handling team. Control Deployed organization-wide. Not associated with baseline. NA NA
PM 13 Security and privacy workforce Establish a security and privacy workforce development and improvement program. Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 14 Testing, training, and monitoring
  1. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems:
    1. are developed and maintained
    2. continue to be executed
  2. Review testing, training, and monitoring plans for consistency with the organizational security and privacy risk management strategy and organization-wide priorities for risk response actions.
 Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 15 Security and privacy groups and associations Establish and institutionalize contact with selected groups and associations within the security and privacy communities to:
  1. facilitate ongoing security and privacy education and training for organizational personnel
  2. maintain currency with recommended security and privacy practices, techniques, and technologies
  3. share current security and privacy information, including threats, vulnerabilities, and incidents
 Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 16 Threat awareness program Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence. Control Deployed organization-wide. Not associated with baseline. NA NA
PM 16(01) Threat awareness program Threat awareness program: Automated means for sharing threat intelligence
Employ automated mechanisms to maximize the effectiveness of sharing threat intelligence information.		 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 17 Protecting controlled information on outsourced external systems
  1. Establish policy and procedures to ensure that requirements for the protection of controlled information that is processed, stored, or transmitted on external systems, are implemented in accordance with applicable laws, Orders in Council, directives, policies, regulations, and standards.
  2. Review and update the policy and procedures [Assignment: organization-defined frequency].
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 18 Privacy program plan
  1. Develop and disseminate an organization-wide privacy program plan that provides an overview of the organization’s privacy program, and:
    1. includes a description of the structure of the service delivery program for privacy and the resources dedicated to the privacy program
    2. provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements
    3. includes the role of the appropriate privacy senior official or executive, describes the formal delegation of authority from the Deputy Head, and identifies and assigns the roles of other privacy officials and staff and their responsibilities
    4. describes management commitment, compliance requirements, and the strategic goals and objectives of the privacy program
    5. reflects coordination among organizational entities responsible for the different aspects of privacy
    6. is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and Canada
  2. Update the plan [Assignment: organization-defined frequency] and address changes in the application of federal privacy laws based on jurisprudence and policy and organizational changes and problems identified during plan implementation or privacy control assessments.
  1. Ensure the privacy program plan is communicated and made available to personnel responsible for implementing the plan.
 Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 19 Privacy program leadership role Appoint an appropriate privacy senior official or executive with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program. Control Deployed organization-wide. Not associated with baseline. NA NA
PM 20 Communication of key privacy services Maintain a central resource webpage on the organization’s principal public website that serves as a central source of information about the organization’s privacy services and that:
  1. ensures that the public has access to a list of programs and services that collect and use personal information via Info Source
  2. ensures that organizational privacy policies, practices and resources are published in the Annual Report to Parliament on the Administration of the Privacy Act
  3. communicates publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices
  1. includes summaries of completed Privacy Impact Assessments
  2. includes direction to individuals about how to file a request to access their personal information, how to file a formal records correction and how to file a formal complaint, if they choose to do so
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 20(01) Communication of key privacy services Communication of key privacy services: Privacy policies on websites, applications, and digital services
Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, if the privacy of websites visitors could be affected. Ensure that policies:
  1. are written in plain language and organized in a way that is easy to understand and navigate
  2. provide information needed by the public to make an informed decision about whether and how to interact with the organization
  3. are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 21 Maintain a record of disclosures
  1. Establish procedures for, and maintain a record of disclosures of personal information including the:
    1. date and details of the disclosure
    2. position and address, or other contact information of the individual or organization to which the disclosure was made
  2. Keep a record of disclosures for the length of the time the personal information is maintained or as required by organization’s information management standards.
  3. Make the record of disclosure available to the individual to whom the personal information relates, upon request, unless the disclosure meets the exemptions cited in the Privacy Act.
  1. Establish a contract, information sharing agreement or information sharing arrangement to document appropriate safeguards prior to any disclosure of personal information to another federal program or to another public or private sector entity.
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 22 Personal information quality management Develop and document organization-wide policies and procedures for:
  1. reviewing for the accuracy, relevance, timeliness, and completeness of personal information across the information lifecycle
  2. implementing records correction process that facilitates correcting or deleting inaccurate or outdated personal information
  3. implementing records correction process that facilitates disseminating notice of corrected personal information when the incorrect information has been disclosed previously
  1. ensuring that collection procedures adhere to the requirements of applicable legislation
  2. documenting any changes or modifications to the information, including the date and sources of the information change
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 23 Data governance committee Establish a data governance committee consisting of [Assignment: organization-defined roles] with [Assignment: organization-defined responsibilities]. Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 24 Data integrity board Establish a data integrity board to:
  1. review proposals to conduct or participate in a matching program
  2. conduct an annual review of all matching programs in which the organization has participated
 Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 25 Minimization of personal information used in testing, training, and research
  1. Develop, document, and implement policies and procedures that address the use of personal information for internal testing, training, and research.
  2. Limit or minimize the amount of personal information used for internal testing, training, and research purposes.
  3. Authorize the use of personal information in internal testing, training, and research when the required result cannot be achieved without the use of the personal information.
  4. Review and update policies and procedures [Assignment: organization-defined frequency].
  1. Restrict the disclosure of datasets containing personal information to external contractors, wherever possible.
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 26 Complaint management Implement a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational security and privacy practices that includes:
  1. mechanisms that are easy to use and readily accessible by the public
  2. all information necessary for successfully filing complaints
  3. tracking mechanisms to ensure all complaints received are reviewed and addressed within [Assignment: organization-defined time period]
  4. acknowledgement of receipt of complaints, concerns, or questions from individuals within [Assignment: organization-defined time period]
  5. response, with discretion, to complaints, concerns, or questions from individuals within [Assignment: organization-defined time period]
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 27 Privacy reporting
  1. Develop [Assignment: organization-defined privacy reports] and disseminate to:
    1. [Assignment: organization-defined oversight bodies] to demonstrate accountability with statutory, regulatory, and policy privacy mandates
    2. [Assignment: organization-defined officials] and other personnel with responsibility for monitoring privacy program compliance
  2. Review and update privacy reports [Assignment: organization-defined frequency].
  1. Federal departments and agencies are required to report details related to the administration of the Privacy Act to both Parliament and TBS, as per section 72 of the Privacy Act.
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 28 Risk framing
  1. Identify and document:
    1. assumptions affecting risk assessments, risk responses, and risk monitoring
    2. constraints affecting risk assessments, risk responses, and risk monitoring
    3. priorities and trade-offs considered by the organization for managing risk
    4. organizational risk tolerance
  2. Distribute the results of risk framing activities to [Assignment: organization-defined personnel].
  3. Review and update risk framing considerations [Assignment: organization-defined frequency].
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 29 Risk management program leadership roles
  1. Appoint a senior accountable official for risk management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes.
  2. Establish a risk executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.
 Control Deployed organization-wide. Not associated with baseline. NA NA
PM 30 Supply chain risk management strategy
  1. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services.
  2. Implement the supply chain risk management strategy consistently across the organization.
  3. Review and update the supply chain risk management strategy on [Assignment: organization-defined frequency] or as required, to address organizational changes.
 Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 30(01) Supply chain risk management strategy Supply chain risk management strategy: Suppliers of critical or mission-essential items
Identify, prioritize, and assess suppliers of critical or mission-essential technologies, products, and services.		 Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 31 Continuous monitoring strategy Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include:
  1. the establishment of the following organization-wide metrics to be monitored: [Assignment: organization-defined metrics]
  2. the establishment of [Assignment: organization-defined monitoring frequencies] and [Assignment: organization-defined assessment frequencies] for control effectiveness
  3. ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy
  4. correlation and analysis of information generated by control assessments and monitoring
  5. response actions to address results of the analysis of control assessment and monitoring information
  6. reporting on the security and privacy status of organizational systems to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency]
 Activity Deployed organization-wide. Not associated with baseline. NA NA
PM 32 Purposing Analyze [Assignment: organization-defined systems or systems components] supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose. Control Deployed organization-wide. Not associated with baseline. NA NA
 
Top of page 
 
Table 4.14: Personnel security
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
PS 01 Personnel security policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] personnel security policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the personnel security policy and the associated personnel security controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the personnel security policy and procedures.
  3. Review and update the current personnel security:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
PS 02 Position security analysis
  1. Determine the security screening requirements of all organizational positions.
  2. Establish screening criteria for individuals filling those positions.
  3. Review and update position security screening requirement [Assignment: organization-defined frequency].
 Control Selected NA NA
PS 03 Personnel screening
  1. Screen individuals prior to authorizing access to the system.
  2. Rescreen individuals in accordance with [Assignment: organization-defined conditions requiring rescreening and, where rescreening is so indicated, the frequency of rescreening].
 Control Selected NA NA
PS 03(01) Personnel screening Personnel screening: Classified information
Verify that individuals accessing a system processing, storing, or transmitting classified information are cleared and indoctrinated to the highest classification level of the information to which they have access on the system.		 Control Not selected NA NA
PS 03(02) Personnel screening Personnel screening: Formal indoctrination
Verify that individuals accessing a system processing, storing, or transmitting types of classified information that require formal indoctrination, are formally indoctrinated for all the relevant types of information to which they have access on the system.		 Control Not selected NA NA
PS 03(03) Personnel screening Personnel screening: Information requiring special protective measures
Verify that individuals accessing a system that processes, stores, or transmits information requiring special protection:
  1. have valid access authorizations that are demonstrated by assigned official government duties
  2. satisfy [Assignment: organization-defined additional personnel screening criteria]
 Control Not selected NA NA
PS 03(04) Personnel screening Personnel screening: Citizenship requirements
Verify that individuals accessing a system that processes, stores, or transmits [Assignment: organization-defined information types] meet [Assignment: organization-defined citizenship requirements].		 Control Not selected NA NA
PS 04 Personnel termination Upon termination of individual employment:
  1. disable system access within [Assignment: organization-defined time period]
  2. terminate or revoke any authenticators and credentials associated with the individual
  3. conduct exit interviews that include a discussion of [Assignment: organization-defined information security topics]
  4. retrieve all security-related, organizational system-related property
  5. retain access to organizational information and systems formerly controlled by the terminated individual
 Control Selected NA NA
PS 04(01) Personnel termination Personnel termination: Post-employment requirements
  1. Notify terminated individuals of applicable, legally binding post-employment requirements for the protection of organizational information.
  2. Require terminated individuals to sign an acknowledgment of post-employment requirements as part of the organizational termination process.
 Control Not selected NA NA
PS 04(02) Personnel termination Personnel termination: Automated actions
Use [Assignment: organization-defined automated mechanisms] to [Selection (one or more): notify [Assignment: organization-defined personnel or roles] of individual termination actions; disable access to system resources].		 Control Not selected NA NA
PS 04(400) Personnel termination Personnel termination: Permanently bound to secrecy
Forward data on the form Record of a Person in a Scheduled Department or Agency Under the Security of Information Act (SOIA) to the Canadian Security Intelligence Service (CSIS).		 Control Not selected NA NA
PS 05 Personnel transfer
  1. Review and confirm ongoing operational need for current logical and physical access authorizations to systems and facilities when individuals are reassigned or transferred to other positions within the organization.
  2. Initiate [Assignment: organization-defined transfer or reassignment actions] within [Assignment: organization-defined time period following the formal transfer action].
  3. Modify access authorization as needed to correspond with any changes in operational need due to reassignment or transfer.
  4. Notify [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period].
 Control Not selected NA NA
PS 05(400) Personnel transfer Personnel transfer: Security clearance
  1. Accept the security status or clearance of the individual when the required one is at the same or lesser level previously granted.
  2. Redo the security screening when:
    1. the results are over five years old
    2. there is evidence to suggest that the security screening was not done in accordance with the TBS Standard on Security Screening
    3. there is a security waiver attached to the status or clearance
    4. law enforcement inquiries or security assessments results have been removed from the individual’s file
    5. there is adverse information in the individual’s file that may pose a security risk to the receiving department or agency
 Control Not selected NA NA
PS 06 Access agreements
  1. Develop and document access agreements for organizational systems.
  2. Review and update the access agreements [Assignment: organization-defined frequency].
  3. Verify that individuals requiring access to organizational information and systems:
    1. sign appropriate access agreements prior to being granted access
    2. re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [Assignment: organization-defined frequency]
 Control Selected NA NA
PS 06(01) Access agreements Access agreements: Information requiring special protection
Withdrawn: Incorporated into PS-03.		 NA NA NA NA
PS 06(02) Access agreements Access agreements: Classified information requiring special protection
Verify that access to classified information requiring special protection is granted only to individuals who:
  1. have a valid access authorization that is demonstrated by assigned official government duties
  2. satisfy associated personnel security criteria
  3. have read, understood, and signed a non-disclosure agreement
 Control Not selected NA NA
PS 06(03) Access agreements Access agreements: Post-employment requirements
  1. Notify individuals of applicable, legally binding post-employment requirements for protection of organizational information.
  2. Require individuals to sign an acknowledgment of these requirements, if applicable, as part of granting initial access to covered information.
 Control Not selected NA NA
PS 07 External personnel security
  1. Establish personnel security requirements, including security roles and responsibilities for external providers.
  2. Require external providers to comply with personnel security policies and procedures established by the organization.
  3. Document personnel security requirements.
  4. Require external providers to notify [Assignment: organization-defined personnel or roles] of any personnel transfers or terminations of external personnel who possess organizational credentials and/or badges, or who have system privileges within [Assignment: organization-defined time period].
  5. Monitor provider compliance with personnel security requirements.
  1. The organization ensures security screening of private-sector organizations and individuals who have access to Protected and Classified information, assets, and facilities in accordance with the TBS Standard on Security Screening.
  2. The organization explicitly defines government oversight and end-user roles and responsibilities relative to third-party-provided services in accordance with the TBS Directive on Security Management, Appendix F: Mandatory Procedures for Security in Contracts and Other Arrangements Control.
 Control Selected NA NA
PS 08 Personnel sanctions
  1. Employ a formal sanctions process for individuals who fail to comply with established information security and privacy policies and procedures.
  2. Notify [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] when a formal employee sanctions process is initiated, identifying the individual sanctioned and the reason for the sanction.
 Control Selected NA NA
PS 09 Position descriptions Incorporate security and privacy roles and responsibilities into organizational position descriptions. Activity Selected NA NA
 
Top of page 
 
Table 4.15: Personal information handling and transparency
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
PT 01 Personal information handling and transparency policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): organization-level; mission/business process-level; system-level] privacy policy and personal information handling procedures that:
      1. addresses objectives, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance obligations
      2. is consistent with applicable laws, jurisprudence, directives, regulations, policies, directives, standards, and guidelines
    2. procedures to facilitate the implementation of the privacy policy and procedures for personal information handling and the associated personal information handling and transparency controls
  2. Delegate responsibility to [Assignment: organization-defined official] to develop, document, and communicate personal information handling and transparency policy and procedures.
  3. Review and update personal information handling and transparency:
    1. privacy policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. personal information handling procedures, including transparency requirements [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Control Not allocated to baseline. NA NA
PT 02 Authority to collect and use personal information
  1. Determine and document the [Assignment: organization-defined authority] that permits the [Assignment: organization-defined collection and use] of personal information.
  2. Restrict the [Assignment: organization-defined collection and use] of personal information to only that which is authorized.
 Control Not allocated to baseline. NA NA
PT 02(01) Authority to collect and use personal information Authority to collect and use personal information: Data tagging
Attach data tags containing [Assignment: organization-defined authorized handling] to [Assignment: organization-defined elements of personal information].		 Control Not allocated to baseline. NA NA
PT 02(02) Authority to collect and use personal information Authority to collect and use personal information: Automation
Manage enforcement of the authorized handling of personal information using [Assignment: organization-defined automated mechanisms].		 Control Not allocated to baseline. NA NA
PT 03 Personal information handling uses and disclosures
  1. Identify and document the [Assignment: organization-defined use(s) and disclosure(s)] associated with collections of personal information.
  2. Describe the purpose(s) of collection in the privacy notices and policies of the program activity or organization.
  3. Restrict the [Assignment: organization-defined use(s) and disclosure(s)] of personal information to only that which is compatible with the identified purpose(s) or permissible under the Privacy Act.
  4. Monitor changes in handling personal information and implement [Assignment: organization-defined mechanisms] to ensure that any changes are made in accordance with [Assignment: identified legislative requirements].
  1. Update the PIB and notify the Office of the Privacy commissioner (OPC) and TBS of the new use or disclosure.
 Control Not allocated to baseline. NA NA
PT 03(01) Personal information handling uses and disclosures Personal information handling uses and disclosures: Data tagging
Attach data tags containing the following purposes to [Assignment: organization-defined elements of personal information]: [Assignment: organization-defined handling purposes].		 Control Not allocated to baseline. NA NA
PT 03(02) Personal information handling uses and disclosures Personal information handling uses and disclosures: Automation
Track handling purposes of personal information using [Assignment: organization-defined automated mechanisms].		 Control Not allocated to baseline. NA NA
PT 04 Consent
  1. Ensure that consent is obtained in writing or is otherwise adequately documented, including information such as the date and time of consent.
  2. In the federal government, implement [Assignment: organization-defined tools or mechanisms] for individuals to provide informed consent to the secondary uses or indirect collection of their personal information. Consent must include:
    1. the purpose of the consent
    2. the specific personal information elements involved
    3. in the case of indirect collection, the sources that will be asked to provide the information, as well as the reason for making the collection indirectly
    4. uses or disclosures that are not consistent with the original purpose of the collection and for which consent is being sought
    5. any consequences that may result from withholding consent
    6. any alternatives to providing consent
  3. In the private sector, implement [Assignment: organization-defined tools or mechanisms] for individuals to provide meaningful consent to the collection, use and disclosure of their personal information.
 Control Not allocated to baseline. NA NA
PT 04(01) Consent Consent: Tailored consent Government of Canada
Provide [Assignment: organization-defined mechanisms] to allow individuals to tailor handling permissions to selected elements of personal information.		 Control Not allocated to baseline. NA NA
PT 04(02) Consent Consent: Timely consent
Present [Assignment: organization-defined consent mechanisms] to individuals at [Assignment: organization-defined frequency] and in conjunction with [Assignment: organization-defined personal information handling].		 Control Not allocated to baseline. NA NA
PT 04(03) Consent Consent: Revocation
Implement [Assignment: organization-defined tools or mechanisms] for individuals to revoke consent to the handling of their personal information.		 Control Not allocated to baseline. NA NA
PT 04(400) Consent Consent: Tailored consent private sector
Provide [Assignment: organization-defined mechanisms] to allow individuals to tailor handling permissions to selected elements of personal information.		 Control Not allocated to baseline. NA NA
PT 05 Privacy notice Provide notice to individuals about the collection of their personal information that includes:
  1. the legal authority for the collection of personal information
  2. any legal or administrative consequences of refusing to provide the personal information
  3. the rights of access to, correction, and protection of personal information
  4. a warning that system usage may be monitored, recorded, and subject to audit and includes:
    1. a statement explaining the regular monitoring practices of electronic networks
    2. a statement that electronic networks will be monitored for work-related purposes
    3. a statement that special monitoring may be permitted without notice in instances where illegal or other unacceptable use is suspected
  5. an explanation of how the information will be used
  6. the right to file a complaint with the Privacy Commissioner of Canada regarding the institution’s handling of the individual’s personal information
  7. the relevant PIB reference, if applicable
 Control Not allocated to baseline. NA NA
PT 05(01) Privacy notice Privacy notice: Timely privacy notice statements
Present notice of personal information handling to individuals at the time that the individual provides personal information [Assignment: organization-defined frequency].		 Control Not allocated to baseline. NA NA
PT 05(02) Privacy notice Privacy notice: Privacy notice statements
Include privacy notice statements on forms that collect information which will be maintained in a Personal Information Bank (PIB).		 Control Not allocated to baseline. NA NA
PT 06 Personal information banks Program activities that collect personal information must register and publish a PIB if that information has been used, is being used, or is available for use for an administrative purpose or if it is organized or intended to be retrieved by the name of an individual or by an identifying number, symbol or other particular assigned to an individual. [Assignment: organization-defined roles or personnel] are responsible for:
  1. registering or submitting new or significantly modified PIBs in accordance with TBS Directive on Privacy Practices, using the Personal Information Bank Submission form provided by TBS
  2. publishing PIBs on the relevant institution’s Info Source webpage and updating this information once a year
  3. keeping PIBs accurate, up-to-date, and scoped in accordance with policy
 Control Not allocated to baseline. NA NA
PT 06(01) Personal information banks Personal information banks: Consistent uses and disclosures
Review all consistent uses published in the PIB at [Assignment: organization-defined frequency] to ensure continued accuracy, and to ensure that consistent uses continue to be compatible with the purpose for which the information was collected.		 Control Not allocated to baseline. NA NA
PT 06(02) Personal information banks Personal information banks: Exempt banks
Review all PIBs that were designated as exempt banks under section 18 of the Privacy Act [Assignment: organization-defined frequency] to ensure they remain appropriate and necessary in accordance with law.		 Control Not allocated to baseline. NA NA
PT 07 Particularly sensitive personal information Apply [Assignment: organization-defined handling conditions] for particularly sensitive personal information. Control Not allocated to baseline. NA NA
PT 07(01) Particularly sensitive personal information Particularly sensitive personal information: Social insurance numbers
When a program or activity collects, uses, or discloses social insurance numbers (SINs):
  1. ensure there is express authority for the collection and use of the SIN
  2. provide notice, at the point of collection, regarding the authority to collect as well as the anticipated use or disclosures of the SIN
  3. ensure the collection and use of SIN is included in the associated PIB, if appropriate
 Control Not allocated to baseline. NA NA
PT 07(02) Particularly sensitive personal information Particularly sensitive personal information: Canadian Charter of Rights and Freedoms
Restrict the handling of information describing how any individual exercises rights guaranteed by the Canadian Charter of Rights and Freedoms unless there is lawful authority or is within the scope of an authorized law-enforcement activity.		 Control Not allocated to baseline. NA NA
PT 07(400) Particularly sensitive personal information Particularly sensitive personal information: Private sector
When collecting, using, or disclosing particularly sensitive personal information, private sector organizations should:
  1. determine the form of consent to use, considering the sensitivity of information
  2. protect personal information with [Assignment: organization-defined tools or mechanisms] appropriate to the sensitivity of information
 Control Not allocated to baseline. NA NA
PT 08 Data matching requirements When a program activity seeks to collect, use, or disclose personal information for the purpose of conducting a data matching activity:
  1. ensure the authority exists to collect, use, or disclose the personal information for the purpose of data matching
  2. develop and enter into an information sharing agreement or information sharing arrangement for the purpose of data matching
  3. verify that the [Selection (one): notice to the individual; consent obtained from the individual] identifies that the information will be used for data matching activities
  4. verify that the associated PIB identifies that the information will be used for data-matching activities
 Control Not allocated to baseline. NA NA
 
Top of page 
 
Table 4.16: Risk assessment
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
RA 01 Risk assessment policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): organization-level; Mission/business process-level; System-level] risk assessment policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the risk assessment policy and the associated risk assessment controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the risk assessment policy and procedures.
  3. Review and update the current risk assessment:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
RA 01(400) Risk assessment policy and procedures Risk assessment policy and procedures: Privacy impact assessments
Develop a privacy impact assessment (PIA) process and associated procedures that:
  1. is established by Heads of GC institutions
  2. considers the responsibility within the institution for establishing personal information banks (PIBs)
  3. is commensurate with the severity of potential injuries related to the privacy invasiveness of the institution's programs or activities
  4. ensures the PIA is completed by the appropriate privacy senior official or executive holding responsibility within the institution for new or substantially modified programs or activities
 Activity Not selected NA NA
RA 02 Security categorization
  1. Categorize the system and information it processes, stores, and transmits.
  2. Document the security categorization results, including supporting rationale, in the security plan for the system.
  3. Verify that the authorizing official or authorizing official’s designated representative reviews and approves the security categorization decision.
 Control Selected NA NA
RA 02(01) Security categorization Security categorization: Impact-level prioritization
Conduct an impact-level prioritization of organizational systems to obtain additional granularity on system impact levels.		 Control Not selected NA NA
RA 03 Risk assessment
  1. Conduct a risk assessment, including:
    1. identifying threats to and vulnerabilities in the system
    2. determining the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system, the information it handles, stores, or transmits, and any related information
    3. determining the likelihood and impact of adverse effects on individuals arising from the handling of personal information
  2. Integrate risk assessment results and risk management decisions from the organization and mission or business process perspectives with system-level risk assessments.
  3. Document risk assessment results in [Selection (one): security and privacy plans; risk assessment report; [Assignment: organization-defined document]].
  4. Review risk assessment results [Assignment: organization-defined frequency].
  5. Disseminate risk assessment results to [Assignment: organization-defined personnel or roles].
  6. Update the risk assessment [Assignment: organization-defined frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.
 Control Selected NA NA
RA 03(01) Risk assessment Risk assessment: Supply chain risk assessment
  1. Assess supply chain risks associated with [Assignment: organization-defined systems, system components, and system services].
  2. Update the supply chain risk assessment [Assignment: organization-defined frequency], when there are significant changes to the relevant supply chain, or when changes to the system, environments of operation, or other conditions may necessitate a change in the supply chain.
 Control Selected NA NA
RA 03(02) Risk assessment Risk assessment: Use of all-source intelligence
Use all-source intelligence to assist in the analysis of risk.		 Control Not selected NA NA
RA 03(03) Risk assessment Risk assessment: Dynamic threat awareness
Determine the current cyber threat environment on an ongoing basis using [Assignment: organization-defined means].		 Control Not selected NA NA
RA 03(04) Risk assessment Risk assessment: Predictive cyber analytics
Employ the following advanced automation and analytics capabilities to predict and identify risks to [Assignment: organization-defined systems or system components]: [Assignment: organization-defined advanced automation and analytics capabilities].		 Control Not selected NA NA
RA 04 Risk assessment update Withdrawn: Incorporated into RA-03. NA NA NA NA
RA 05 Vulnerability monitoring and scanning
  1. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported.
  2. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
    1. enumerating platforms, software flaws, and improper configurations
    2. formatting checklists and test procedures
    3. measuring vulnerability impact
  3. Analyze vulnerability scan reports and results from vulnerability monitoring.
  4. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk.
  5. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems.
  6. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.
 Control Selected NA NA
RA 05(01) Vulnerability monitoring and scanning Vulnerability monitoring and scanning: Update tool capability
Withdrawn: Incorporated into RA-05.		 NA NA NA NA
RA 05(02) Vulnerability monitoring and scanning Vulnerability monitoring and scanning: Update vulnerabilities to be scanned
Update the system vulnerabilities to be scanned [Selection (one or more): [Assignment: organization-defined frequency]; prior to a new scan; when new vulnerabilities are identified and reported].		 Control Selected NA NA
RA 05(03) Vulnerability monitoring and scanning Vulnerability monitoring and scanning: Breadth and depth of coverage
Define the breadth and depth of vulnerability scanning coverage.		 Control Not selected NA NA
RA 05(04) Vulnerability monitoring and scanning Vulnerability monitoring and scanning: Discoverable information
Determine information about the system that is discoverable and take [Assignment: organization-defined corrective actions].		 Control Not selected NA NA
RA 05(05) Vulnerability monitoring and scanning Vulnerability monitoring and scanning: Privileged access
Implement privileged access authorization to [Assignment: organization-defined system components] for [Assignment: organization-defined vulnerability scanning activities].		 Control Selected NA NA
RA 05(06) Vulnerability monitoring and scanning Vulnerability monitoring and scanning: Automated trend analyses
Compare the results of multiple vulnerability scans using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
RA 05(07) Vulnerability monitoring and scanning Vulnerability monitoring and scanning: Automated detection and notification of unauthorized components Withdrawn: Incorporated into CM-08. NA NA NA NA
RA 05(08) Vulnerability monitoring and scanning Vulnerability monitoring and scanning: Review historic audit logs
Review historic audit logs to determine if a vulnerability identified in a [Assignment: organization-defined system] has been previously exploited within an [Assignment: organization-defined time period].		 Control Not selected NA NA
RA 05(09) Vulnerability monitoring and scanning Vulnerability monitoring and scanning: Penetration testing and analyses
Withdrawn: Incorporated into CA-08.		 NA NA NA NA
RA 05(10) Vulnerability monitoring and scanning Vulnerability monitoring and scanning: Correlate scanning information
Correlate the output from vulnerability scanning tools to determine the presence of multi-vulnerability and multi-hop attack vectors.		 Control Not selected NA NA
RA 05(11) Vulnerability monitoring and scanning Vulnerability monitoring and scanning: Public disclosure program
Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components.		 Control Selected NA NA
RA 06 Technical surveillance countermeasures survey Employ a technical surveillance countermeasures survey at [Assignment: organization-defined locations] [Selection (one or more): [Assignment: organization-defined frequency]; when the following events or indicators occur: [Assignment: organization-defined events or indicators]]. Control Not selected NA NA
RA 07 Risk response Respond to findings from security and privacy assessments, monitoring, and audits in accordance with organizational risk tolerance. Activity Selected NA NA
RA 08 Privacy impact assessments Conduct PIAs for systems, programs or other activities when:
  1. designing, developing or procuring means of handling personal information
  2. initiating a new collection of personal information
 
  1. making substantial modifications to existing systems, programs or activities where personal information is handled
 Activity Not selected NA NA
RA 09 Criticality analysis Identify critical system components and functions by performing a criticality analysis for [Assignment: organization-defined systems, system components, or system services] at [Assignment: organization-defined decision points in the system development lifecycle]. Activity Selected NA NA
RA 10 Threat hunting
  1. Establish and maintain a cyber threat hunting capability to:
    1. search for indicators of compromise in organizational systems
    2. detect, track, and disrupt threats that evade existing controls
  2. Employ the threat hunting capability [Assignment: organization-defined frequency].
 Control Not selected NA NA
 
Top of page 
 
Table 4.17: System and services acquisition
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
SA 01 System and services acquisition policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] system and services acquisition policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the system and services acquisition policy and the associated system and services acquisition controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures.
  3. Review and update the current system and services acquisition:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
SA 02 Allocation of resources
  1. Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning.
  2. Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process.
  3. Establish a discrete line item for information security and privacy in organizational programming and budgeting documentation.
 Control Selected NA NA
SA 03 System development lifecycle
  1. Acquire, develop, and manage the system using [Assignment: organization-defined system development lifecycle] that incorporates information security and privacy considerations.
  2. Define and document information security and privacy roles and responsibilities throughout the system development lifecycle.
  3. Identify individuals having information security and privacy roles and responsibilities.
  4. Integrate the organizational information security and privacy risk management process into system development lifecycle activities.
 Activity Selected NA NA
SA 03(01) System development lifecycle System development lifecycle: Manage pre-production environment
Protect system pre-production environments commensurate with risk throughout the system development lifecycle for the system, system component, or system service.		 Activity Not selected NA NA
SA 03(02) System development lifecycle System development lifecycle: Use of live or operational data
  1. Approve, document, and control the use of live data in pre-production environments for the system, system component, or system service.
  2. Protect pre-production environments for the system, system component, or system service at the same impact or classification level as any live data in use within the pre-production environments.
 Activity Not selected NA NA
SA 03(03) System development lifecycle System development lifecycle: Technology refresh
Plan for and implement a technology refresh schedule for the system throughout the system development lifecycle.		 Activity Not selected NA NA
SA 04 Acquisition process Include the following requirements, descriptions, and criteria, explicitly or by reference, using [Selection (one or more): standardized contract language; [Assignment: organization-defined contract language]] in the acquisition contract for the system, system component, or system service:
  1. security and privacy functional requirements
  2. strength of mechanism requirements
  3. security and privacy assurance requirements
  4. controls needed to satisfy the security and privacy requirements
  5. security and privacy documentation requirements
  6. requirements for protecting security and privacy documentation
  7. a description of the system development environment and the environment in which the system is intended to operate
  8. the allocation of responsibility or identification of parties responsible for information security, privacy, and supply chain risk management
  9. acceptance criteria
 Control Selected NA NA
SA 04(01) Acquisition process Acquisition process: Functional properties of controls
Require the developer of the system, system component, or system service to provide a description of the functional properties of the controls to be implemented.		 Control Selected NA NA
SA 04(02) Acquisition process Acquisition process: Design and implementation information for controls
Require the developer of the system, system component, or system service to provide design and implementation information for the controls that includes: [Selection (one or more): security-relevant external system interfaces; high-level design; low-level design; source code or hardware schematics; [Assignment: organization-defined design and implementation information]] at [Assignment: organization-defined level of detail].		 Control Not selected NA NA
SA 04(03) Acquisition process Acquisition process: Development methods, techniques, and practices
Require the developer of the system, system component, or system service to demonstrate the use of a system development lifecycle process that includes:
  1. [Assignment: organization-defined systems engineering methods]
  2. [Selection (one or more): [Assignment: organization-defined systems security engineering methods]; [Assignment: organization-defined privacy engineering methods]]
  3. [Assignment: organization-defined software development methods; testing, evaluation, assessment, verification, and validation methods; and quality control processes]
 Control Not selected NA NA
SA 04(04) Acquisition process Acquisition process: Assignment of components to systems
Withdrawn: Incorporated into CM-08(09).		 Control NA NA NA
SA 04(05) Acquisition process Acquisition process: System, component, and service configurations
Require the developer of the system, system component, or system service to:
  1. deliver the system, component, or service with [Assignment: organization-defined security configurations] implemented
  2. use the configurations as the default for any subsequent system, component, or service reinstallation or upgrade
 Control Not selected NA NA
SA 04(06) Acquisition process Acquisition process: Use of cyber security products
  1. Employ only government off-the-shelf or commercial off-the-shelf (COTS) cyber security and cyber security-enabled information technology (IT) products that compose a Cyber Centre-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted.
  2. Ensure that these products have been evaluated or validated by the Cyber Centre or in accordance with Cyber Centre-approved procedures.
 Control Not selected NA NA
SA 04(07) Acquisition process Acquisition process: Canadian Common Criteria Program (CCCP)-approved protection profiles
  1. Limit the use of commercially provided cyber security and cyber security-enabled IT products to those products that have been successfully evaluated against a CCCP-recognized protection profile for a specific technology type, if such a profile exists.
  2. If no CCCP-recognized protection profile exists for a specific technology type but a commercially provided IT product relies on cryptographic functionality to enforce its security policy, require that the cryptographic module is Federal Information Processing Standard (FIPS)-validated or CCCP-recognized.
 Control Not selected NA NA
SA 04(08) Acquisition process Acquisition process: Continuous monitoring plan for controls
Require the developer of the system, system component, or system service to produce a plan for continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.		 Control Not selected NA NA
SA 04(09) Acquisition process Acquisition process: Functions, ports, protocols, and services in use
Require the developer of the system, system component, or system service to identify the functions, ports, protocols, and services intended for organizational use.		 Control Selected NA NA
SA 04(10) Acquisition process Acquisition process: Use of approved digital credential products
Employ only IT products that are recommended by the Cyber Centre for digital credentials capability implemented within organizational systems.		 Control Selected NA NA
SA 04(11) Acquisition process Acquisition process: System of records
Include [Assignment: organization-defined Privacy Act requirements] in the acquisition contract for the operation of a system of records on behalf of an organization to accomplish an organizational mission or function.		 Control Not selected NA NA
SA 04(12) Acquisition process Acquisition process: Data ownership
  1. Include organizational data ownership requirements in the acquisition contract.
  2. Require all data to be removed from the contractor’s system and returned to the organization within [Assignment: organization-defined time frame].
 Control Selected NA NA
SA 05 System documentation
  1. Obtain or develop administrator documentation for the system, system component, or system service that describes:
    1. secure configuration, installation, and operation of the system, component, or service
    2. effective use and maintenance of security and privacy functions and mechanisms
    3. known vulnerabilities regarding configuration and use of administrative or privileged functions
  2. Obtain or develop user documentation for the system, system component, or system service that describes:
    1. user-accessible security and privacy functions and mechanisms and how to effectively use those functions and mechanisms
    2. methods for user interaction, which enable individuals to use the system, component, or service in a more secure manner and protect individual privacy
    3. user responsibilities in maintaining the security of the system, component, or service and privacy of individuals
  3. Document attempts to obtain system, system component, or system service documentation when such documentation is either unavailable or non-existent and take [Assignment: organization-defined actions] in response.
  4. Distribute documentation to [Assignment: organization-defined personnel or roles].
 Activity Selected NA NA
SA 05(01) System documentation System documentation: Functional properties of security controls
Withdrawn: Incorporated into SA-04(01).		 NA NA NA NA
SA 05(02) System documentation System documentation: Security-relevant external system interfaces
Withdrawn: Incorporated into SA-04(02).		 NA NA NA NA
SA 05(03) System documentation System documentation: High-level design
Withdrawn: Incorporated into SA-04(02).		 NA NA NA NA
SA 05(04) System documentation System documentation: Low-level design
Withdrawn: Incorporated into SA-04(02).		 NA NA NA NA
SA 05(05) System documentation System documentation: Source code
Withdrawn: Incorporated into SA-04(02).		 NA NA NA NA
SA 06 Software usage restrictions Withdrawn: Incorporated into CM-10 and SI-07. NA NA NA NA
SA 07 User-installed software Withdrawn: Incorporated into CM-11 and SI-07. NA NA NA NA
SA 08 Security and privacy engineering principles Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [Assignment: organization-defined systems security and privacy engineering principles]. Control Selected NA NA
SA 08(01) Security and privacy engineering principles Security and privacy engineering principles: Clear abstractions
Implement the security design principle of clear abstractions.		 Control Not selected NA NA
SA 08(02) Security and privacy engineering principles Security and privacy engineering principles: Least common mechanism
Implement the security design principle of least common mechanism in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(03) Security and privacy engineering principles Security and privacy engineering principles: Modularity and layering
Implement the security design principles of modularity and layering in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(04) Security and privacy engineering principles Security and privacy engineering principles: Partially ordered dependencies
Implement the security design principle of partially ordered dependencies in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(05) Security and privacy engineering principles Security and privacy engineering principles: Efficiently mediated access
Implement the security design principle of efficiently mediated access in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(06) Security and privacy engineering principles Security and privacy engineering principles: Minimized sharing
Implement the security design principle of minimized sharing in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(07) Security and privacy engineering principles Security and privacy engineering principles: Reduced complexity
Implement the security design principle of reduced complexity in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(08) Security and privacy engineering principles Security and privacy engineering principles: Secure evolvability
Implement the security design principle of secure evolvability in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(09) Security and privacy engineering principles Security and privacy engineering principles: Trusted components
Implement the security design principle of trusted components in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(10) Security and privacy engineering principles Security and privacy engineering principles: Hierarchical trust
Implement the security design principle of hierarchical trust in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(11) Security and privacy engineering principles Security and privacy engineering principles: Inverse modification threshold
Implement the security design principle of inverse modification threshold in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(12) Security and privacy engineering principles Security and privacy engineering principles: Hierarchical protection
Implement the security design principle of hierarchical protection in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(13) Security and privacy engineering principles Security and privacy engineering principles: Minimized security elements
Implement the security design principle of minimized security elements in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(14) Security and privacy engineering principles Security and privacy engineering principles: Least privilege
Implement the security design principle of least privilege in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(15) Security and privacy engineering principles Security and privacy engineering principles: Predicate permission
Implement the security design principle of predicate permission in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(16) Security and privacy engineering principles Security and privacy engineering principles: Self-reliant trustworthiness
Implement the security design principle of self-reliant trustworthiness in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(17) Security and privacy engineering principles Security and privacy engineering principles: Secure distributed composition
Implement the security design principle of secure distributed composition in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(18) Security and privacy engineering principles Security and privacy engineering principles: Trusted communications channels
Implement the security design principle of trusted communications channels in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(19) Security and privacy engineering principles Security and privacy engineering principles: Continuous protection
Implement the security design principle of continuous protection in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(20) Security and privacy engineering principles Security and privacy engineering principles: Secure metadata management
Implement the security design principle of secure metadata management in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(21) Security and privacy engineering principles Security and privacy engineering principles: Self-analysis
Implement the security design principle of self-analysis in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(22) Security and privacy engineering principles Security and privacy engineering principles: Accountability and traceability
Implement the security design principle of accountability and traceability in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(23) Security and privacy engineering principles Security and privacy engineering principles: Secure defaults
Implement the security design principle of secure defaults in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(24) Security and privacy engineering principles Security and privacy engineering principles: Secure failure and recovery
Implement the security design principle of secure failure and recovery in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(25) Security and privacy engineering principles Security and privacy engineering principles: Economic security
Implement the security design principle of economic security in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(26) Security and privacy engineering principles Security and privacy engineering principles: Performance security
Implement the security design principle of performance security in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(27) Security and privacy engineering principles Security and privacy engineering principles: Human factored security
Implement the security design principle of human factored security in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(28) Security and privacy engineering principles Security and privacy engineering principles: Acceptable security
Implement the security design principle of acceptable security in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(29) Security and privacy engineering principles Security and privacy engineering principles: Repeatable and documented procedures
Implement the security design principle of repeatable and documented procedures in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(30) Security and privacy engineering principles Security and privacy engineering principles: Procedural rigour
Implement the security design principle of procedural rigour in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(31) Security and privacy engineering principles Security and privacy engineering principles: Secure system modification
Implement the security design principle of secure system modification in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(32) Security and privacy engineering principles Security and privacy engineering principles: Sufficient documentation
Implement the security design principle of sufficient documentation in [Assignment: organization-defined systems or system components].		 Control Not selected NA NA
SA 08(33) Security and privacy engineering principles Security and privacy engineering principles: Minimization
Implement the privacy principle of minimization using [Assignment: organization-defined processes].		 Control Not selected NA NA
SA 08(400) Security and privacy engineering principles Security and privacy engineering principles: Licensed and certified engineers
Employ licensed and certified security engineers that assume responsibility for the specification, design, development, and implementation of information system security and privacy solutions.		 Control Not selected NA NA
SA 09 External system services
  1. Require that providers of external system services comply with organizational security and privacy requirements and employ the following controls: [Assignment: organization-defined controls].
  2. Define and document organizational oversight and user roles and responsibilities with regard to external system services.
  3. Employ the following processes, methods, and techniques to monitor control compliance by external service providers on an ongoing basis: [Assignment: organization-defined processes, methods, and techniques].
 Control Selected NA NA
SA 09(01) External system services External system services: Risk assessments and organizational approvals
  1. Conduct an organizational risk assessment prior to acquiring or outsourcing information security services.
  2. Verify that the acquisition or outsourcing of dedicated information security services is approved by [Assignment: organization-defined personnel or roles].
 Control Selected NA NA
SA 09(02) External system services External information systems: Identification of functions, ports, protocols, and services
Require providers of the following external system services to identify the functions, ports, protocols, and other services required for the use of such services: [Assignment: organization-defined external system services].		 Control Selected NA NA
SA 09(03) External system services External system services: Establish and maintain trust relationship with providers
Establish, document, and maintain trust relationships with external service providers based on the following requirements, properties, factors, or conditions: [Assignment: organization-defined security and privacy requirements, properties, factors, or conditions defining acceptable trust relationships].		 Control Not selected NA NA
SA 09(04) External system services External system services: Consistent interests of consumers and providers
Take the following actions to verify that the interests of [Assignment: organization-defined external service providers] are consistent with and reflect organizational interests: [Assignment: organization-defined actions].		 Control Not selected NA NA
SA 09(05) External system services External system services: Processing, storage, and service location
Restrict the location of [Selection (one or more): information processing; information or data; system services] to [Assignment: organization-defined locations] based on [Assignment: organization-defined requirements or conditions].		 Control Not selected NA NA
SA 09(06) External system services External system services: Organization-controlled cryptographic keys
Maintain exclusive control of cryptographic keys for encrypted material stored or transmitted through an external system.		 Control Not selected NA NA
SA 09(07) External system services External system services: Organization-controlled integrity checking
Provide the capability to check the integrity of information while it resides in the external system.		 Control Not selected NA NA
SA 09(08) External system services External system services: Processing and storage location — within Canada
Restrict the geographic location of information processing and data storage to facilities located within in the legal jurisdictional boundary of Canada.		 Control Selected NA NA
SA 10 Developer configuration management Require the developer of the system, system component, or system service to:
  1. perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation; disposal]
  2. document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items under configuration management]
  3. implement only organization-approved changes to the system, component, or service
  4. document approved changes to the system, component, or service and the potential security and privacy impacts of such changes
  5. track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel]
 Activity Selected NA NA
SA 10(01) Developer configuration management Developer configuration management: Software and firmware integrity verification
Require the developer of the system, system component, or system service to enable integrity verification of software and firmware components.		 Activity Selected NA NA
SA 10(02) Developer configuration management Developer configuration management: Alternative configuration management processes
Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.		 Activity Not selected NA NA
SA 10(03) Developer configuration management Developer configuration management: Hardware integrity verification
Require the developer of the system, system component, or system service to enable integrity verification of hardware components.		 Activity Not selected NA NA
SA 10(04) Developer configuration management Developer configuration management: Trusted generation
Require the developer of the system, system component, or system service to employ tools for comparing newly generated versions of security-relevant hardware descriptions, source code, and object code with previous versions.		 Activity Not selected NA NA
SA 10(05) Developer configuration management Developer configuration management: Mapping integrity for version control
Require the developer of the system, system component, or system service to maintain the integrity of the mapping between the master build data describing the current version of security-relevant hardware, software, and firmware and the on-site master copy of the data for the current version.		 Activity Not selected NA NA
SA 10(06) Developer configuration management Developer configuration management: Trusted distribution
Require the developer of the system, system component, or system service to execute procedures for ensuring that security-relevant hardware, software, and firmware updates distributed to the organization are exactly as specified by the master copies.		 Activity Not selected NA NA
SA 10(07) Developer configuration management Developer configuration management: Security and privacy representatives
Require [Assignment: organization-defined security and privacy representatives] to be included in the [Assignment: organization-defined configuration change management and control process].		 Activity Selected 1 [SSC, TBS and Cyber Centre]
2 [SSC projects and services serving multiple departments]		 NA
SA 11 Developer testing and evaluation At all post-design stages of the system development lifecycle, require the developer of the system, system component, or system service to:
  1. develop and implement a plan for ongoing security and privacy control assessments
  2. perform [Selection (one or more): unit; integration; system; regression] testing/evaluation [Assignment: organization-defined frequency] at [Assignment: organization-defined depth and coverage]
  3. produce evidence of the execution of the assessment plan and the results of the testing and evaluation
  4. implement a verifiable flaw remediation process
  5. correct flaws identified during testing and evaluation
 Activity Selected NA NA
SA 11(01) Developer testing and evaluation Developer testing and evaluation: Static code analysis
Require the developer of the system, system component, or system service to employ static code analysis tools to identify common flaws and document the results of the analysis.		 Activity Not selected NA NA
SA 11(02) Developer testing and evaluation Developer testing and evaluation: Threat modeling and vulnerability analyses
Require the developer of the system, system component, or system service to perform threat modelling and vulnerability analyses during development and the subsequent testing and evaluation of the system, component, or service that:
  1. uses the following contextual information: [Assignment: organization-defined information concerning impact, environment of operations, known or assumed threats, and acceptable risk levels]
  2. employs the following tools and methods: [Assignment: organization-defined tools and methods]
  3. conducts the modelling and analyses at the following level of rigour: [Assignment: organization-defined breadth and depth of modelling and analyses]
  4. produces evidence that meets the following acceptance criteria: [Assignment: organization-defined acceptance criteria]
 Activity Not selected NA NA
SA 11(03) Developer testing and evaluation Developer testing and evaluation: Independent verification of assessment plans and evidence
  1. Require an independent agent satisfying [Assignment: organization-defined independence criteria] to verify the correct implementation of the developer security and privacy assessment plans and the evidence produced during testing and evaluation.
  2. Verify that the independent agent is provided with sufficient information to complete the verification process or granted the authority to obtain such information.
 Activity Not selected NA NA
SA 11(04) Developer testing and evaluation Developer testing and evaluation: Manual code reviews
Require the developer of the system, system component, or system service to perform a manual code review of [Assignment: organization-defined specific code] using the following processes, procedures, and/or techniques: [Assignment: organization-defined processes, procedures, and/or techniques].		 Activity Not selected NA NA
SA 11(05) Developer testing and evaluation Developer testing and evaluation: Penetration testing
Require the developer of the system, system component, or system service to perform penetration testing:
  1. at the following level of rigour: [Assignment: organization-defined breadth and depth of testing]
  2. under the following constraints: [Assignment: organization-defined constraints]
 Activity Not selected NA NA
SA 11(06) Developer testing and evaluation Developer testing and evaluation: Attack surface reviews
Require the developer of the system, system component, or system service to perform attack surface reviews.		 Activity Not selected NA NA
SA 11(07) Developer testing and evaluation Developer testing and evaluation: Verify scope of testing and evaluation
Require the developer of the system, system component, or system service to verify that the scope of testing and evaluation provides complete coverage of the required controls at the following level of rigour: [Assignment: organization-defined breadth and depth of testing and evaluation].		 Activity Not selected NA NA
SA 11(08) Developer testing and evaluation Developer testing and evaluation: Dynamic code analysis
Require the developer of the system, system component, or system service to employ dynamic code analysis tools to identify common flaws and document the results of the analysis.		 Activity Not selected NA NA
SA 11(09) Developer testing and evaluation Developer testing and evaluation: Interactive application security testing
Require the developer of the system, system component, or system service to employ interactive application security testing tools to identify flaws and document the results.		 Activity Not selected NA NA
SA 12 Supply chain protection Withdrawn: Moved to SR Family. NA NA NA NA
SA 12(01) Supply chain protection Supply chain protection: Acquisition strategies / tools / methods
Withdrawn: Moved to SR-05.		 NA NA NA NA
SA 12(02) Supply chain protection Supply chain protection: Supplier reviews
Withdrawn: Moved to SR-06.		 NA NA NA NA
SA 12(03) Supply chain protection Supply chain protection: Trusted shipping and warehousing
Withdrawn: Incorporated into SR-03.		 NA NA NA NA
SA 12(04) Supply chain protection Supply chain protection: Diversity of suppliers
Withdrawn: Incorporated into SR-03(01).		 NA NA NA NA
SA 12(05) Supply chain protection Supply chain protection: Limitation of harm
Withdrawn: Incorporated into SR-03(02).		 NA NA NA NA
SA 12(06) Supply chain protection Supply chain protection: Minimizing procurement time
Withdrawn: Incorporated into SR-05(01).		 NA NA NA NA
SA 12(07) Supply chain protection Supply chain protection: Assessments prior to selection / acceptance / update
Withdrawn: Moved to SR-05(02).		 NA NA NA NA
SA 12(08) Supply chain protection Supply chain protection: Use of all-source intelligence
Withdrawn: Incorporated into RA-03(02).		 NA NA NA NA
SA 12(09) Supply chain protection Supply chain protection: Operations security
Withdrawn: Moved to SR-07.		 NA NA NA NA
SA 12(10) Supply chain protection Supply chain protection: Validate as genuine and not altered
Withdrawn: Moved to SR-04(03).		 NA NA NA NA
SA 12(11) Supply chain protection Supply chain protection: Penetration testing / analysis of elements, processes, and actors
Withdrawn: Moved to SR-06(01).		 NA NA NA NA
SA 12(12) Supply chain protection Supply chain protection: Inter-organizational agreements
Withdrawn: Moved to SR-08.		 NA NA NA NA
SA 12(13) Supply chain protection Supply chain protection: Critical information system components
Withdrawn: Incorporated into MA-06 and RA-09.		 NA NA NA NA
SA 12(14) Supply chain protection Supply chain protection: Identity and traceability
Withdrawn: Moved to SR-04(01) and SR-04(02).		 NA NA NA NA
SA 12(15) Supply chain protection Supply chain protection: Processes to address weaknesses or deficiencies
Withdrawn: Incorporated into SR-03.		 NA NA NA NA
SA 13 Trustworthiness Withdrawn: Incorporated into SA-08. NA NA NA NA
SA 14 Criticality analysis Withdrawn: Incorporated into RA-09. NA NA NA NA
SA 14(01) Criticality analysis Criticality analysis: Critical components with no viable alternative sourcing
Withdrawn: Incorporated into SA-20.		 NA NA NA NA
SA 15 Development process, standards, and tool
  1. Require the developer of the system, system component, or system service to follow a documented development process that:
    1. explicitly addresses security and privacy requirements
    2. identifies the standards and tools used in the development process
    3. documents the specific tool options and tool configurations used in the development process
    4. documents, manages, and ensures the integrity of changes to the process and/or tools used in development
  2. Review the development process, standards, tools, tool options, and tool configurations [Assignment: organization-defined frequency] to determine if the process, standards, tools, tool options, and tool configurations selected and employed can satisfy the following security and privacy requirements: [Assignment: organization-defined security and privacy requirements].
 Activity Selected NA NA
SA 15(01) Development process, standards, and tool Development process, standards, and tools: Quality metrics
Require the developer of the system, system component, or system service to:
  1. define quality metrics at the beginning of the development process
  2. provide evidence of meeting the quality metrics [Selection (one or more): [Assignment: organization-defined frequency]; [Assignment: organization-defined program review milestones]; upon delivery]
 Activity Not selected NA NA
SA 15(02) Development process, standards, and tool Development process, standards, and tools: Security and privacy control traceability tools
Require the developer of the system, system component, or system service to select and employ security and privacy controls traceability tools for use during the development process.		 Activity Not selected NA NA
SA 15(03) Development process, standards, and tool Development process, standards, and tools: Criticality analysis
Require the developer of the system, system component, or system service to perform a criticality analysis:
  1. at the following decision points in the system development lifecycle: [Assignment: organization-defined decision points in the system development lifecycle]
  2. at the following level of rigour: [Assignment: organization-defined breadth and depth of criticality analysis]
 Activity Selected NA NA
SA 15(04) Development process, standards, and tool Development process, standards, and tools: Threat modeling / vulnerability analysis
Withdrawn: Incorporated into SA-11(02).		 NA NA NA NA
SA 15(05) Development process, standards, and tool Development process, standards, and tools: Attack surface reduction
Require the developer of the system, system component, or system service to reduce attack surfaces to [Assignment: organization-defined thresholds].		 Activity Not selected NA NA
SA 15(06) Development process, standards, and tool Development process, standards, and tools: Continuous improvement
Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process.		 Activity Not selected NA NA
SA 15(07) Development process, standards, and tool Development process, standards, and tools: Automated vulnerability analysis
Require the developer of the system, system component, or system service [Assignment: organization-defined frequency] to:
  1. perform an automated vulnerability analysis using [Assignment: organization-defined tools]
  2. determine the exploitation potential for discovered vulnerabilities
  3. determine potential risk mitigations for delivered vulnerabilities
  4. deliver the outputs of the tools and results of the analysis to [Assignment: organization-defined personnel or roles]
 Activity Not selected NA NA
SA 15(08) Development process, standards, and tool Development process, standards, and tools: Reuse of threat and vulnerability information
Require the developer of the system, system component, or system service to use threat modeling and vulnerability analyses from similar systems, components, or services to inform the current development process.		 Activity Not selected NA NA
SA 15(09) Development process, standards, and tool Development process, standards, and tools: Use of live data Withdrawn: Incorporated into SA-03(02). NA NA NA NA
SA 15(10) Development process, standards, and tool Development process, standards, and tools: Incident response plan
Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan.		 Activity Not selected NA NA
SA 15(11) Development process, standards, and tool Development process, standards, and tools: Archive system or component
Require the developer of the system or system component to archive the system or component to be released or delivered together with the corresponding evidence supporting the final security and privacy review.		 Activity Not selected NA NA
SA 15(12) Development process, standards, and tool Development process, standards, and tool: Minimize personal information
Require the developer of the system or system component to minimize the use of personal information in development and test environments.		 Activity Not selected NA NA
SA 16 Developer provided training Require the developer of the system, system component, or system service to provide the following training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms: [Assignment: organization-defined training]. Control Selected NA NA
SA 17 Developer security and privacy architecture and design Require the developer of the system, system component, or system service to produce a design specification and security and privacy architecture that:
  1. is consistent with the organization’s security and privacy architecture that is an integral part the organization’s enterprise architecture
  2. accurately and completely describes the required security and privacy functionality and the allocation of controls among physical and logical components
  3. expresses how individual security and privacy functions, mechanisms, and services work together to provide required security and privacy capabilities and a unified approach to protection
 Activity Selected NA NA
SA 17(01) Developer security and privacy architecture and design Developer security and privacy architecture and design: Formal policy model
Require the developer of the system, system component, or system service to:
  1. produce, as an integral part of the development process, a formal policy model describing the [Assignment: organization-defined elements of organizational security and privacy policy] to be enforced
  2. prove that the formal policy model is internally consistent and sufficient to enforce the defined elements of the organizational security and privacy policy when implemented
 Activity Not selected NA NA
SA 17(02) Developer security and privacy architecture and design Developer security and privacy architecture and design: Security-relevant components
Require the developer of the system, system component, or system service to:
  1. define security-relevant hardware, software, and firmware
  2. provide a rationale that the definition for security-relevant hardware, software, and firmware is complete
 Activity Not selected NA NA
SA 17(03) Developer security and privacy architecture and design Developer security and privacy architecture and design: Formal correspondence
Require the developer of the system, system component, or system service to:
  1. produce, as an integral part of the development process, a formal top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions, error messages, and effects
  2. show, via proof to the extent feasible with additional informal demonstration as necessary, that the formal top-level specification is consistent with the formal policy model
  3. show, via informal demonstration, that the formal top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware
  4. show that the formal top-level specification is an accurate description of the implemented security-relevant hardware, software, and firmware
  5. describe the security-relevant hardware, software, and firmware mechanisms not addressed in the formal top-level specification but strictly internal to the security-relevant hardware, software, and firmware
 Activity Not selected NA NA
SA 17(04) Developer security and privacy architecture and design Developer security and privacy architecture and design: Informal correspondence
Require the developer of the system, system component, or system service to:
  1. produce, as an integral part of the development process, an informal descriptive top-level specification that specifies the interfaces to security-relevant hardware, software, and firmware in terms of exceptions, error messages, and effects
  2. show, via [Selection (one): informal demonstration; convincing argument with formal methods as feasible], that the descriptive top-level specification is consistent with the formal policy model
  3. show, via informal demonstration, that the descriptive top-level specification completely covers the interfaces to security-relevant hardware, software, and firmware
  4. show that the descriptive top-level specification is an accurate description of the interfaces to security-relevant hardware, software, and firmware
  5. describe the security-relevant hardware, software, and firmware mechanisms not addressed in the descriptive top-level specification but strictly internal to the security-relevant hardware, software, and firmware
 Activity Not selected NA NA
SA 17(05) Developer security and privacy architecture and design Developer security and privacy architecture and design: Conceptually simple design
Require the developer of the system, system component, or system service to:
  1. design and structure the security-relevant hardware, software, and firmware to use a complete, conceptually simple protection mechanism with precisely defined semantics
  2. internally structure the security-relevant hardware, software, and firmware with specific regard for this mechanism
 Activity Not selected NA NA
SA 17(06) Developer security and privacy architecture and design Developer security and privacy architecture and design: Structure for testing
Require the developer of the system, system component, or system service to structure security-relevant hardware, software, and firmware to facilitate testing.		 Activity Not selected NA NA
SA 17(07) Developer security and privacy architecture and design Developer security and privacy architecture and design: Structure for least privilege
Require the developer of the system, system component, or system service to structure security-relevant hardware, software, and firmware to facilitate controlling access with least privilege.		 Activity Not selected NA NA
SA 17(08) Developer security and privacy architecture and design Developer security and privacy architecture and design: Orchestration
Design [Assignment: organization-defined critical systems or system components] with coordinated behaviour to implement the following capabilities: [Assignment: organization-defined capabilities, by system or component].		 Activity Not selected NA NA
SA 17(09) Developer security and privacy architecture and design Developer security and privacy architecture and design: Design diversity
Use different designs for [Assignment: organization-defined critical systems or system components] to satisfy a common set of requirements or to provide equivalent functionality.		 Activity Not selected NA NA
SA 18 Tamper resistance and detection Withdrawn: Moved to SR-09. NA NA NA NA
SA 18(01) Tamper resistance and detection Tamper resistance and detection: Multiple phases of SDLC
Withdrawn: Moved to SR-09(01).		 NA NA NA NA
SA 18(02) Tamper resistance and detection Tamper resistance and detection: Inspection of information systems, components, or devices
Withdrawn: Moved to SR-10.		 NA NA NA NA
SA 19 Component authenticity Withdrawn: Moved to SR-11. NA NA NA NA
SA 19(01) Component authenticity Component authenticity: Anti-counterfeit training
Withdrawn: Moved to SR-11(01).		 NA NA NA NA
SA 19(02) Component authenticity Component authenticity: Configuration control for component service / repair
Withdrawn: Moved to SR-11(02).		 NA NA NA NA
SA 19(03) Component authenticity Component authenticity: Component disposal
Withdrawn: Moved to SR-12.		 NA NA NA NA
SA 19(04) Component authenticity Component authenticity: Anti-counterfeit scanning
Withdrawn: Moved to SR-11(03).		 NA NA NA NA
SA 20 Customized development of critical components Reimplement or custom develop the following critical system components: [Assignment: organization-defined critical system components]. Control Not selected NA NA
SA 21 Developer screening Require that the developer of [Assignment: organization-defined system, system component, or system service]:
  1. has appropriate access authorizations as determined by assigned [Assignment: organization-defined official government duties]
  2. satisfies the following additional personnel screening criteria: [Assignment: organization-defined additional personnel screening criteria]
 Control Not selected NA NA
SA 21(01) Developer screening Developer screening: Validation of screening
Withdrawn: Incorporated into SA-21.		 NA NA NA NA
SA 22 Unsupported system components
  1. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer.
  2. Provide the following options for alternative sources for continued support for unsupported components [Selection (one or more): in-house support; [Assignment: organization-defined support from external providers]].
 Control Selected NA NA
SA 22(01) Unsupported system components Unsupported system components: Alternative sources for continued support
Withdrawn: Incorporated into SA-22.		 NA NA NA NA
SA 23 Specialization Employ [Selection (one or more): design; modification; augmentation; reconfiguration] on [Assignment: organization-defined systems or system components] supporting mission-essential services or functions to increase the robustness in those systems or components. Activity Not selected NA NA
SA 400 Sovereignty and jurisdiction Require the organizational business function to conduct a sovereignty and jurisdiction threat and risk assessment process at the [Selection (one or more): organization-level, mission/business-level, system-level] that:
  1. conducts an injury assessment to determine the maximum potential injuries that may be suffered due to external legal compulsion of the business functions or information assets by:
    1. considering the business needs for security including any laws or regulations which require that data not be disclosed or compromised
    2. updating the security categorization of the business functions or information assets
    3. documenting the negative consequences of legal compulsion
  2. performs jurisdiction-specific threat assessment that establishes a likelihood of being targeted
  3. undertakes a vulnerability assessment to evaluate the potential means by which the external jurisdiction could exploit the business functions or information assets
  4. completes a jurisdiction-specific risk assessment
 Control Selected NA NA
SA 400(01) Sovereignty and jurisdiction Sovereignty and jurisdiction: Threat and risk assessment
Require the organization to perform threat and risk assessments in relation to data sovereignty, considering its jurisdiction and by which surfaces legal compulsion may be effective.		 Control Not selected NA NA
SA 400(02) Sovereignty and jurisdiction Sovereignty and jurisdiction: Legal and contractual assessment
Require the organization to perform threat and risk assessments in relation to data sovereignty, considering its jurisdiction and by which surfaces legal compulsion may be effective.		 Control Not selected NA NA
SA 400(03) Sovereignty and jurisdiction Sovereignty and jurisdiction: Business process attribute marking
Ensure business processes receive the intended handling with respect to legal jurisdiction.		 Control Not selected NA NA
SA 400(04) Sovereignty and jurisdiction Sovereignty and jurisdiction: Protection of data at rest
Prevent data from residing in any other legal jurisdiction.		 Control Not selected NA NA
SA 400(05) Sovereignty and jurisdiction Sovereignty and jurisdiction: Protection of data in transit
Prevent data from transiting through any other legal jurisdiction.		 Control Not selected NA NA
SA 400(06) Sovereignty and jurisdiction Sovereignty and jurisdiction: Protection of data in use
Prevent data from being used in any other legal jurisdiction.		 Control Not selected NA NA
SA 400(07) Sovereignty and jurisdiction Sovereignty and jurisdiction: Protection against extraterritorial compulsion
Prevent business functions from being compromised by individuals or corporations that are being compelled by a different legal jurisdiction.		 Control Not selected NA NA
SA 400(08) Sovereignty and jurisdiction Sovereignty and jurisdiction: Protection of business lifecycle
Prevent business functions from being compromised by lifecycle attacks embedded via legal compulsion in or from a different legal jurisdiction.		 Control Not selected NA NA
SA 400(09) Sovereignty and jurisdiction Sovereignty and jurisdiction: Public ownership
Prevent business functions from being compromised by ownership transfer of lifecycle functions to a different legal jurisdiction.		 Control Not selected NA NA
 
Top of page 
 
Table 4.18: System and communications protection
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
SC 01 System and communications protection policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] system and communications protection policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the system and communications protection policy and the associated system and communications protection controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the system and communications protection policy and procedures.
  3. Review and update the current system and communications protection:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
SC 02 Separation of system and user functionality Separate user functionality, including user interface services, from system management functionality. Control Selected NA NA
SC 02(01) Separation of system and user functionality Separation of system and user functionality: Interfaces for non-privileged users
Prevent the presentation of system management functionality at interfaces to non-privileged users.		 Control Not selected NA NA
SC 02(02) Separation of system and user functionality Separation of system and user functionality: Disassociability
Store state information from applications and software separately.		 Control Not selected NA NA
SC 03 Security function isolation Isolate security functions from non-security functions. Control Not selected NA NA
SC 03(01) Security function isolation Security function isolation: Hardware separation
Employ hardware separation mechanisms to implement security function isolation.		 Control Not selected NA NA
SC 03(02) Security function isolation Security function isolation: Access and flow control functions
Isolate security functions enforcing access and information flow control from non-security functions and from other security functions.		 Control Not selected NA NA
SC 03(03) Security function isolation Security function isolation: Minimize non-security functionality
Minimize the number of non-security functions included within the isolation boundary containing security functions.		 Control Not selected NA NA
SC 03(04) Security function isolation Security function isolation: Module coupling and cohesiveness
Implement security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.		 Control Not selected NA NA
SC 03(05) Security function isolation Security function isolation: Layered structures
Implement security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.		 Control Not selected NA NA
SC 04 Information in shared system resources Prevent unauthorized and unintended information transfer via shared system resources. Control Selected NA NA
SC 04(01) Information in shared system resources Information in shared system resources: Security levels
Withdrawn: Incorporated into SC-04.		 NA NA NA NA
SC 04(02) Information in shared system resources Information in shared system resources: Multilevel or periods processing
Prevent unauthorized information transfer via shared resources in accordance with [Assignment: organization-defined procedures] when system processing explicitly switches between different information classification levels or security categories.		 Control Not selected NA NA
SC 05 Denial-of-service protection
  1. [Selection (one): Protect against; Limit] the effects of the following types of denial-of-service events: [Assignment: organization-defined types of denial-of-service events].
  2. Employ the following controls to achieve the denial-of-service objective: [Assignment: organization-defined controls by type of denial-of-service event].
 Control Selected NA NA
SC 05(01) Denial-of-service protection Denial-of-service protection: Restrict ability to attack other systems
Restrict the ability of individuals to launch the following denial-of-service attacks against other systems: [Assignment: organization-defined denial-of-service attacks].		 Control Not selected NA NA
SC 05(02) Denial-of-service protection Denial-of service-protection: Capacity, bandwidth, and redundancy
Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding denial-of-service attacks.		 Control Selected NA NA
SC 05(03) Denial-of-service protection Denial-of-service protection: Detection and monitoring
  1. Employ the following monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system: [Assignment: organization-defined monitoring tools].
  2. Monitor the following system resources to determine if sufficient resources exist to prevent effective denial-of-service attacks: [Assignment: organization-defined system resources].
 Control Not selected NA NA
SC 06 Resource availability Protect the availability of resources by allocating [Assignment: organization-defined resources] by [Selection (one or more): priority; quota; [Assignment: organization-defined controls]]. Control Not selected NA NA
SC 07 Boundary protection
  1. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system.
  2. Implement subnetworks for publicly accessible system components that are [Selection (one): physically; logically] separated from internal organizational networks.
  3. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.
 Control Selected NA NA
SC 07(01) Boundary protection Boundary protection: Physically separated subnetworks
Withdrawn: Incorporated into SC-07.		 NA NA NA NA
SC 07(02) Boundary protection Boundary protection: Public access
Withdrawn: Incorporated into SC-07.		 NA NA NA NA
SC 07(03) Boundary protection Boundary protection: Access points
Limit the number of external network connections to the system.		 Control Selected NA NA
SC 07(04) Boundary protection Boundary protection: External telecommunications services
  1. Implement a managed interface for each external telecommunication service.
  2. Establish a traffic flow policy for each managed interface.
  3. Protect the confidentiality and integrity of the information being transmitted across each interface.
  4. Document each exception to the traffic flow policy with a supporting mission or business need and the duration of that need.
  5. Review exceptions to the traffic flow policy [Assignment: organization-defined frequency] and remove exceptions that are no longer supported by an explicit mission or business need.
  6. Prevent unauthorized exchange of control plane traffic with external networks.
  7. Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks.
  8. Filter unauthorized control plane traffic from external networks.
 Control Selected NA NA
SC 07(05) Boundary protection Boundary protection: deny by default - Allow by exception
Deny network communications traffic by default and allow network communications traffic by exception [Selection (one or more): at managed interfaces; for [Assignment: organization-defined systems]].		 Control Selected NA NA
SC 07(06) Boundary protection Boundary protection: Response to recognized failures
Withdrawn: Incorporated into SC-07(18).		 Control Not selected NA NA
SC 07(07) Boundary protection Boundary protection: Split tunnelling for remote devices
Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignment: organization-defined safeguards].		 Control Selected NA NA
SC 07(08) Boundary protection Boundary protection: Route traffic to authenticated proxy servers
Route [Assignment: organization-defined internal communications traffic] to [Assignment: organization-defined external networks] through authenticated proxy servers at managed interfaces.		 Control Selected NA NA
SC 07(09) Boundary protection Boundary protection: Restrict threatening outgoing communications traffic
  1. Detect and deny outgoing communications traffic posing a threat to external systems.
  2. Audit the identity of internal users associated with denied communications.
 Control Selected NA NA
SC 07(10) Boundary protection Boundary protection: Prevent exfiltration
  1. Prevent the exfiltration of information.
  2. Conduct exfiltration tests [Assignment: organization-defined frequency].
 Control Not selected NA NA
SC 07(11) Boundary protection Boundary protection: Restrict incoming communications traffic
Only allow incoming communications from [Assignment: organization-defined authorized sources] to be routed to [Assignment: organization-defined authorized destinations].		 Control Selected NA NA
SC 07(12) Boundary protection Boundary protection: Host-based protection
Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components].		 Control Selected NA NA
SC 07(13) Boundary protection Boundary protection: Isolation of security tools, mechanisms, and support components
Isolate [Assignment: organization-defined information security tools, mechanisms, and support components] from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.		 Control Selected NA NA
SC 07(14) Boundary protection Boundary protection: Protects against unauthorized physical connections
Protect against unauthorized physical connections at [Assignment: organization-defined managed interfaces].		 Control Not selected NA NA
SC 07(15) Boundary protection Boundary protection: Network privileged accesses
Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.		 Control Not selected NA NA
SC 07(16) Boundary protection Boundary protection: Prevent discovery of system components
Prevent the discovery of specific system components that represent a managed interface.		 Control Not selected NA NA
SC 07(17) Boundary protection Boundary protection: Automated enforcement of protocol formats
Enforce adherence to protocol formats.		 Control Not selected NA NA
SC 07(18) Boundary protection Boundary protection: Fail secure
Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device.		 Control Not selected NA NA
SC 07(19) Boundary protection Boundary protection: Block communication from non-organizationally configured hosts
Block inbound and outbound communications traffic between [Assignment: organization-defined communication clients] that are independently configured by end users and external service providers.		 Control Not selected NA NA
SC 07(20) Boundary protection Boundary protection: Dynamic isolation and segregation
Provide the capability to dynamically isolate [Assignment: organization-defined system components] from other system components.		 Control Not selected NA NA
SC 07(21) Boundary protection Boundary protection: Isolation of system components
Employ boundary protection mechanisms to isolate [Assignment: organization-defined system components] supporting [Assignment: organization-defined missions and/or business functions].		 Control Not selected NA NA
SC 07(22) Boundary protection Boundary protection: Separate subnets for connecting to different security domains
Implement separate network addresses to connect to systems in different security domains.		 Control Not selected NA NA
SC 07(23) Boundary protection Boundary protection: Disable sender feedback on protocol validation failure
Disable feedback to senders on protocol format validation failure.		 Control Not selected NA NA
SC 07(24) Boundary protection Boundary protection: Personal information
For systems that handle personal information:
  1. apply the following handling rules to data elements of personal information: [Assignment: organization-defined handling rules]
  2. monitor for permitted handling at the external interfaces to the system and at key internal boundaries within the system
  3. document each handling exception
  4. review and remove exceptions that are no longer supported
 Control Not selected NA NA
SC 07(25) Boundary protection Boundary protection: Unclassified national security system connections
Prohibit the direct connection of [Assignment: organization-defined unclassified national security system] to an external network without the use of [Assignment: organization-defined boundary protection device].		 Control Not selected NA NA
SC 07(26) Boundary protection Boundary protection: Classified national security system connections
Prohibit the direct connection of a classified national security system to an external network without the use of [Assignment: organization-defined boundary protection device].		 Control Not selected NA NA
SC 07(27) Boundary protection Boundary protection: Unclassified non-national security system connections
Prohibit the direct connection of [Assignment: organization-defined unclassified non-national security system] to an external network without the use of [Assignment: organization-defined boundary protection device].		 Control Not selected NA NA
SC 07(28) Boundary protection Boundary protection: Connections to public networks
Prohibit the direct connection of [Assignment: organization-defined system] to a public network.		 Control Not selected NA NA
SC 07(29) Boundary protection Boundary protection: Separate subnets to isolate functions
Implement [Selection (one): physically; logically] separate subnetworks to isolate the following critical system components and functions: [Assignment: organization-defined critical system components and functions].		 Control Not selected NA NA
SC 08 Transmission confidentiality and integrity Protect the [Selection (one or more): confidentiality; integrity] of transmitted information. Control Selected NA NA
SC 08(01) Transmission confidentiality and integrity Transmission confidentiality and integrity: Cryptographic protection
Implement cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.		 Control Selected NA NA
SC 08(02) Transmission confidentiality and integrity Transmission confidentiality and integrity: Pre- and post-transmission handling
Maintain the [Selection (one or more): confidentiality; integrity] of information during preparation for transmission and during reception.		 Control Not selected NA NA
SC 08(03) Transmission confidentiality and integrity Transmission confidentiality and integrity: Cryptographic protection for message externals
Implement cryptographic mechanisms to protect message externals unless otherwise protected by [Assignment: organization-defined alternative physical controls].		 Control Not selected NA NA
SC 08(04) Transmission confidentiality and integrity Transmission confidentiality and integrity: Conceal or randomize communications
Implement cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by [Assignment: organization-defined alternative physical controls].		 Control Not selected NA NA
SC 08(05) Transmission confidentiality and integrity Transmission confidentiality and integrity: Protected distribution system
Implement [Assignment: organization-defined protected distribution system] to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission.		 Control Not selected NA NA
SC 09 Transmission confidentiality Withdrawn: Incorporated into SC-08. NA NA NA NA
SC 10 Network disconnect Terminate the network connection associated with a communications session at the end of the session or after [Assignment: organization-defined time period] of inactivity. Control Selected NA NA
SC 11 Trusted path
  1. Provide a [Selection (one): physically; logically] isolated trusted communications path for communications between the user and the trusted components of the system.
  2. Permit users to invoke the trusted communications path for communications between the user and the following security functions of the system, including at a minimum, authentication and re-authentication: [Assignment: organization-defined security functions].
 Control Not selected NA NA
SC 11(01) Trusted path Trusted path: Irrefutable communications path
  1. Provide a trusted communications path that is irrefutably distinguishable from other communications paths.
  2. Initiate the trusted communications path for communications between the [Assignment: organization-defined security functions] of the system and the user.
 Control Not selected NA NA
SC 12 Cryptographic key establishment and management Establish and manage cryptographic keys when cryptography is employed within the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction]. Control Selected NA NA
SC 12(01) Cryptographic key establishment and management Cryptographic key establishment and management: Availability
Maintain availability of information in the event of the loss of cryptographic keys by users.		 Control Selected NA NA
SC 12(02) Cryptographic key establishment and management Cryptographic key establishment and management: Symmetric keys
Produce, control, and distribute symmetric cryptographic keys using [Selection (one): CMVP-validated; Cyber Centre-approved; prepositioned keying material] key management technology and processes.		 Control Not selected NA NA
SC 12(03) Cryptographic key establishment and management Cryptographic key establishment and management: Asymmetric keys
Produce, control, and distribute asymmetric cryptographic keys using [Selection (one): Cyber Centre-approved key management technology and processes; prepositioned keying material; Cyber Centre-approved or Cyber Centre-issued Medium Assurance Public Key Infrastructure (PKI) certificates; Cyber Centre-approved or Cyber Centre-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user’s private key; certificates issued in accordance with organization-defined requirements].		 Control Not selected NA NA
SC 12(04) Cryptographic key establishment and management Cryptographic key establishment and management: PKI certificates
Withdrawn: Incorporated into SC-12(03).		 NA NA NA NA
SC 12(05) Cryptographic key establishment and management Cryptographic key establishment and management: PKI certificates / hardware tokens
Withdrawn: Incorporated into SC-12(03).		 NA NA NA NA
SC 12(06) Cryptographic key establishment and management Cryptographic key establishment and management: Physical control of keys
Maintain physical control of cryptographic keys when stored information is encrypted by external service providers.		 Control Not selected NA NA
SC 13 Cryptographic protection
  1. Determine the [Assignment: organization-defined cryptographic uses].
  2. Implement the following types of cryptography required for each specified cryptographic use: [Assignment: organization-defined types of cryptography for each specified cryptographic use].
 Control Selected NA NA
SC 13(01) Cryptographic protection Cryptographic protection: FIPS-validated cryptography
Withdrawn: Incorporated into SC-13.		 NA NA NA NA
SC 13(02) Cryptographic protection Cryptographic protection: National Security Agency (NSA)-approved cryptography
Withdrawn: Incorporated into SC-13.		 NA NA NA NA
SC 13(03) Cryptographic protection Cryptographic protection: Individuals without formal access approvals
Withdrawn: Incorporated into SC-13.		 NA NA NA NA
SC 13(04) Cryptographic protection Cryptographic protection: Digital signatures
Withdrawn: Incorporated into SC-13.		 NA NA NA NA
SC 13(400) Cryptographic protection Cryptographic protection: Protected A data in transit
Withdrawn: Incorporated into SC-13.		 NA NA NA NA
SC 13(401) Cryptographic protection Cryptographic protection: Protected B data in transit
Withdrawn: Incorporated into SC-13.		 NA NA NA NA
SC 13(402) Cryptographic protection Cryptographic protection: Protected C data in transit
Withdrawn: Incorporated into SC-13.		 NA NA NA NA
SC 13(403) Cryptographic protection Cryptographic protection: Protected data at rest
Withdrawn: Incorporated into SC-13.		 NA NA NA NA
SC 13(404) Cryptographic protection Cryptographic protection: National security systems
Withdrawn: Incorporated into SC-13.		 NA NA NA NA
SC 14 Public access protections Withdrawn: Incorporated into AC-02, AC-03, AC-05, AC-06, SI-03, SI-04, SI-05, SI-07, and SI-10. NA NA NA NA
SC 15 Collaborative computing devices and applications
  1. Prohibit remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: organization-defined exceptions where remote activation is to be allowed].
  2. Provide an explicit indication of use to users physically present at the devices.
 Control Selected NA NA
SC 15(01) Collaborative computing devices and applications Collaborative computing devices and applications: Physical or logical disconnect
Provide [Selection (one or more): physical; logical] disconnect of collaborative computing devices in a manner that supports ease of use.		 Control Not selected NA NA
SC 15(02) Collaborative computing devices and applications Collaborative computing devices and applications: Blocking inbound / outbound communications traffic
Withdrawn: Incorporated into SC-07.		 NA NA NA NA
SC 15(03) Collaborative computing devices and applications Collaborative computing devices and applications: Disabling and removal in secure work areas
Disable or remove collaborative computing devices and applications from [Assignment: organization-defined systems or system components] in [Assignment: organization-defined secure work areas].		 Control Selected NA NA
SC 15(04) Collaborative computing devices and applications Collaborative computing devices and applications: Explicitly indicate current participants
Provide an explicit indication of current participants in [Assignment: organization-defined online meetings and teleconferences].		 Control Not selected NA NA
SC 16 Transmission of security and privacy attributes Associate [Assignment: organization-defined security and privacy attributes] with information exchanged between systems and between system components. Control Not selected NA NA
SC 16(01) Transmission of security and privacy attributes Transmission of security and privacy attributes: Integrity verification
Verify the integrity of transmitted security and privacy attributes.		 Control Not selected NA NA
SC 16(02) Transmission of security and privacy attributes Transmission of security and privacy attributes: Anti-spoofing mechanisms
Implement anti-spoofing mechanisms to prevent adversaries from falsifying the security attributes indicating the successful application of the security process.		 Control Not selected NA NA
SC 16(03) Transmission of security and privacy attributes Transmission of security and privacy attributes: Cryptographic binding
Implement [Assignment: organization-defined mechanisms or techniques] to bind security and privacy attributes to transmitted information.		 Control Not selected NA NA
SC 17 Public key infrastructure certificates
  1. Issue public key certificates under an [Assignment: organization-defined certificate policy] or obtain public key certificates from an approved service provider; and
  2. Include only approved trust anchors in trust stores or certificate stores managed by the organization.
 Control Selected NA NA
SC 18 Mobile code
  1. Define acceptable and unacceptable mobile code and mobile code technologies.
  2. Authorize, monitor, and control the use of mobile code within the system.
 Control Selected NA NA
SC 18(01) Mobile code Mobile code: Identify unacceptable code and take corrective actions
Identify [Assignment: organization-defined unacceptable mobile code] and take [Assignment: organization-defined corrective actions].		 Control Selected NA NA
SC 18(02) Mobile code Mobile code: Acquisition, development, and use
Verify that the acquisition, development, and use of mobile code to be deployed in the system meets [Assignment: organization-defined mobile code requirements].		 Control Selected NA NA
SC 18(03) Mobile code Mobile code: Prevent downloading and execution
Prevent the download and execution of [Assignment: organization-defined unacceptable mobile code].		 Control Selected NA NA
SC 18(04) Mobile code Mobile code: Prevent automatic execution
Prevent the automatic execution of mobile code in [Assignment: organization-defined software applications] and enforce [Assignment: organization-defined actions] prior to executing the code.		 Control Selected NA NA
SC 18(05) Mobile code Mobile code: Allow execution only in confined environments
Allow execution of permitted mobile code only in confined virtual machine environments.		 Control Selected NA NA
SC 19 Voice over internet protocol
  1. The organization establishes usage restrictions and implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously.
  2. The organization authorizes, monitors, and controls the use of VoIP within the information system.
 Control Not selected NA NA
SC 19(400) Voice over internet protocol Voice over internet protocol: Protocol conversion
Unclassified VoIP is not permitted within classified facilities unless the VoIP is converted to plain old telephone systems (POTS) before exiting the facility boundary.		 Control Not selected NA NA
SC 19(401) Voice over internet protocol Voice over internet protocol: No public network access
Unclassified VoIP over a Local Area Network (LAN) with access to a public data network is not permitted within classified facilities.		 Control Not selected NA NA
SC 20 Secure name / address resolution service (authoritative source)
  1. Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.
  2. Provide the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.
 Control Selected NA NA
SC 20(01) Secure name / address resolution service (authoritative source) Secure name / address resolution service (authoritative source): Child subspaces
Withdrawn: Incorporated into SC-20.		 NA NA NA NA
SC 20(02) Secure name / address resolution service (authoritative source) Secure name / address resolution service (authoritative source): Data origin and integrity
Provide data origin and integrity protection artifacts for internal name/address resolution queries.		 Control Not selected NA NA
SC 21 Secure name / address resolution service (recursive or caching resolver) Request and perform data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources. Control Selected NA NA
SC 21(01) Secure name / address resolution service (recursive or caching resolver) Secure name / address resolution service (recursive or caching resolver): Data origin / integrity
Withdrawn: Incorporated into SC-21.		 NA NA NA NA
SC 22 Architecture and provisioning for name / address resolution service Ensure the systems that collectively provide name/address resolution service for an organization are fault-tolerant and implement internal and external role separation. Control Selected NA NA
SC 23 Session authenticity Protect the authenticity of communications sessions. Control Selected NA NA
SC 23(01) Session authenticity Session authenticity: Invalidate session identifiers at logout
Invalidate session identifiers upon user logout or other session termination.		 Control Selected NA NA
SC 23(02) Session authenticity Session authenticity: User-initiated logouts / message displays
Withdrawn: Incorporated into AC-12(01).		 NA NA NA NA
SC 23(03) Session authenticity Session authenticity: Unique system-generated session identifiers
Generate a unique session identifier for each session with [Assignment: organization-defined randomness requirements] and recognize only session identifiers that are system-generated.		 Control Selected NA NA
SC 23(04) Session authenticity Session authenticity: Unique session identifiers with randomization
Withdrawn: Incorporated into SC-23(03).		 NA NA NA NA
SC 23(05) Session authenticity Session authenticity: Allowed certificate authorities
Only allow the use of [Assignment: organization-defined certificate authorities] for verification of the establishment of protected sessions.		 Control Not selected NA NA
SC 24 Fail in known state Fail to a [Assignment: organization-defined known system state] for the following failures on the indicated components while preserving [Assignment: organization-defined system state information] in failure: [Assignment: list of organization-defined types of system failures on organization-defined system components]. Control Not selected NA NA
SC 25 Thin nodes Employ minimal functionality and information storage on the following system components: [Assignment: organization-defined system components]. Control Not selected NA NA
SC 26 Decoys Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks. Control Not selected NA NA
SC 26(01) Decoys Decoys: Detection of malicious code
Withdrawn: Incorporated into SC-35.		 NA NA NA NA
SC 27 Platform-independent applications Include within organizational systems the following platform independent applications: [Assignment: organization-defined platform-independent applications]. Control Not selected NA NA
SC 28 Protection of information at rest Protect the [Selection (one or more): confidentiality; integrity] of the following information at rest: [Assignment: organization-defined information at rest]. Control Selected NA NA
SC 28(01) Protection of information at rest Protection of information at rest: Cryptographic protection
Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [Assignment: organization-defined system components or media]: [Assignment: organization-defined information].		 Control Selected NA NA
SC 28(02) Protection of information at rest Protection of information at rest: Offline storage
Remove the following information from online storage and store offline in a secure location: [Assignment: organization-defined information].		 Control Not selected NA NA
SC 28(03) Protection of information at rest Protection of information at rest: Cryptographic keys
Provide protected storage for cryptographic keys [Selection (one): [Assignment: organization-defined safeguards]; hardware-protected key store].		 Control Not selected NA NA
SC 29 Heterogeneity Employ a diverse set of information technologies for the following system components in the implementation of the system: [Assignment: organization-defined system components]. Control Selected [cyber security devices and tools] In order to protect PBMM against Td4 compromise using a single unknown system flaw (a 0-Day), disaggregate the business functions between systems that do not share a single-point-of-failure. For example, host one line-of-business database in Windows, and a different line-of-business database in Linux.
SC 29(01) Heterogeneity Heterogeneity: Virtualization techniques
Employ virtualization techniques to support the deployment of a diversity of operating systems and applications that are changed [Assignment: organization-defined frequency].		 Control Not selected NA NA
SC 30 Concealment and misdirection Employ the following concealment and misdirection techniques for [Assignment: organization-defined systems] at [Assignment: organization-defined time periods] to confuse and mislead adversaries: [Assignment: organization-defined concealment and misdirection techniques]. Control Not selected NA NA
SC 30(01) Concealment and misdirection Concealment and misdirection: Virtualization techniques
Withdrawn: Incorporated into SC-29(01).		 NA NA NA NA
SC 30(02) Concealment and misdirection Concealment and misdirection: Randomness
Employ [Assignment: organization-defined techniques] to introduce randomness into organizational operations and assets.		 Control Not selected NA NA
SC 30(03) Concealment and misdirection Concealment and misdirection: Randomness
Employ [Assignment: organization-defined techniques] to introduce randomness into organizational operations and assets.		 Control Not selected NA NA
SC 30(04) Concealment and misdirection Concealment and misdirection: Misleading information
Employ realistic, but misleading information in [Assignment: organization-defined system components] about its security state or posture.		 Control Not selected NA NA
SC 30(05) Concealment and misdirection Concealment and misdirection: Concealment of system components
Employ the following techniques to hide or conceal [Assignment: organization-defined system components]: [Assignment: organization-defined techniques].		 Control Not selected NA NA
SC 31 Covert channel analysis
  1. Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert [Selection (one or more): storage; timing] channels.
  2. Estimate the maximum bandwidth of those channels.
 Control Not selected NA NA
SC 31(01) Covert channel analysis Covert channel analysis: Test covert channels for exploitability
Test a subset of the identified covert channels to determine the channels that are exploitable.		 Control Not selected NA NA
SC 31(02) Covert channel analysis Covert channel analysis: Maximum bandwidth
Reduce the maximum bandwidth for identified covert [Selection (one or more): storage; timing] channels to [Assignment: organization-defined values].		 Control Not selected NA NA
SC 31(03) Covert channel analysis Covert channel analysis: Measure bandwidth in operational environments
Measure the bandwidth of [Assignment: organization-defined subset of identified covert channels] in the operational environment of the system.		 Control Not selected NA NA
SC 32 System partitioning Partition the system into [Assignment: organization-defined system components] residing in separate [Selection (one): physical; logical] domains or environments based on [Assignment: organization-defined circumstances for physical or logical separation of components]. Control Not selected NA NA
SC 32(01) System partitioning System partitioning: Separate physical domains for privileged functions
Partition privileged functions into separate physical domains.		 Control Not selected NA NA
SC 33 Transmission preparation integrity Withdrawn: Incorporated into SC-08. NA NA NA NA
SC 34 Non-modifiable executable programs For [Assignment: organization-defined system components], load and execute:
  1. the operating environment from hardware-enforced, read-only media
  2. the following applications from hardware-enforced, read-only media: [Assignment: organization-defined applications]
 Control Not selected NA NA
SC 34(01) Non-modifiable executable programs Non-modifiable executable programs: No writable storage
Employ [Assignment: organization-defined system components] with no writeable storage that is persistent across component restart or power on/off.		 Control Not selected NA NA
SC 34(02) Non-modifiable executable programs Non-modifiable executable programs: Integrity protection and read-only media
Protect the integrity of information prior to storage on read-only media and control the media after such information has been recorded onto the media.		 Control Not selected NA NA
SC 34(03) Non-modifiable executable programs Non-modifiable executable programs: Hardware-based protection
Withdrawn: Moved to SC-51.		 NA NA NA NA
SC 35 External malicious code identification Include system components that proactively seek to identify network-based malicious code or malicious websites. Control Not selected NA NA
SC 36 Distributed processing and storage Distribute the following processing and storage components across multiple [Selection (one): physical locations; logical domains]: [Assignment: organization-defined processing and storage components]. Control Not selected NA NA
SC 36(01) Distributed processing and storage Distributed processing and storage: Polling techniques
  1. Employ polling techniques to identify potential faults, errors, or compromises to the following processing and storage components: [Assignment: organization-defined distributed processing and storage components].
  2. Take the following actions in response to identified faults, errors, or compromises: [Assignment: organization-defined actions].
 Control Not selected NA NA
SC 36(02) Distributed processing and storage Distributed processing and storage: Synchronization
Synchronize the following duplicate systems or system components: [Assignment: organization-defined duplicate systems or system components].		 Control Not selected NA NA
SC 37 Out-of-band channels Employ the following out-of-band channels for the physical delivery or electronic transmission of [Assignment: organization-defined information, system components, or devices] to [Assignment: organization-defined individuals or systems]: [Assignment: organization-defined out-of-band channels]. Control Not selected NA NA
SC 37(01) Out-of-band channels Out-of-band channels: Ensure delivery and transmission
Employ [Assignment: organization-defined controls] to ensure that only [Assignment: organization-defined individuals or systems] receive the following information, system components, or devices: [Assignment: organization-defined information, system components, or devices].		 Control Not selected NA NA
SC 38 Operations security Employ the following operations security controls to protect key organizational information throughout the system development lifecycle: [Assignment: organization-defined operations security controls]. Control Not selected NA NA
SC 39 Process isolation Maintain a separate execution domain for each executing system process. Control Selected NA NA
SC 39(01) Process isolation Process isolation: Hardware separation
Implement hardware separation mechanisms to facilitate process isolation.		 Control Not selected NA NA
SC 39(02) Process isolation Process isolation: Separate execution domain per thread
Maintain a separate execution domain for each thread in [Assignment: organization-defined multi-threaded processing].		 Control Not selected NA NA
SC 40 Wireless link protection Protect external and internal [Assignment: organization-defined wireless links] from the following signal parameter attacks: [Assignment: organization-defined types of signal parameter attacks or references to sources for such attacks]. Control Not selected NA NA
SC 40(01) Wireless link protection Wireless link protection: Electromagnetic interference
Implement cryptographic mechanisms that achieve [Assignment: organization-defined level of protection] against the effects of intentional electromagnetic interference.		 Control Not selected NA NA
SC 40(02) Wireless link protection Wireless link protection: Reduce detection potential
Implement cryptographic mechanisms to reduce the detection potential of wireless links to [Assignment: organization-defined level of reduction].		 Control Not selected NA NA
SC 40(03) Wireless link protection Wireless link protection: Imitative or manipulative communications deception
Implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.		 Control Not selected NA NA
SC 40(04) Wireless link protection Wireless link protection: Signal parameter identification
Implement cryptographic mechanisms to prevent the identification of [Assignment: organization-defined wireless transmitters] by using the transmitter signal parameters.		 Control Not selected NA NA
SC 41 Port and i/o device access [Selection (one): Physically; Logically] disable or remove [Assignment: organization-defined connection ports or input/output devices] on the following systems or system components: [Assignment: organization-defined systems or system components]. Control Not selected NA NA
SC 42 Sensor capability and data
  1. Prohibit [Selection (one or more): the use of devices possessing [Assignment: organization-defined environmental sensing capabilities] in [Assignment: organization-defined facilities, areas, or systems]; the remote activation of environmental sensing capabilities on organizational systems or system components with the following exceptions: [Assignment: organization-defined exceptions where remote activation of sensors is allowed]].
  2. Provide an explicit indication of sensor use to [Assignment: organization-defined group of users].
 Control Not selected NA NA
SC 42(01) Sensor capability and data Sensor capability and data: Reporting to authorized individuals or roles
Verify that the system is configured so that data or information collected by the [Assignment: organization-defined sensors] is only reported to authorized individuals or roles.		 Control Not selected NA NA
SC 42(02) Sensor capability and data Sensor capability and data: Authorized use
Employ the following measures so that data or information collected by [Assignment: organization-defined sensors] is only used for authorized purposes: [Assignment: organization-defined measures].		 Control Not selected NA NA
SC 42(03) Sensor capability and data Sensor capability and data: Prohibit use of devices
Withdrawn: Incorporated into SC-42.		 NA NA NA NA
SC 42(04) Sensor capability and data Sensor capability and data: Notice of collection
Employ the following measures to facilitate an individual’s awareness that personal information is being collected by [Assignment: organization-defined sensors]: [Assignment: organization-defined measures].		 Control Not selected NA NA
SC 42(05) Sensor capability and data Sensor capability and data: Collection minimization
Employ [Assignment: organization-defined sensors] that are configured to minimize the collection of information about individuals that is not needed.		 Control Not selected NA NA
SC 42(400) Sensor capability and data Sensor capability and data: Disablement in security/high security zone
Ensure that the organization disables all sensors on all devices when they are not approved to process information at the highest classification level in the security or high-security zone they are in.		 Control Not selected NA NA
SC 43 Usage restrictions
  1. Establish usage restrictions and implementation guidelines for the following system components: [Assignment: organization-defined system components].
  2. Authorize, monitor, and control the use of such components within the system.
 Control Not selected NA NA
SC 44 Detonation chambers Employ a detonation chamber capability within [Assignment: organization-defined system, system component, or location]. Control Not selected NA NA
SC 45 System time synchronization Synchronize system clocks within and between systems and system components. Control Selected NA NA
SC 45(01) System time synchronization System time synchronization: Synchronization with authoritative time source
  1. Compare the internal system clocks [Assignment: organization-defined frequency] with [Assignment: organization-defined authoritative time source].
  2. Synchronize the internal system clocks to the authoritative time source when the time difference is greater than [Assignment: organization-defined time period].
 Control Not selected NA NA
SC 45(02) System time synchronization System time synchronization: Secondary authoritative time source
  1. Identify a secondary authoritative time source that is in a different geographic region than the primary authoritative time source.
  2. Synchronize the internal system clocks to the secondary authoritative time source if the primary authoritative time source is unavailable.
 Control Not selected NA NA
SC 46 Cross domain policy enforcement Implement a policy enforcement mechanism [Selection (one): physically; logically] between the physical and/or network interfaces for the connecting security domains. Control Not selected NA NA
SC 46(400) Cross domain policy enforcement Cross domain policy enforcement: Manual data transfer
Limit the use of manual data transfer.		 Control Not selected NA NA
SC 47 Alternate communications paths Establish [Assignment: organization-defined alternate communications paths] for system operations organizational command and control. Control Not selected NA NA
SC 48 Sensor relocation Relocate [Assignment: organization-defined sensors and monitoring capabilities] to [Assignment: organization-defined locations] under the following conditions or circumstances: [Assignment: organization-defined conditions or circumstances]. Control Not selected NA NA
SC 48(01) Sensor relocation Sensor relocation: Dynamic relocation of sensors or monitoring capabilities
Dynamically relocate [Assignment: organization-defined sensors and monitoring capabilities] to [Assignment: organization-defined locations] under the following conditions or circumstances: [Assignment: organization-defined conditions or circumstances].		 Control Not selected NA NA
SC 49 Hardware-enforced separation and policy enforcement Implement hardware-enforced separation and policy enforcement mechanisms between [Assignment: organization-defined security domains]. Control Not selected NA NA
SC 50 Software-enforced separation and policy enforcement Implement software-enforced separation and policy enforcement mechanisms between [Assignment: organization-defined security domains]. Control Not selected NA NA
SC 51 Hardware-based protection
  1. Employ hardware-based write-protect for [Assignment: organization-defined system firmware components].
  2. Implement specific procedures for [Assignment: organization-defined authorized individuals] to manually disable hardware write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.
 Control Not selected NA NA
SC 400 Entity source authentication The information system allows a message recipient to verify the claimed source identifier in a message. Control Not selected NA NA
SC 400(01) Entity source authentication Entity source authentication: Claimed identifier authentication
Authentication of the claimed identifier in the message is cryptographically based.		 Control Not selected NA NA
SC 400(02) Entity source authentication Entity source authentication: Digital signature
The organization employs Cryptographic Module Validation Program (CMVP)-certified cryptography for digital signature generation and verification.		 Control Not selected NA NA
SC 400(03) Entity source authentication Entity source authentication: Authentication implementation
The organization employs Cyber Centre-approved cryptography and protocols to implement the authentication.		 Control Not selected NA NA
SC 401 Unclassified telecommunications systems in secure facilities
  1. Unclassified telecommunications systems in secure facilities must not pass/transmit sensitive audio discussions when they are idle and not in use. Additionally, these telecommunications systems must be configured to prevent external control or activation. The concepts of on-hook audio protection outlined in CNSSI 5002 and 5006 must be incorporated into secure facilities’ telecommunications systems.
  2. Unclassified telephone systems and services must be configured to prevent technical exploitation or penetration. In addition, these systems must incorporate physical and software access controls to prevent disclosure or manipulation of system programming and stored data.
  3. The organization must ensure that the following specific requirements are applied to unclassified telecommunications systems:
    1. Provide on-hook audio protection by the use of CNSSI 5006 equipment, CNSSI 5006-approved disconnect devices, or equivalent CNSSI 5002 system configuration
    2. Provide isolation by using a computerized telephone system (CTS) with control of software and hardware configuration control and of audit reports (such as station message detail reporting, call detail reporting, etc.). System programming will not include the ability to place, or keep, a handset off-hook. Configuration of the system must ensure that all on-hook and off-hook vulnerabilities are identified and mitigated
    3. Ensure that equipment used for the administration of telephone systems is installed inside an area where access is limited to authorized personnel. When local administration terminals (for a CTS) are not or cannot be contained within the controlled area or safeguarded against unauthorized manipulation, then the use of CNSSI 5006-approved telephone equipment must be required, regardless of the CTS configuration
    4. Ensure that remote maintenance is not used outside the secure facility
    5. Ensure that speakerphones and audio-conferencing systems are not used on unclassified telecommunications systems in secure facilities. CSE may approve exceptions to this requirement when these systems have sufficient audio isolation from other classified discussion areas in the secure facility, and when there are established procedures to prevent inadvertent transmission of classified information
    6. Ensure that features used for voicemail or unified messaging services are configured to prevent unauthorized access to remote diagnostic ports or internal dial tone
    7. Ensure that telephone answering devices (TAD) and facsimile machines do not contain features that introduce security vulnerabilities, for example, remote room monitoring, remote programming, or other similar features that may permit off-premises access to room audio. Prior CSE approval is required before installation or use.
  4. All unclassified telecommunications systems and associated infrastructure must be electrically and physically isolated from any classified information/telecommunications systems in accordance with CNSS requirements or any other separation standards applied to the classified information system on site.
  5. The security requirements and installation guidelines contained in the CNSSI 5000 shall be followed for VoIP systems installed in any physical security zone processing classified information.
 Control Not selected NA NA
 
Top of page 
 
Table 4.19: System and information integrity
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
SI 01 System and information integrity policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] system and information integrity policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the system and information integrity policy and the associated system and information integrity controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the system and information integrity policy and procedures.
  3. Review and update the current system and information integrity:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
SI 02 Flaw remediation
  1. Identify, report, and correct system flaws.
  2. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation.
  3. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates.
  4. Incorporate flaw remediation into the organizational configuration management process.
 Control Selected NA NA
SI 02(01) Flaw remediation Flaw remediation: Central management
Withdrawn: Incorporated into PL-09.		 NA NA NA NA
SI 02(02) Flaw remediation Flaw remediation: Automated flaw remediation status
Determine if system components have applicable security-relevant software and firmware updates installed using [Assignment: organization-defined automated mechanisms] [Assignment: organization-defined frequency].		 Control Selected NA NA
SI 02(03) Flaw remediation Flaw remediation: Time to remediate flaws and benchmarks for corrective actions
  1. Measure the time between flaw identification and flaw remediation.
  2. Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined benchmarks].
 Control Not selected NA NA
SI 02(04) Flaw remediation Flaw remediation: Automated patch management tools
Withdrawn: Incorporated into SI-02.		 NA NA NA NA
SI 02(05) Flaw remediation Flaw remediation: Automatic software and firmware updates
Install [Assignment: organization-defined security-relevant software and firmware updates] automatically to [Assignment: organization-defined system components].		 Control Not selected NA NA
SI 02(06) Flaw remediation Flaw remediation: Removal of previous versions of software and firmware
Remove previous versions of [Assignment: organization-defined software and firmware components] after updated versions have been installed.		 Control Not selected NA NA
SI 03 Malicious code protection
  1. Implement [Selection (one or more): signature based; non-signature based] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code;
  2. Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures;
  3. Configure malicious code protection mechanisms to:
    1. Perform periodic scans of the system [Assignment: organization-defined frequency] and real-time scans of files from external sources at [Selection (one or more): endpoint; network entry and exit points] as the files are downloaded, opened, or executed in accordance with organizational policy; and
    2. [Selection (one or more): block malicious code; quarantine malicious code; take [Assignment: organization-defined action]]; and send alert to [Assignment: organization-defined personnel or roles] in response to malicious code detection; and
  4. Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the system.
 Control Selected C. 1) frequency [at least every 30 days]
C. 2) selection [quarantine malicious code]		 NA
SI 03(01) Malicious code protection Malicious code protection: Central management
Withdrawn: Incorporated into PL-09.		 NA NA NA NA
SI 03(02) Malicious code protection Malicious code protection: Automatic updates
Withdrawn: Incorporated into SI-03.		 NA NA NA NA
SI 03(03) Malicious code protection Malicious code protection: Non-privileged users
Withdrawn: Incorporated into AC-06(10).		 NA NA NA NA
SI 03(04) Malicious code protection Malicious code protection: Updates only by privileged users
Update malicious code protection mechanisms only when directed by a privileged user.		 Control Selected NA NA
SI 03(05) Malicious code protection Malicious code protection: Portable storage devices
Withdrawn: Incorporated into MP-07.		 NA NA NA NA
SI 03(06) Malicious code protection Malicious code protection: Testing and verification
  1. Test malicious code protection mechanisms [Assignment: organization-defined frequency] by introducing known benign code into the system.
  2. Verify that the detection of the code and the associated incident reporting occur.
 Control Not selected NA NA
SI 03(07) Malicious code protection Malicious code protection: Non-signature-based detection
Withdrawn: Incorporated into SI-03.		 NA NA NA NA
SI 03(08) Malicious code protection Malicious code protection: Detect unauthorized commands
  1. Detect the following unauthorized operating system commands through the kernel application programming interface on [Assignment: organization-defined system hardware components]: [Assignment: organization-defined unauthorized operating system commands].
  2. [Selection (one or more): issue a warning; audit the command execution; prevent the execution of the command].
 Control Not selected NA NA
SI 03(09) Malicious code protection Malicious code protection: Authenticate remote commands
Withdrawn: Moved to AC-17(10).		 NA NA NA NA
SI 03(10) Malicious code protection Malicious code protection: Malicious code analysis
  1. Employ the following tools and techniques to analyze the characteristics and behaviour of malicious code: [Assignment: organization-defined tools and techniques].
  2. Incorporate the results from malicious code analysis into organizational incident response and flaw remediation processes.
 Control Not selected NA NA
SI 04 System monitoring
  1. Monitor the system to detect:
    1. attacks and indicators of potential attacks in accordance with the following monitoring objectives: [Assignment: organization-defined monitoring objectives]
    2. unauthorized local, network, and remote connections
  2. Identify unauthorized use of the system through the following techniques and methods: [Assignment: organization-defined techniques and methods].
  3. Invoke internal monitoring capabilities or deploy monitoring devices:
    1. strategically within the system to collect organization-determined essential information
    2. at ad hoc locations within the system to track specific types of transactions of interest to the organization
  4. Analyze detected events and anomalies.
  5. Adjust the level of system monitoring activity when there is a change in risk to organizational operations and assets, individuals, other organizations, or Canada.
  6. Obtain legal opinion regarding system monitoring activities.
  7. Provide [Assignment: organization-defined system monitoring information] to [Assignment: organization-defined personnel or roles] [Selection (one or more): as needed; [Assignment: organization-defined frequency]].
 Control Selected NA NA
SI 04(01) System monitoring System monitoring: System-wide intrusion detection system
Connect and configure individual intrusion detection tools into a system-wide intrusion detection system.		 Control Not selected NA NA
SI 04(02) System monitoring System monitoring: Automated tools and mechanisms for real-time analysis
Employ automated tools and mechanisms to support near real-time analysis of events.		 Control Selected NA NA
SI 04(03) System monitoring System monitoring: Automated tool and mechanism integration
Employ automated tools and mechanisms to integrate intrusion detection tools and mechanisms into access control and flow control mechanisms.		 Control Not selected NA NA
SI 04(04) System monitoring System monitoring: Inbound and outbound communications traffic
  1. Determine criteria for unusual or unauthorized activities or conditions for inbound and outbound communications traffic.
  2. Monitor inbound and outbound communications traffic [Assignment: organization-defined frequency] for [Assignment: organization-defined unusual or unauthorized activities or conditions].
 Control Selected NA NA
SI 04(05) System monitoring System monitoring: System-generated alerts
Alert [Assignment: organization-defined personnel or roles] when the following system-generated indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].		 Control Selected NA NA
SI 04(06) System monitoring System monitoring: Restrict non-privileged users
Withdrawn: Incorporated into AC-06(10).		 NA NA NA NA
SI 04(07) System monitoring System monitoring: Automated response to suspicious events
  1. Notify [Assignment: organization-defined incident response personnel (identified by name and/or by role)] of detected suspicious events.
  2. Take the following actions upon detection: [Assignment: organization-defined least-disruptive actions to terminate suspicious events].
 Control Not selected NA NA
SI 04(08) System monitoring System monitoring: Protection of monitoring information
Withdrawn: Incorporated into SI-04.		 NA NA NA NA
SI 04(09) System monitoring System monitoring: Testing of monitoring tools and mechanisms
Test intrusion-monitoring tools and mechanisms [Assignment: organization-defined frequency].		 Control Not selected NA NA
SI 04(10) System monitoring System monitoring: Visibility of encrypted communications
Make provisions so that [Assignment: organization-defined encrypted communications traffic] is visible to [Assignment: organization-defined system monitoring tools and mechanisms].		 Control Selected NA NA
SI 04(11) System monitoring System monitoring: Analyze communications traffic anomalies
Analyze outbound communications traffic at the external interfaces to the system and selected [Assignment: organization-defined interior points within the system] to discover anomalies.		 Control Selected NA NA
SI 04(12) System monitoring Information system monitoring: Automated organization-generated alerts
Alert [Assignment: organization-defined personnel or roles] using [Assignment: organization-defined automated mechanisms] when the following indications of inappropriate or unusual activities with security or privacy implications occur: [Assignment: organization-defined activities that trigger alerts].		 Control Selected NA NA
SI 04(13) System monitoring System monitoring: Analyze traffic and event patterns
  1. Analyze communications traffic and event patterns for the system.
  2. Develop profiles representing common traffic and event patterns.
  3. Use the traffic and event profiles in tuning system-monitoring devices.
 Control Selected NA NA
SI 04(14) System monitoring System monitoring: Wireless intrusion detection
Employ a wireless intrusion detection system (WIDS) to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.		 Control Selected NA NA
SI 04(15) System monitoring System monitoring: Wireless to wireline communications
Employ an intrusion detection system to monitor wireless communications traffic as the traffic passes from wireless to wireline networks.		 Control Selected NA NA
SI 04(16) System monitoring System monitoring: Correlate monitoring information
Correlate information from monitoring tools and mechanisms employed throughout the system.		 Control Not selected NA NA
SI 04(17) System monitoring System monitoring: Integrated situational awareness
Correlate information from monitoring physical, cyber, and supply chain activities to achieve integrated, organization-wide situational awareness.		 Control Not selected NA NA
SI 04(18) System monitoring System monitoring: Analyze traffic and covert exfiltration
Analyze outbound communications traffic at external interfaces to the system and at the following interior points to detect covert exfiltration of information: [Assignment: organization-defined interior points within the system].		 Control Not selected NA NA
SI 04(19) System monitoring System monitoring: Risk for individuals
Implement [Assignment: organization-defined additional monitoring] of individuals who have been identified by [Assignment: organization-defined sources] as posing an increased level of risk.		 Control Not selected NA NA
SI 04(20) System monitoring System monitoring: Privileged user
Implement the following additional monitoring of privileged users: [Assignment: organization-defined additional monitoring].		 Control Not selected NA NA
SI 04(21) System monitoring System monitoring: Probationary periods
Implement the following additional monitoring of individuals during [Assignment: organization-defined probationary period]: [Assignment: organization-defined additional monitoring].		 Control Not selected NA NA
SI 04(22) System monitoring System monitoring: Unauthorized network services
  1. Detect network services that have not been authorized or approved by [Assignment: organization-defined authorization or approval processes].
  2. [Selection (one or more): Audit; Alert [Assignment: organization-defined personnel or roles]] when detected.
 Control Not selected NA NA
SI 04(23) System monitoring System monitoring: Host-based devices
Implement the following host-based monitoring mechanisms at [Assignment: organization-defined system components]: [Assignment: organization-defined host-based monitoring mechanisms].		 Control Not selected NA NA
SI 04(24) System monitoring System monitoring: Indicators of compromise
Discover, collect, and distribute to [Assignment: organization-defined personnel or roles], indicators of compromise (IOCs) provided by [Assignment: organization-defined sources].		 Control Not selected NA NA
SI 04(25) System monitoring System monitoring: Optimize network traffic analysis
Provide visibility into network traffic at external and key internal system interfaces to optimize the effectiveness of monitoring devices.		 Control Not selected NA NA
SI 05 Security alerts, advisories, and directives
  1. Receive system security alerts, advisories, and directives from [Assignment: organization-defined external organizations] on an ongoing basis.
  2. Generate internal security alerts, advisories, and directives as necessary.
  3. Disseminate security alerts, advisories, and directives to: [Selection (one or more): [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined elements within the organization]; [Assignment: organization-defined external organizations]].
  4. Implement security directives in accordance with established timeframes or notify the issuing organization of the degree of non-compliance.
 Control Selected NA NA
SI 05(01) Security alerts, advisories, and directives Security alerts, advisories, and directives: Automated alerts and advisories
Broadcast security alert and advisory information throughout the organization using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
SI 06 Security and privacy function verification
  1. Verify the correct operation of [Assignment: organization-defined security and privacy functions].
  2. Perform the verification of the functions specified in SI-06A [Selection (one or more): [Assignment: organization-defined system transitional states]; upon command by user with appropriate privilege; [Assignment: organization-defined frequency]].
  3. Alert [Assignment: organization-defined personnel or roles] to failed security and privacy verification tests.
  4. [Selection (one or more): Shut the system down; Restart the system; [Assignment: organization-defined alternative action(s)]] when anomalies are discovered.
 Control Not selected NA NA
SI 06(01) Security and privacy function verification Security and privacy function verification: Notification of failed security tests
Withdrawn: Incorporated into SI-06.		 NA NA NA NA
SI 06(02) Security and privacy function verification Security and privacy function verification: Automation support for distributed testing
Implement automated mechanisms to support the management of distributed security and privacy function testing.		 Control Not selected NA NA
SI 06(03) Security and privacy function verification Security and privacy function verification: Report verification results
Report the results of security and privacy function verification to [Assignment: organization-defined personnel or roles].		 Control Not selected NA NA
SI 07 Software, firmware, and information integrity
  1. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignment: organization-defined software, firmware, and information].
  2. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignment: organization-defined actions].
 Control Selected NA NA
SI 07(01) Software, firmware, and information integrity Software, firmware, and information integrity: Integrity checks
Perform an integrity check of [Assignment: organization-defined software, firmware, and information] [Selection (one or more): at startup; at [Assignment: organization-defined transitional states or security-relevant events]; [Assignment: organization-defined frequency]].		 Control Selected [4] [frequency at no longer than 30 days] NA
SI 07(02) Software, firmware, and information integrity Software, firmware, and information integrity: Automated notifications of integrity violations
Employ automated tools that provide notification to [Assignment: organization-defined personnel or roles] upon discovering discrepancies during integrity verification.		 Control Selected NA NA
SI 07(03) Software, firmware, and information integrity Software, firmware, and information integrity: Centrally managed integrity tools
Employ centrally managed integrity verification tools.		 Control Selected NA NA
SI 07(04) Software, firmware, and information integrity Software, firmware, and information integrity: Tamper-evident packaging
Withdrawn: Incorporated into SA-12.		 NA NA NA NA
SI 07(05) Software, firmware, and information integrity Software, firmware, and information integrity: Automated response to integrity violations
Automatically [Selection (one or more): shut the system down; restart the system; implement [Assignment: organization-defined controls]] when integrity violations are discovered.		 Control Not selected NA NA
SI 07(06) Software, firmware, and information integrity Software, firmware, and information integrity: Cryptographic protection
Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.		 Control Not selected NA NA
SI 07(07) Software, firmware, and information integrity Software, firmware, and information integrity: Integration of detection and response
Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignment: organization-defined security-relevant changes to the system].		 Control Selected NA NA
SI 07(08) Software, firmware, and information integrity Software, firmware, and information integrity: Auditing capability for significant events
Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection (one or more): generate an audit record; alert current user; alert [Assignment: organization-defined personnel or roles]; [Assignment: organization-defined other actions]].		 Control Not selected NA NA
SI 07(09) Software, firmware, and information integrity Software, firmware, and information integrity: Verify boot process
Verify the integrity of the boot process of the following system components: [Assignment: organization-defined system components].		 Control Not selected NA NA
SI 07(10) Software, firmware, and information integrity Software, firmware, and information integrity: Protection of boot firmware
Implement the following mechanisms to protect the integrity of boot firmware in [Assignment: organization-defined system components]: [Assignment: organization-defined mechanisms].		 Control Not selected NA NA
SI 07(11) Software, firmware, and information integrity Software, firmware, and information integrity: Confined environments with limited privileges
Withdrawn: Moved to CM-07(06).		 NA NA NA NA
SI 07(12) Software, firmware, and information integrity Software, firmware, and information integrity: Integrity verification
Require that the integrity of the following software be verified prior to execution: [Assignment: organization-defined software].		 Control Not selected NA NA
SI 07(13) Software, firmware, and information integrity Software, firmware, and information integrity: Code execution in protected environments
Withdrawn: Moved to CM-07(07).		 NA NA NA NA
SI 07(14) Software, firmware, and information integrity Software, firmware, and information integrity: Binary or machine executable code
Withdrawn: Moved to CM-07(08).		 NA NA NA NA
SI 07(15) Software, firmware, and information integrity Software, firmware, and information integrity: Code authentication
Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignment: organization-defined software or firmware components].		 Control Not selected NA NA
SI 07(16) Software, firmware, and information integrity Software, firmware, and information integrity: Time limit on process execution without supervision
Prohibit processes from executing without supervision for more than [Assignment: organization-defined time period].		 Control Not selected NA NA
SI 07(17) Software, firmware, and information integrity Software, firmware, and information integrity: Run-time application self-protection
Implement [Assignment: organization-defined controls] for application self-protection at runtime.		 Control Not selected NA NA
SI 08 Spam protection
  1. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages.
  2. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.
 Control Selected NA NA
SI 08(01) Spam protection Spam protection: Central management
Withdrawn: Incorporated into PL-09.		 NA NA NA NA
SI 08(02) Spam protection Spam protection: Automatic updates
Automatically update spam protection mechanisms [Assignment: organization-defined frequency].		 Control Selected NA NA
SI 08(03) Spam protection Spam protection: Continuous learning capability
Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.		 Control Not selected NA NA
SI 09 Information input restrictions Withdrawn: Incorporated into AC-02, AC-03, AC-05, and AC-06. NA NA NA NA
SI 10 Information input validation Check the validity of the following information inputs: [Assignment: organization-defined information inputs to the system]. Control Selected NA NA
SI 10(01) Information input validation Information input validation: Manual override capability
  1. Provide a manual override capability for input validation of the following information inputs: [Assignment: organization-defined inputs defined in the base control (SI-10)].
  2. Restrict the use of the manual override capability to only [Assignment: organization-defined authorized individuals].
  3. Audit the use of the manual override capability.
 Control Not selected NA NA
SI 10(02) Information input validation Information input validation: Review and resolve of errors
Review and resolve input validation errors within [Assignment: organization-defined time period].		 Control Not selected NA NA
SI 10(03) Information input validation Information input validation: Predictable behaviour
Verify that the system behaves in a predictable and documented manner when invalid inputs are received.		 Control Not selected NA NA
SI 10(04) Information input validation Information input validation: Timing interactions
Account for timing interactions among system components in determining appropriate responses for invalid inputs.		 Control Not selected NA NA
SI 10(05) Information input validation Information input validation: Restrict inputs to trusted sources and approved formats
Restrict the use of information inputs to [Assignment: organization-defined trusted sources] and/or [Assignment: organization-defined formats].		 Control Not selected NA NA
SI 10(06) Information input validation Information input validation: Injection prevention
Prevent untrusted data injections.		 Control Not selected NA NA
SI 11 Error handling
  1. Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited.
  2. Reveal error messages only to [Assignment: organization-defined personnel or roles].
 Control Selected NA NA
SI 12 Information management and retention Manage and retain information within the system and information output from the system in accordance with applicable laws, Orders in Council, directives, regulations, policies, standards, guidelines and operational requirements. Control Selected NA NA
SI 12(01) Information management and retention Information management and retention: Limit personal information elements
Limit personal information being processed in the information lifecycle to the following elements of personal information: [Assignment: organization-defined elements of personal information].		 Control Not selected NA NA
SI 12(02) Information management and retention Information management and retention: Minimize personal information in testing, training, and research
Use the following techniques to minimize the use of personal information for research, testing, or training: [Assignment: organization-defined techniques].		 Control Not selected NA NA
SI 12(03) Information management and retention Information management and retention: Information disposal
Use the following techniques to dispose of, destroy, or erase information following the retention period: [Assignment: organization-defined techniques].		 Control Not selected NA NA
SI 13 Predictable failure prevention
  1. Determine mean time to failure (MTTF) for the following system components in specific environments of operation: [Assignment: organization-defined system components].
  2. Provide substitute system components and a means to exchange active and standby components in accordance with the following criteria: [Assignment: organization-defined MTTF substitution criteria].
 Control Not selected NA NA
SI 13(01) Predictable failure prevention Predictable failure prevention: Transferring component responsibilities
Take system components out of service by transferring component responsibilities to substitute components no later than [Assignment: organization-defined fraction or percentage] of mean time to failure.		 Control Not selected NA NA
SI 13(02) Predictable failure prevention Predictable failure prevention: Time limit on process execution without supervision
Withdrawn: Incorporated into SI-07(16).		 NA NA NA NA
SI 13(03) Predictable failure prevention Predictable failure prevention: Manual transfer between components
Manually initiate transfers between active and standby system components when the use of the active component reaches [Assignment: organization-defined percentage] of the mean time to failure.		 Control Not selected NA NA
SI 13(04) Predictable failure prevention Predictable failure prevention: Standby component installation and notification
If system component failures are detected:
  1. ensure that the standby components are successfully and transparently installed within [Assignment: organization-defined time period]
  2. [Selection (one or more): Activate [Assignment: organization-defined alarm]; Automatically shut down the system; [Assignment: organization-defined action]]
 Control Not selected NA NA
SI 13(05) Predictable failure prevention Predictable failure prevention: Failover capability
Provide [Selection (one): real-time; near real-time] [Assignment: organization-defined failover capability] for the system.		 Control Not selected NA NA
SI 14 Non-persistence Implement non-persistent [Assignment: organization-defined system components and services] that are initiated in a known state and terminated [Selection (one or more): upon end of session of use; periodically at [Assignment: organization-defined frequency]]. Control Not selected NA NA
SI 14(01) Non-persistence Non-persistence: Refresh from trusted sources
Obtain software and data employed during system component and service refreshes from the following trusted sources: [Assignment: organization-defined trusted sources].		 Control Not selected NA NA
SI 14(02) Non-persistence Non-persistence: Non-persistent information
  1. [Selection (one): Refresh [Assignment: organization-defined information] [Assignment: organization-defined frequency]; Generate [Assignment: organization-defined information] on demand].
  2. Delete information when no longer needed.
 Control Not selected NA NA
SI 14(03) Non-persistence Non-persistence: Non-persistent connectivity
Establish connections to the system on demand and terminate connections after [Selection (one): completion of a request; a period of non-use].		 Control Not selected NA NA
SI 15 Information output filtering Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [Assignment: organization-defined software programs and/or applications]. Control Not selected NA NA
SI 16 Memory protection Implement the following controls to protect the system memory from unauthorized code execution: [Assignment: organization-defined controls]. Control Selected NA NA
SI 17 Fail-safe procedures Implement the indicated fail-safe procedures when the indicated failures occur: [Assignment: organization-defined list of failure conditions and associated fail-safe procedures]. Control Not selected NA NA
SI 18 Personal information quality operations
  1. Ensure the accuracy, relevance, timeliness, and completeness of personal information used for an administrative purpose by the organization across the information lifecycle [Assignment: organization-defined frequency].
  2. Correct or delete inaccurate or outdated personal information.
 Control Not selected NA NA
SI 18(01) Personal information quality operations Personal information quality operations: Automation support
Correct or delete personal information that is inaccurate or outdated, incorrectly determined regarding impact, or incorrectly de-identified using [Assignment: organization-defined automated mechanisms].		 Control Not selected NA NA
SI 18(02) Personal information quality operations Personal information quality operations: Data tags
Employ data tags to automate the correction or deletion of personal information across the information lifecycle within organizational systems.		 Control Not selected NA NA
SI 18(03) Personal information quality operations Personal information quality operations: Collection
Collect personal information directly from the individual.		 Control Not selected NA NA
SI 18(04) Personal information quality operations Personal information quality operations: Individual requests
Correct or delete personal information upon request by individuals or their designated representatives.		 Control Not selected NA NA
SI 18(05) Personal information quality operations Personal information quality operations: Notice of correction or deletion
Notify [Assignment: organization-defined recipients of personal information] and individuals that the personal information has been corrected or deleted.		 Control Not selected NA NA
SI 19 De-identification
  1. Remove the following elements of personal information from datasets: [Assignment: organization-defined elements of personal information].
  2. Evaluate [Assignment: organization-defined frequency] for effectiveness of de-identification.
  1. Consider the privacy injury if information that may be available in the public enables re-identification of individuals.
 Control Not selected NA NA
SI 19(01) De-identification De-identification: Collection
De-identify the dataset upon collection by not collecting personal information.		 Control Not selected NA NA
SI 19(02) De-identification De-identification: Archiving
Prohibit archiving of personal information elements if those elements in a dataset will not be needed after the dataset is archived.		 Control Not selected NA NA
SI 19(03) De-identification De-identification: Release
Remove personal information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.		 Control Not selected NA NA
SI 19(04) De-identification De-identification: Removal, masking, encryption, hashing, or replacement of direct identifiers
Remove, mask, encrypt, hash, or replace direct identifiers in a dataset.		 Control Not selected NA NA
SI 19(05) De-identification De-identification: Statistical disclosure control
Manipulate numerical data, contingency tables, and statistical findings so that no individual or organization is identifiable in the results of the analysis.		 Control Not selected NA NA
SI 19(06) De-identification De-identification: Differential privacy
Prevent disclosure of personal information by adding non-deterministic noise to the results of mathematical operations before the results are reported.		 Control Not selected NA NA
SI 19(07) De-identification De-identification: Validated algorithms and software
Perform de-identification using validated algorithms and software that is validated to implement the algorithms.		 Control Not selected NA NA
SI 19(08) De-identification De-identification: Motivated intruder
Perform a motivated intruder test on the de-identified dataset to determine if the identified data remains or if the de-identified data can be re-identified.		 Control Not selected NA NA
SI 20 Tainting Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization: [Assignment: organization-defined systems or system components]. Control Not selected NA NA
SI 21 Information refresh Refresh [Assignment: organization-defined information] at [Assignment: organization-defined frequencies] or generate the information on demand and delete the information when no longer needed. Control Not selected NA NA
SI 22 Information diversity
  1. Identify the following alternative sources of information for [Assignment: organization-defined essential functions and services]: [Assignment: organization-defined alternative information sources].
  2. Use an alternative information source for the execution of essential functions or services on [Assignment: organization-defined systems or system components] when the primary source of information is corrupted or unavailable.
 Control Not selected NA NA
SI 23 Information fragmentation Based on [Assignment: organization-defined circumstances]:
  1. fragment the following information: [Assignment: organization-defined information]
  2. distribute the fragmented information across the following systems or system components: [Assignment: organization-defined systems or system components]
 Control Not selected NA NA
SI 400 Dedicated administration workstation Require any administrative or superuser actions to be performed from a physical workstation which is dedicated to those specific tasks and isolated from all other functions and networks, and especially from any form of internet access. Control Selected NA NA
SI 400(01) Dedicated administration workstation Dedicated administration workstation: Thin client dedicated administration workstation
Implement virtualized DAW inside network-isolated physical thin client DAW.		 Control Not selected NA NA
SI 400(02) Dedicated administration workstation Dedicated administration workstation: VPN on carrier private network
Connect a DAW to a target network using carrier private networks (for example, virtual private LAN service (VPLS) or multiprotocol label switching (MPLS)) with VPN encryption.		 Control Not selected NA NA
SI 400(03) Dedicated administration workstation Dedicated administration workstation: Local area network
Connect a DAW to a target network using only LAN.		 Control Not selected NA NA
SI 400(04) Dedicated administration workstation Dedicated administration workstation: Console access only
Connect a DAW to the target system using only direct console ports.		 Control Not selected NA NA
SI 400(05) Dedicated administration workstation Dedicated administration workstation: Dedicated physical workstation
Use a single-purpose physical workstation as the DAW.		 Control Not selected NA NA
SI 400(06) Dedicated administration workstation Dedicated administration workstation: Heterogeneous administrative access
Use a different operating system for the DAW relative to the target system.		 Control Not selected NA NA
 
Top of page 
 
Table 4.20: Supply chain risk management
Family ID Name Description Control/
Activity		 Suggested for this profile Suggested placeholder values Profile-specific notes
SR 01 Supply chain risk management policy and procedures
  1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
    1. [Selection (one or more): Organization-level; Mission/business process-level; System-level] supply chain risk management (SCRM) policy that:
      1. addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
      2. is consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines
    2. procedures to facilitate the implementation of the SCRM policy and the associated SCRM controls
  2. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the SCRM policy and procedures.
  3. Review and update the current SCRM:
    1. policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
    2. procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
 Activity Selected NA NA
SR 02 Supply chain risk management plan
  1. Develop a plan for managing supply chain risks associated with the research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal of the following systems, system components or system services: [Assignment: organization-defined systems, system components, or system services].
  2. Review and update the SCRM plan [Assignment: organization-defined frequency] or as required, to address threat, organizational or environmental changes.
  3. Protect the SCRM plan from unauthorized disclosure and modification.
 Activity Selected NA NA
SR 02(01) Supply chain risk management plan Supply chain risk management plan: Establish a SCRM team
Establish a SCRM team consisting of [Assignment: organization-defined personnel, roles, and responsibilities] to lead and support the following SCRM activities: [Assignment: organization-defined supply chain risk management activities].		 Activity Selected NA NA
SR 03 Supply chain controls and processes
  1. Establish a process or processes to identify and address weaknesses or deficiencies in the supply chain elements and processes of [Assignment: organization-defined system or system component] in coordination with [Assignment: organization-defined supply chain personnel].
  2. Employ the following controls to protect against supply chain risks to the system, system component, or system service and to limit the harm or consequences from supply chain-related events: [Assignment: organization-defined supply chain controls].
  3. Document the selected and implemented supply chain processes and controls in [Selection (one): security and privacy plans; SCRM plan; [Assignment: organization-defined document]].
 Control Selected NA NA
SR 03(01) Supply chain controls and processes Supply chain controls and processes: Diverse supply base
Employ a diverse set of sources for the following system components and services: [Assignment: organization-defined system components and services].		 Control Not selected NA NA
SR 03(02) Supply chain controls and processes Supply chain controls and processes: Limitation of harm
Employ the following controls to limit harm from potential adversaries identifying and targeting the organizational supply chain: [Assignment: organization-defined controls].		 Control Not selected NA NA
SR 03(03) Supply chain controls and processes Supply chain controls and processes: Sub-tier flow down
Ensure that the controls included in the contracts of prime contractors are also included in the contracts of subcontractors.		 Control Not selected NA NA
SR 04 Provenance Document, monitor, and maintain valid provenance of the following systems, system components, and associated data: [Assignment: organization-defined systems, system components, and associated data]. Control Not selected NA NA
SR 04(01) Provenance Provenance: Identity
Establish and maintain unique identification of the following supply chain elements, processes, and personnel associated with the identified system and critical system components: [Assignment: organization-defined supply chain elements, processes, and personnel associated with organization-defined systems and critical system components].		 Control Not selected NA NA
SR 04(02) Provenance Provenance: Track and trace
Establish and maintain unique identification of the following systems and critical system components for tracking through the supply chain: [Assignment: organization-defined systems and critical system components].		 Control Not selected NA NA
SR 04(03) Provenance Provenance: Validate as genuine and not altered
Employ the following controls to validate that the system or system component received is genuine and has not been altered: [Assignment: organization-defined controls].		 Control Not selected NA NA
SR 04(04) Provenance Provenance: Supply chain integrity - pedigree
Employ [Assignment: organization-defined controls] and conduct [Assignment: organization-defined analysis] to ensure the integrity of the system and system components by validating the internal composition and provenance of critical or mission-essential technologies, products, and services.		 Control Not selected NA NA
SR 05 Acquisition strategies, tools and methods Employ the following acquisition strategies, contract tools, and procurement methods to protect against, identify, and mitigate supply chain risks: [Assignment: organization-defined acquisition strategies, contract tools, and procurement methods]. Control Selected NA NA
SR 05(01) Acquisition strategies, tools and methods Acquisition strategies, tools and methods: Adequate supply
Employ the following controls to ensure an adequate supply of [Assignment: organization-defined critical system components]: [Assignment: organization-defined controls].		 Control Not selected NA NA
SR 05(02) Acquisition strategies, tools and methods Acquisition strategies, tools and methods: Assessments prior to selection, acceptance, modification, or update
Assess the system, system component, or system service prior to selection, acceptance, modification, or update.		 Control Not selected NA NA
SR 06 Supplier assessments and reviews Assess and review the supply chain-related risks associated with suppliers or contractors and the system, system component, or system service they provide [Assignment: organization-defined frequency]. Control Selected NA NA
SR 06(01) Supplier assessments and reviews Supplier assessments and reviews: Testing and analysis
Employ [Selection (one or more): organizational analysis; independent third-party analysis; organizational testing; independent third-party testing] of the following supply chain elements, processes, and actors associated with the system, system component, or system service: [Assignment: organization-defined supply chain elements, processes, and actors].		 Control Not selected NA NA
SR 07 Supply chain operations security Employ the following operations security (OPSEC) controls to protect supply chain-related information for the system, system component, or system service: [Assignment: organization-defined OPSEC controls]. Control Not selected NA NA
SR 08 Notification agreements Establish agreements and procedures with entities involved in the supply chain for the system, system component, or system service for the [Selection (one or more): notification of supply chain compromises; results of assessments or audits; [Assignment: organization-defined information]]. Control Selected NA NA
SR 09 Tamper resistance and detection Implement a tamper protection program for the system, system component, or system service Control Not selected NA NA
SR 09(01) Tamper resistance and detection Tamper resistance and detection: Multiple stages of system development lifecycle
Employ anti-tamper technologies, tools, and techniques throughout the system development lifecycle.		 Control Not selected NA NA
SR 10 Inspection of systems or components Inspect the following systems or system components [Selection (one or more): at random; at [Assignment: organization-defined frequency], upon [Assignment: organization-defined indications of need for inspection]] to detect tampering: [Assignment: organization-defined systems or system components]. Control Selected NA NA
SR 11 Component authenticity
  1. Develop and implement anti-counterfeiting policy and procedures that include the means to detect and prevent counterfeit components from entering the system.
  2. Report counterfeit system components to [Selection (one or more): source of counterfeit component; [Assignment: organization-defined external reporting organizations]; [Assignment: organization-defined personnel or roles]].
 Control Selected NA NA
SR 11(01) Component authenticity Component authenticity: Anti-counterfeit training
Train [Assignment: organization-defined personnel or roles] to detect counterfeit system components (including hardware, software, and firmware).		 Control Selected NA NA
SR 11(02) Component authenticity Component authenticity: Configuration control for component service and repair
Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [Assignment: organization-defined system components].		 Control Selected NA NA
SR 11(03) Component authenticity Component authenticity: Anti-counterfeit scanning
Scan for counterfeit system components [Assignment: organization-defined frequency].		 Control Not selected NA NA
SR 12 Component disposal Dispose of [Assignment: organization-defined data, documentation, tools, or system components] using the following techniques and methods: [Assignment: organization-defined techniques and methods]. Control Selected NA NA
]]>https://cyber.gc.ca/en/guidance/cyber-security-privacy-risk-management/itsp10033<![CDATA[Security and privacy controls and assurance activities catalogue (ITSP.10.033)]]>2026-03-31T18:28:12Z

Alternate format: Security and privacy controls and assurance activities catalogue - ITSP.10.033 (PDF, 4.5 MB)

 

Table of contents

List of figures

]]>https://cyber.gc.ca/en/guidance/cyber-security-privacy-risk-management<![CDATA[Cyber security and privacy risk management: A lifecycle approach]]>2026-03-31T18:16:57Z

This publication is part of a series of guidelines published by the Cyber Centre, under “Cyber security and privacy risk management: A lifecycle approach.” It contains definitions of assurance activities and controls for systems and organizations that practitioners can use as a foundation for selecting, tailoring and allocating controls and assurance activities to manage cyber security and privacy risks. Implementing a comprehensive set of security and privacy controls and assurance activities can help organizations achieve their business activities.

]]>https://cyber.gc.ca/en/news-events/etherhiding-trojan-your-toolchain<![CDATA[ EtherHiding: The trojan in your toolchain]]>2026-03-31T14:00:15Z

The Canadian Centre for Cyber Security (Cyber Centre) is actively tracking a campaign exploiting blockchain technology to covertly host and distribute malware. This campaign leverages a technique known as EtherHiding.

The Cyber Centre has compiled a detailed analysis derived from a recent investigation to help defenders combat attacks leveraging this technique. This analysis examines the evolution and use of the EtherHiding technique and provides an in-depth characterization of the threat actor’s techniques, along with critical mitigation and detection guidance.

Table of contents

Executive summary

This technical article aims to raise awareness and describe some of the tactics, techniques, and procedures (TTPs) associated with EtherHiding. The Cyber Centre’s preliminary findings highlight that, in the analyzed incident, the threat actor inserted a malicious one-liner JavaScript downloader inside a configuration file for the Tailwind CSS framework (tailwind.config.js).

The downloaded JavaScript payload is a highly advanced backdoor designed for a covert operation, as it operates within the Node.js runtime environment that is embedded in Visual Studio Code (VS Code) or Cursor AI (a modified version of VS Code). It is designed to infect developer machines, perform file or directory theft, and execute command from a command-and-control server (C2). The subsequent analysis of this backdoor module provided valuable insights into the extent of the compromise as well as the threat actor’s intentions and activities.

An incident overview

Disclaimer: Although it is unknown how the threat actor was able to push the file, this technical analysis focuses on how the threat actor was able to achieve remote code execution, maintain persistence, leverage C2 techniques and exfiltrate data.

While working on an artificial intelligence (AI) source project that used the Node.js Tailwind CSS framework, a developer observed an unknown commit made to their private internal GitHub repository. That commit modified their tailwind.config.js file in plain sight. Padded with over a thousand whitespace characters, the file blended seamlessly into the developer’s workspace – making it especially difficult to spot during routine code reviews. Technical support was sought from the Cyber Centre to assist with threat analysis and identification.

The malicious code is designed to take advantage of the Node.js ecosystem, which is commonly used by developers to build and test applications. When a developer interacts with the repository, the hidden payload is triggered within the environment without their knowledge.

Figure 1: Attack path depicting how the threat actor gained access and moved through the environment

Figure 1 - Long description immediately follows
Long description - Attack path depicting how the threat actor gained access and moved through the environment

The figure depicts a multi-stage cyber attack flowchart. It starts with the execution of a malicious JavaScript file that retrieves transaction hashes from cryptocurrency platforms. This triggers a chain of events involving multiple downloaders and a JavaScript backdoor (InvisibleFerret) to execute malicious payloads and enable unauthorized access.

Top of page

Analysis of the incident

Disclaimer: To enhance source code readability, content may be updated by adding comments or renaming functions and variables.

mitre att&CK techniques observed during analysis

The information below is based on the attack path outlined in figure 1.

Observation 1

Observation 2

Observation 3

Observation 4

Observation 1

Observed tactics: Execution (TA0002); Defense evasion (TA0005); Resource development (TA0042)

Observed techniques: Command and scripting interpreter: JavaScript (T1059.007); Masquerading (T1036); Stage capabilities: Upload malware (T1608.001)

Once triggered, the malware runs custom JavaScript routines that decrypt and launch additional payloads. The attack is multi-staged and dynamic.

Stage 1

The tailwind.config.js file loads a jadesnow downloader that requests a transaction hash from hardcoded wallet addresses on the tron or Aptos blockchains.Footnote 1

Figure 2: Flow diagram illustrating how the script requests a transaction hash

Figure 2 - Long description immediately follows
Long description - Flow diagram illustrating how the script requests a transaction hash

The figure illustrates the initial stages of a cyber attack, starting with the execution of a malicious JavaScript file (tailwind.config.js) within a Node.js environment. This script triggers the jadesnow Downloader1, which retrieves a transaction hash from cryptocurrency platforms.

Stage 2

Using the transaction hash, the jadesnow downloader fetches a payload from the Binance Smart Chain (BSC) via a JSON RPC post request. The payload is XOR-decrypted using a hardcoded key and executed as JavaScript.

Figure 3: Flow diagram illustrating how the payload is XOR-decrypted

Figure 3 - Long description immediately follows
Long description - Flow diagram illustrating how the payload is XOR-decrypted

The figure depicts a cyber attack segment involving two malicious downloaders. The "jadesnow Downloader1" downloads a payload from Binance (step 3) and decrypts the payload using XOR (step 4) to produce a JavaScript file (payload1.js). The decrypted file is then executed (step 5), triggering "jadesnow Downloader2" to continue the attack chain.

Stage 3

The decrypted payload is another jadesnow downloader, repeating the blockchain fetch-and-decrypt process with new wallet combinations and a hardcoded XOR key. The payload is a loader for the InvisibleFerret.JavaScript backdoor.Footnote 2

Figure 4: How the decrypted payload repeats the process using new wallet combinations

Figure 4 - Long description immediately follows
Long description - Flow diagram illustrating how the payload is XOR-decrypted

The figure depicts how the "jadesnow Downloader2" retrieves a transaction hash from the TRON and Aptos cryptocurrency platforms. Using that transaction hash, it downloads a payload from Binance which is decrypted using XOR to produce a JavaScript file (payload2.js). It is then executed to trigger "jadesnow Downloader1" and continue the attack sequence.

Stage 4

The last payload is another jadesnow downloader that is XOR-decrypted using a static key. This variant of the malware checks for a kill switch (process.env.jsbot) to terminate itself if detected, attempts to deploy Python (python.zip, python.7z, 7zr.exe), and runs scripts (boot, client) for further compromise.

Figure 5: XOR decryption key

Figure 5 - Long description immediately follows
Long description - Figure 5: XOR decryption key

The figure depicts how the "jadesnow Downloader1" retrieves a transaction hash from the TRON and APTOS cryptocurrency platforms. Using that transaction hash, it downloads a payload from Binance which is decrypted using XOR to produce a JavaScript file (payload3.js). It is then executed to trigger "jadesnow Downloader3" and continue the attack sequence.

Top of page

Observation 2

Observed tactics: Privilege escalation (TA0004); Persistence (TA0003)

Observed technique: Event triggered execution: Component object model hijacking (T1546.015)

InvisibleFerret.JavaScript injects itself into the telemetry files of VS Code and Cursor AI to reconfigure files like index.js in the editor’s internal modules. The injected code includes custom session labelling, such as [5-74-<date>]<hostname>$<username>.

It maintains persistent communication with its operators using both HTTP POST and socket.io connections while it waits for commands and will attempt to reconnect every five seconds if the connection is dropped.

Since this module is responsible for generating unique machine IDs, hijacking it allows the malware to:

  • track users across sessions and installations
  • leak identifying information
  • maintain persistent access

Paths for the injected file varies by operating system (OS):

  • Windows: %localappdata%\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\deviceid\dist\index.js
  • MacOS: /Applications/Visual Studio Code.app/Contents/Resources/app/node_modules/@vscode/deviceid/dist/index.js
  • Linux: /usr/share/code/resources/app/node_modules/@vscode/deviceid/dist/index.js
Top of page

Observation 3

Observed tactics: Command and control (TA0011); Discovery (TA0007)

Observed techniques: Application layer protocol: Web protocols (T1071.001); Application layer protocol: DNS (T1071.004); System location discovery (T1614)

Communication with the attacker’s infrastructure is handled specifically via HTTP POST requests to hardcoded internet protocol (IP) addresses and uniform resource identifiers (URIs). Various C2 servers and endpoints include a numerical value of 5-74 in the uniform resource locator (URL) which corresponds to a malware or campaign version number defined in the JavaScript program.

The malware fetches external internet protocol (IP) information to determine the geographical location of the victim, helping attackers profile the infected environment and tailor their operations. It also supports a wide range of other commands, as outlined below.

Supported commands with descriptions and techniques

  • cd: changes the current location to the target directory
  • ss_info: returns information about the running Node.js application: version, session, operating system, and path
  • ss_ip: gets the external IP address information from ip-api[.]com/json
  • ss_upf: uploads a file
  • ss_upd: uploads a directory
  • ss_dir: changes the current location to the module directory
  • ss_fcd: changes the current location to the target directory
  • ss_inz: injects JavaScript code in VSCode
  • ss_eval: executes JavaScript code using eval

The commands above enable a threat actor to conduct data collection activities (Tactic: Collection (TA0009) – Data from Local System (T1005)) and run arbitrary code on affected systems.

Top of page

Observation 4

Observed tactic: Exfiltration (TA0010)

Observed technique: Exfiltration over C2 channel (T1041)

Robust, recursive routines are used to upload a single file or an entire directory to attacker-controlled servers. The malware then leverages Node.js modules like Axios and form data to craft HTTP POST requests with multipart/form-data, ensuring compatibility with web servers and stealth in transit.

The malware’s recursive upload function (recursiveHttpUpload) walks through directories, collecting file paths and uploading each file individually. Success and failure counts are tracked, and status messages are sent back to the C2 via socket.io events. The exfiltration is not limited to files, as entire directory trees can be sent, enabling attackers to siphon off large volumes of source code, configuration files or sensitive data in one go.

Indicators of compromise and recommendations

Indicators of compromise (IoCs) were distributed through alerts and communications by the Canadian Cyber Security Incident Response Team (CSIRT). This ensured that partners across all sectors had the information they needed to act decisively.

For up-to-date information on alerts and advisories or cyber security guidance, please contact the Cyber Centre.

Malicious JavaScript configuration

  • tailwind.config.js
    • SHA256: d043f264ff5216fa724cad2d35ba4d895c43e295df72be6d46c07a3a46cfbd62

Payloads

  • payload2.js (InvisibleFerret.Javascript)
    • SHA256: 7237310e076459d2fce2f531941b5920e451f390a8b8e633787b62b68b1315d5
  • boot-decoded-2.js
    • SHA256: 91822e59bd642f8e6f321011d0fb45b8a5f0854547ea898dead5d5af1db3ed9b

C2 URL

  • /verify-human/5-74

C2 URL for upload endpoint

  • /u/f/

C2 IPs

  • 166.88.4[.]2
  • 23.27.202[.]27
  • 23.27.202[.]143
  • 136.0.9[.]8

C2 port

  • 27017
Top of page

Cyber Centre tools and services

No single tool, service or turnkey solution can reconstruct an incident, trace an attacker’s path or validate a threat on its own. A holistic approach using multiple perspectives is required to conduct a thorough investigation. As such, the Cyber Centre relies on multiple layered telemetry sources to detect threats and protect monitored assets.

AssemblyLine was used to enable triage at scale, processing hundreds of thousands of files per day. In response to this incident, the Cyber Centre also created YARA rules to help with the detection of malicious files related to the threat actor’s activity. Additional YARA rules will be released periodically after an evaluation period to ensure accuracy.

The YARA rule below enables a detection of similar payloads extracted from the compromised host.

Figure 6: YARA rule for jadesnow obfuscated downloader

Figure 6 - Long description immediately follows
Long description - Figure 6: YARA rule for jadesnow obfuscated downloader

This YARA rule specifically targets malware associated with the jadesnow actor group. It uses a combination of metadata, including a unique identifier, fingerprint, version, and description, along with a specific string pattern and condition to identify the presence of the obfuscated downloader in files. The condition checks for a specific hexadecimal value and the presence of a defined obfuscated string pattern to flag potential threats.

Code
rule jadesnow_obfuscated_downloader { 
    meta: 
      id = "1vzA18HaXi4AzFlgIvijiq" 
      fingerprint = "02701150de12a2a30a570cb0c1147d32b005fe618a6eceb1452e1c1eaba6b27a" 
      version = "1.0" 
      modified = "2025-12-30" 
      status = "released" 
      sharing = "TLP:GREEN" 
      source = "CCCS" 
      author = "reveng@CCCS" 
      description = "Detects the obfuscated downloader appended to legitimate GitHub projects, used by jadesnow" 
      category = "malware" 
      malware_type = "downloader" 
      report = "TA25-0064" 
      hash = "d043f264ff5216fa724cad2d35ba4d895c43e295df72be6d46c07a3a46cfbd62" 
      first_imported = "2025-12-30" 
      strings: $obfuscated_downloader = /\s{200}global\[[\x09\x0A\x0D\x20-\x7E]+function[\x09\x0A\x0D\x20-\x7E]+\.length;[\x09\x0A\x0D\x20-\x7E]+charAt\([\x09\x0A\x0D\x20-\x7E]+\.join/ 
      condition: uint16(0) != 0x5A4D and 
      $obfuscated_downloader 
  }
Top of page

Acknowledgments

As a part of the Communications Security Establishment Canada (CSE), the Cyber Centre is a proud member of the Five Eyes, the world’s longest-standing and closest intelligence-sharing alliance. Sharing IoCs and TTPs with the cyber community and Five Eyes partners has been instrumental since the EtherHiding campaign was first discovered, and ongoing analytical exchanges have maximized the value of collected data.

Further collaboration with organizations such as Mandiant has enabled the exchange of detailed malware analysis and technical findings, strengthening collective defences.

Disclaimer: The Cyber Centre disclaims all liability for any loss, damage, or costs arising from the use of or reliance on the information within this article. Readers are solely responsible for verifying the accuracy and applicability of any information before acting on it.

]]>https://cyber.gc.ca/en/news-events/joint-guidance-securing-space-cyber-security-low-earth-orbit-satellite-communications<![CDATA[Joint guidance on securing space and cyber security for low earth orbit satellite communications]]>2026-03-25T14:40:25Z

The Canadian Centre for Cyber Security (Cyber Centre) has joined the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), the Australian Space Agency (ASA) and the following international partners in releasing cyber security guidance on considerations for users of low earth orbit (LEO) satellite services:

  • New Zealand National Cyber Security Centre (NCSC-NZ)
  • United States’ National Security Agency (NSA)

The rapid expansion and increasing reliance on LEO satellite communication (SATCOM) systems have introduced significant cyber security challenges. As LEO satellite constellations grow, the attack surface for threat actors increases. This growth puts critical networks that depend on these satellite services at greater risk. Securing this infrastructure is essential to ensuring the resilience of commercial communications, national security systems and emergency response capabilities.

This joint guidance is intended for users of LEO SATCOM services. It highlights the key cyber security risks and mitigation strategies to support informed decision-making. It also provides organizations with a set of critical questions that they can ask in discussions about security with LEO SATCOM service providers.

Read the full joint guidance: Securing space – Cyber security for low earth orbit satellite communications

]]>https://cyber.gc.ca/en/guidance/top-10-artificial-intelligence-security-actions-primer-itsap10049<![CDATA[Top 10 artificial intelligence security actions: A primer - ITSAP.10.049]]>2026-03-05T16:56:13Z

In an era of rapid advancements in artificial intelligence (AI), organizations face heightened security risks. Such risks include data theft, reputational harm, and operational and financial loss stemming from adversarial abuse of AI, attacks on AI systems or misuse of AI by business users.

The Canadian Centre for Cyber Security (Cyber Centre) plays a critical role in safeguarding Canadian organizations from these threats. Our top AI security actions are designed to help organizations of all sizes and sectors strengthen their cyber resilience. These recommended AI security actions support and strengthen our existing Top IT security actions (ITSM.10.089), rather than replace them.

By adopting AI-specific security actions, organizations can build more resilient AI-enabled infrastructures and processes. This will minimize the likelihood and impact of AI-related intrusions, misuse and system compromise.

Our top AI security actions are organized into the following 3 pillars:

Given the speed at which AI solutions are being developed and adopted, we expect the risks and actions to evolve over the next 10 years. However, the 3 pillars are expected to remain the same for the foreseeable future, even as AI models and methods evolve.

Top of page
 

Pillar 1: Protecting against adversarial use of AI

This pillar provides actions for your organization to enhance your ability to protect your environment from the adversarial use of AI.

Action 1: Implement prompt injection and jailbreak mitigations

  • Sanitize inputs
  • Isolate system prompts and protect prompt history
  • Apply output filtering and policy gating
  • Restrict high risk tools and agents via role based access and identity controls
  • Validate downstream actions (files, code and tools) before execution
  • Quarantine anomalous outputs
  • Reduce access to private data by AI models
  • Limit exposure to untrusted content
  • Reduce the ability for AI systems to communicate externally (such as embedded data in markdown image URLs)

Why this action matters Action 1

Imagine that you’re chatting with a smart chatbot assistant, but a hacker finds a way to secretly slip in sneaky commands inside your questions. These commands trick the AI into doing things it shouldn’t do, such as running harmful computer commands.

This happened in 2025 with GitHub Copilot. Threat actors used a clever “prompt injection” to fool it into running dangerous code remotely. Microsoft quickly fixed it, showing us that spotting these hidden hacks early is key to keeping AI safe.Footnote 1

Action 2: Defend against deepfake and impersonation

  • Deploy media authenticity checks and detection
  • Enforce strong identity verification and phishing-resistant multi-factor authentication (including meeting PINs) for conferencing and messaging
  • Train staff to verify unusual requests across channels
  • Implement out of band verification for sensitive actions
  • Implement abuse prevention for scams and social engineering at scale
  • Monitor for AI generated phishing and voice or video spoofs
  • Follow our Top 10 IT security actions (ITSM.10.089), including securing online accounts, to reduce hijacking and limit the impact of disinformation or false narratives
  • Set the default for all identify signals (such as voice and video) as untrusted until verified by your organization
  • Implement robust identity binding processes for higher risk business functions, such as finance, administrative privileges and access to sensitive information
  • Enforce identity risk scoring to AI when it’s used to launch or accelerate specific actions to determine the likelihood of compromise

Why this action matters Action 2

In early 2024, a British design and engineering firm lost millions of dollars/pounds when a threat actor used AI-powered deepfake technology to impersonate the company’s CFO. During a video call, they fooled an employee in Hong Kong into transferring funds to fake accounts. The money quickly vanished offshore.

In May 2025, a separate incident highlighted how a global advertising giant narrowly avoided a similar scam. In this case, a threat actor used deepfake video and audio of the CEO and senior executives in a Microsoft Teams meeting to try to trick employees into leaking confidential information and making payments.Footnote 2

Action 3: Harden defences against AI powered cyber attacks and fraud

  • Upgrade analytics for high volume, automated probing and credential stuffing
  • Enforce rate limiting, bot detection and adaptive authentication
  • Adopt zero trust principles and best practices
  • Establish clear standards for data quality, code and documentation
  • Regularly refactor models and code as systems evolve
  • Ensure ongoing maintenance, automated testing and proactive code review
  • Continuously monitor to mitigate “technical debt” and improve long-term AI system reliability and adaptability
  • Train staff on AI threats and create tailored awareness programs which include:
    • sharing intelligence reporting
    • developing resilience by addressing known issues through employee upskilling and vulnerability disclosure

Why this action matters Action 3

Early in 2025, ransomware attacks exploded by almost 150%. A new trend has emerged where threat actors use AI to craft perfect phishing emails that appear to be from your boss or bank. AI-driven malware can shape-shift (called polymorphic malware), acting normally on your computer to avoid being spotted until it’s too late.

Ransom amounts have increased from hundreds of thousands to millions of dollars, while the level of effort for threat actors has gone down significantly.Footnote 3

Top of page
 

Pillar 2: Protecting AI systems

This pillar provides actions for your organization to enhance your ability to protect AI systems.

Action 4: Conduct testing and red teaming of AI to identify modifications

  • Regularly evaluate models, pipelines and interfaces against known attacks (such as evasion, prompt injection and poisoning)
  • Update guardrails as exploits evolve
  • Prioritize vetted, signed and well-maintained models based on risk assessments
  • Apply timely patches and configuration updates
  • Develop recovery plans to provide options for faulty deployments
  • Implement disaster recovery and incident response plans for AI systems

Why this action matters Action 4

In July 2025, researchers found a critical data poisoning exploit in Microsoft 365 Copilot and similar retrieval-augmented generation (RAG) AI systems where threat actors injected poisoned documents to manipulate AI outputs persistently. This exploit showed the danger of insufficient continuous testing and updating of AI guardrails against evolving attacks.Footnote 4

Action 5: Safeguard against data poisoning

  • Track data provenance
  • Curate versioned datasets
  • Harden training environments or use sandboxed architectures
  • Run anomaly and bias detection on ingested data (including mirrored or manipulated news or content sources)
  • Implement gate training and finetuning with approval workflows and model and data rollback plans
  • Ensue rigorous identity and access control measures are implemented across all parts of the data and operations chain

Why this action matters Action 5

In 2024, security researchers working with Wiz and Hugging Face uncovered a risk in which malicious actors could upload poisoned data to Hugging Face’s dataset repositories. This vulnerability threatened AI pipelines of multiple organizations using their models and data. It exposed weak tracking of data sources and lack of anomaly detection on ingested data.Footnote 5

Action 6: Implement data usage controls and model theft prevention

  • Enforce “no train” defaults and strict data sharing controls
  • Implement vendor contractual clauses
  • Log and audit all models and data access
  • Monitor application programming interfaces (APIs) for extraction patterns (such as mass queries or label harvesting)
  • Prevent sensitive data leakage with data loss prevention and secret scrubbing

Why this action matters Action 6

Threat actors carry out model extraction attacks by querying a machine learning model extensively and using the responses to train a replica with similar functionality. Implementing defences like API rate limiting, authentication, query monitoring, model watermarking, and legal protections can prevent unauthorized model replication and data leakage.

Action 7: Secure AI engineering and supply chain processes

Why this action matters Action 7

In 2024, the NullBulge group conducted high-profile supply chain attacks on AI-related open-source repositories hosted on GitHub and Hugging Face. By injecting malicious Python payloads into widely used AI tools and dependencies, they were able to exfiltrate sensitive data and deploy ransomware into downstream systems.

This incident underscores the dangers of technology debt when AI solutions are rapidly adopted without robust security controls. The incident also demonstrates the urgent need for foundational secure engineering, cryptographically signed artifacts, comprehensive SBOMs, and adherence to recognized security frameworks.Footnote 6

Top of page
 

Pillar 3: Protecting users and business processes

This pillar provides actions for your organization to enhance your ability to protect users and business processes.

Action 8: Enforce data privacy, vendor and contractual controls

  • Classify and minimize personally identifiable information (PII) in prompts
  • Encrypt data in transit and at rest
  • Apply data loss prevention, access controls and retention limits
  • Require transparency, audit rights, liability and use restrictions (for intellectual property and copyright issues)
  • Support the labelling of generative AI content to improve transparency
  • Map and identify sanctioned and unsanctioned models operating on a network
  • Implement policies, process and tools to govern the use of “shadow AI”
  • Create an internal business policy for the acceptable use of AI tools
  • Apply allow and deny lists for AI solutions
  • Draft procurement clauses for vendors of AI-generated tools or solutions to protect against reputational harm

To meet regulatory expectations and manage vendor risk, contracts with AI vendors should include explicit data usage, privacy, audit, and liability clauses. These clauses should include:

  • prohibiting unauthorized use of organizational data for model training
  • ensuring encryption and access controls for all PII
  • requiring vendor transparency and audit rights
  • embedding usage restrictions and liability terms to protect against data leakage, unauthorized reuse, and reputational or legal harm

Why this action matters Action 8

Internal policies, including lists of approved AI tools and shadow AI controls, ensure AI tools are used safely and in compliance with privacy laws and contractual obligations.

Action 9: Ensure that human-in-the-loop oversight and execution controls are in place

  • Embed human checkpoints in automated and multi‑agent workflows
  • Provide explainability tools and auditable decision trails
  • Implement escalation, triage, rate limits and kill‑switches or emergency shutdown procedures for high‑impact actions

Why this action matters Action 9

In 2025, an HR technology company faced reputational damage and legal scrutiny after removing human review from its AI-driven candidate screening process. The lack of human oversight allowed unchecked algorithmic bias to influence hiring decisions. In response, the organization reinstated human-in-the-loop controls, added execution checks, and established auditable decision trails to ensure all AI-driven outcomes are monitored and can be corrected by human reviewers.Footnote 7

Action 10: Maintain operational resilience against model drift, hallucinations, bias and overreliance

  • Continuously monitor for drift and performance degradation
  • Retrain or retire models that exceed validated bounds
  • Continuously monitor for AI decision transparency to enable better understanding of model decisions and outputs
  • Add truth checking and human review for critical outputs
  • Test for bias and misuse
  • Maintain fallback procedures and user training to avoid overreliance
  • Require human review to prevent introduction of made-up components and containers for software code that could be appropriated by a threat actor
  • Implement detection measures and retraining thresholds

Why this action matters Action 10

Financial regulators, including Canada’s Office of the Superintendent of Financial Institutions (OSFI), have identified AI model risk as a growing supervisory concern, particularly risks arising from data quality issues, model drift, lack of transparency, bias, and overreliance on automated outputs. OSFI has warned that poorly governed AI systems can produce unreliable or unexpected results, potentially leading to operational disruption, financial loss, legal exposure, and reputational harm if not actively monitored and controlled.

As AI models evolve over time and conditions change, maintaining operational resilience requires continuous performance monitoring, explainability, human oversight for critical decisions, and clear fallback procedures to ensure AI systems remain within validated and acceptable risk boundaries.Footnote 8

Top of page
 
Top of page
 
]]>https://cyber.gc.ca/en/news-events/joint-guidance-supply-chain-risks-mitigations-artificial-intelligence-machine-learning<![CDATA[Joint guidance on supply chain risks and mitigations for artificial intelligence and machine learning]]>2026-03-05T15:05:25Z

The Canadian Centre for Cyber Security (Cyber Centre) has joined the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and the following international partners in releasing cyber security guidance on supply chain risks and mitigations for artificial intelligence (AI) and machine learning (ML):

  • Japan’s National Cybersecurity Office (NCO)
  • New Zealand National Cyber Security Centre (NCSC-NZ)
  • Republic of Korea’s National Intelligence Service (NIS)
  • Singapore’s Cyber Security Agency (CSA)
  • United Kingdom’s National Cyber Security Centre (NCSC-UK)
  • United States’ National Security Agency (NSA)

AI and ML systems allow organizations to improve their efficiency in various ways, including by making informed decisions, streamlining processes and improving customer experience.

If not securely managed, adopting AI or ML systems and using pre-trained models and third-party data sets can introduce unique supply chain risks and expose your organization to existing vulnerabilities and compromises. Organizations should know what to look out for when developing or incorporating AI and ML into their systems.

This joint guidance is intended for organizations and staff that deploy or develop AI or ML systems and components. The risks and mitigation in this joint guidance should inform organizations’ questions and requirements for vendors when sourcing third-party AI or ML systems and components. It aims to highlight the importance of AI and ML supply chain security and address key risks and mitigations that should be considered when developing or procuring an AI system.

Consult the full joint guidance: Artificial intelligence and machine learning – Supply chain risks and mitigations

]]>https://cyber.gc.ca/en/guidance/cyber-threat-bulletin-iranian-cyber-threat-response-usisrael-strikes-february-2026<![CDATA[Cyber threat bulletin: Iranian Cyber Threat Response to US/Israel strikes, February 2026]]>2026-03-02T15:28:10Z

Overview

On February 28, 2026, the United States (U.S.) and the State of Israel (Israel) launched military strikes against the Islamic Republic of Iran (Iran) to eliminate threats from the Iranian regime.Footnote 1 Iran retaliated with military strikes against Israel and U.S. military bases across the Middle East.Footnote 2

On February 28, 2026, the Government of Canada released a statement supporting the United States acting to prevent Iran from obtaining a nuclear weapon and to prevent its regime from further threatening international peace and security.Footnote 3

Iran will very likely use its cyber program to respond to the joint U.S. and Israel combat operations against Iran. Possible responses by Iranian cyber threat actors include:

  • Cyber attacks against critical infrastructure;
  • Cyber-enabled information operations;
  • Online harassment of military personnel; and
  • Harassment and repression of diaspora and activist communities.

Canadian critical infrastructure operators and other possible targeted entities should remain vigilant to threats posed by cyber actors aligned with Iranian interests.

Iran uses cyber program to retaliate, achieve geopolitical goals

  • Iranian state-sponsored cyber threat actors conduct disruptive cyber-enabled information operations to further Iran’s geopolitical objectives and the regime’s interests. Iran has developed a network of hacktivist personas and social media channels to intimidate Iran’s opponents and shape public opinion.Footnote 4
  • Iranian state-sponsored cyber threat actors opportunistically target poorly secured critical infrastructure (CI) networks and internet-connected devices around the world, including those associated with the water and energy sectors.Footnote 5 Iranian cyber threat actors have performed denial of services attacks, attempted to manipulate industrial control systems, and accessed networks to encrypt, wipe, and leak data.Footnote 6
  • Pro-Iran hacktivists conduct cyber threat activity against Iran’s rivals, but often overstate their impact. In response to the U.S. airstrikes on Iranian nuclear sites in 2025, pro-Iran hacktivist groups claimed to have conducted distributed denial-of-service (DDoS) attacks against websites associated with the U.S. military, U.S. defence companies and U.S. financial institutions.Footnote 7 Pro-Iran hacktivists will likely view Canada as a target for low-sophistication disruptive cyber activity due to Canada’s public support of the US/Israel military activity.
  • Iranian state-sponsored cyber threat actors likely conduct cyber espionage against individuals in Canada that the Iranian regime considers a threat, such as political activists, journalists, and human rights advocates.Footnote 4 We assess that Iranian cyber threat actors will likely target opponents abroad, especially those advocating for regime change in Iran.Footnote 8
Top of page
 

Characteristics of Iranian cyber threat activity

Compelling social engineering

Iranian cyber threat groups are particularly sophisticated in combining social engineering with spear phishing, using these efforts to target public officials and gain access to government networks and private sector organizations globally.Footnote 9

Iranian social engineering efforts focus on using professional interactions on social media platforms to gain information about organizations related to Iran’s political, economic and military interests, particularly in the aerospace, energy, defence, security, and telecommunications sectors.Footnote 9

Exploiting known vulnerabilities

Iranian cyber threat actors exploit known vulnerabilities to gain initial access to systems, and then leverage this access for follow on operations such as data exfiltration or encryption, ransomware, and extortion.Footnote 10

Iranian cyber threat actors opportunistically identify targets using publicly available scanning tools to search for internet-exposed systems with vulnerable configurations, for example devices using default or weak passwords and without multi-factor authentication.Footnote 11

Disruptive and destructive cyber attacks

Iranian cyber threat actors typically conduct DDoS attacks and website / device defacements to temporarily disrupt target networks. They also deploy ransomware and destructive wiper malware and conduct hack-and-leak operations against compromised targets.Footnote 12

Top of page
 

Useful resources

Refer to the following online resources for more information and useful advice and guidance.

Reports and advisories

Advice and guidance

Top of page
 

About this document

Contact

For follow-up questions or issues, contact the Cyber Centre at contact@cyber.gc.ca.

Assessment base and methodology

The key judgements in this assessment rely on reporting from multiples sources, both classified and unclassified. The judgements are based on the Canadian Centre for Cyber Security (Cyber Centre)’s knowledge and expertise in cyber security. Defending the Government of Canada’s information systems provides the Cyber Centre with a unique perspective to observe trends in the cyber threat environment, which also informs our assessments. CSE’s foreign intelligence mandate provides us with valuable insight into adversary behavior in cyberspace. While we must always protect classified sources and methods, we provide the reader with as much justification as possible for our judgements.

Our key judgements are based on an analytical process that includes evaluating the quality of available information, exploring alternative explanations, mitigating biases and using probabilistic language. We use terms such as “we assess” or “we judge” to convey an analytic assessment. We use qualifiers such as “possibly”, “likely”, and “very likely” to convey probability.

The contents of this document are based on information available as of February 28, 2026.

Estimative language

Estimated language chart long description immediately follows

Long description - Estimative language chart
  • 1 to 9% Almost no chance
  • 10 to 24% Very unlikely/Very Improbable
  • 25 to 39% Unlikely/Improbable
  • 40 to 59% Roughly even chance
  • 60 to 74% Likely/probably
  • 75 to 89% Very likely/very probable
  • 90 to 100% Almost certainly
 
 
Top of page
]]>https://cyber.gc.ca/en/news-events/joint-guidance-malicious-cyber-threats-sd-wan-networks<![CDATA[Joint guidance on malicious cyber threats to SD-WAN networks]]>2026-02-25T16:10:24Z

Malicious cyber threat actors are targeting Software-Defined Wide Area Networks (SD-WAN) networks used by organizations globally. The Canadian Centre for Cyber Security (Cyber Centre), a part of the Communications Security Establishment Canada (CSE), and international partners strongly encourage immediate action to ensure SD-WANs are patched, hardened and investigated for potential compromise.

Consult the following for additional information and recommendations:

The Cyber Centre is monitoring the situation and can provide assistance and advice as required. If you believe your organization has been impacted or requires assistance, contact us by email at contact@cyber.gc.ca or by phone at 613-949-7048 or 1‑833‑CYBER‑88.

Quote

We urge Canadian organizations and their network defenders to heed this warning, use the hunt guide, and patch. These malicious cyber threat actors are targeting organizations globally. Vigilance and immediate action will help us all harden our defences to get ahead of this threat.
Rajiv Gupta, Head of the Canadian Centre for Cyber Security

Background

The Cyber Centre has joined ACSC and the following other international partners in releasing guidance alerting of malicious cyber threat actors targeting SD-WAN networks used by organizations globally:

  • New Zealand National Cyber Security Centre (NCSC-NZ)
  • United Kingdom National Cyber Security Centre (NCSC-UK)
  • United States National Security Agency (NSA)
  • United States Cybersecurity and Infrastructure Security Agency (CISA)

Threat actors have been observed using CVE-2026-20127 to add a malicious rogue peer. They have then conducted a range of follow-on actions to achieve root access and maintain persistent, long-term access to SD-WAN networks.

ACSC’s hunt guide (PDF) has been prepared based on observations from various investigations and details the tactics, techniques and procedures (TTPs) leveraged by these malicious actors. The hunt guide aims to support network owners and defenders to conduct detection and threat hunting activities and provides mitigation guidance to reduce the risk from the observed TTPs.

Mitigation advice

The authoring agencies strongly urge network defenders to ensure SD-WANs are fully patched (including for CVE-2026-20127) and to hunt for evidence of compromise detailed in the hunt guide. The guidance also urges organizations to review and implement Cisco's SD-WAN hardening guidance.

To reduce the risks to your networks, Cisco’s SD-WAN hardening guidance should be reviewed in full. It includes advice on the following:

  • Network perimeter controls: Ensure control components are behind a firewall, isolate VPN 512 interfaces, and use IP blocks for manually provisioned edge IPs
  • SD-WAN manager access: Replace the self-signed certificate for the web user interface
  • Control and data plane security: Use pairwise keying
  • Session timeout: Limit to the shortest period possible
  • Logging: Forward to a remote syslog server

Additional resources

For more information on vulnerabilities, visit our Alerts and advisories page.

For best practices, visit our Cyber security guidance page.

]]>https://cyber.gc.ca/en/news-events/cse-calls-canadian-organizations-critical-infrastructure-providers-strengthen-defences-fourth-anniversary-russias-invasion-ukraine<![CDATA[CSE calls on Canadian organizations and critical infrastructure providers to strengthen defences on fourth anniversary of Russia’s invasion of Ukraine]]>2026-02-20T19:06:58Z

The Communications Security Establishment Canada (CSE) and its Canadian Centre for Cyber Security (Cyber Centre) are urging Canadian organizations to stay vigilant and strengthen their defences against malicious cyber threats as the four-year mark of Russia's full-scale invasion of Ukraine approaches.

Over the past four years, the Cyber Centre has observed pro-Russia cyber actors targeting countries, including Canada, that support Ukraine. These activities have affected government and military agencies, private and public sector organizations, and critical infrastructure networks in Canada. Russian cyber threat actors have also attempted to disrupt services to Canadians by targeting cloud-based platforms, supply chains, and Internet-facing systems, including through distributed denial of service (DDoS) attacks.

As we previously reported, we continue to see ideologically motivated, pro-Russia non-state cyber groups conducting malicious activity against perceived enemies. These groups are generally less sophisticated than state-sponsored actors but act independently, leading to unpredictability and a higher tolerance for risk.

Canadian organizations and critical infrastructure operators should remain vigilant to threats posed by cyber actors aligned with Russian interests and prepare for potential service disruptions, website defacement and increased ransomware activity. Operators of Internet-connected operational technology (OT) devices should remain alert, as these systems are easily discoverable and vulnerable to cyber threats.

We urge all Canadian organizations to implement appropriate measures now to defend against threats from Russian-aligned cyber actors.

Recommended actions

The Cyber Centre continues to share cyber threat information with Canadian critical infrastructure and government partners via protected channels throughout the year. We actively monitor the cyber threat environment in Canada and globally. Canadian organizations that believe they may have been targeted by cyber threat activity should contact the Cyber Centre by email at contact@cyber.gc.ca or by phone at 1-833-CYBER-88.

Related resources

]]>https://cyber.gc.ca/en/guidance/security-considerations-sims<![CDATA[Security considerations for SIMs (ITSAP.10.021)]]>2026-02-16T18:56:46Z

A subscriber identity module (SIM) card is an electronic chip that stores mobile network user information, such as your phone number and authentication key used to grant access to the cellular network. A SIM card is also referred to as a universal integrated circuit chip (UICC), which is the modern day version of the original SIM card. Although the UICC is the technical term, it continues to be referred to as the SIM card.

Because of the information they store, SIMs can be valuable targets for threat actors. This publication aims to help you understand the main threat, known as SIM swapping, and provide you with recommendations to better protect yourself.

On This Page

Difference between a SIM card and an eSIM

A SIM card is a physical card inserted into a device. It uses information stored within it to identify and authenticate the user on a mobile network. An embedded SIM (eSIM) is a non-removable electronic chip integrated into the device, making it easy to configure and activate remotely. An eSIM is capable of storing several SIM profiles at once.

Considerations for eSIMs

Providers are increasingly offering eSIMs as a format due to convenience. However, there are risks associated with them. eSIMs can make it easier for threat actors to:

  • compromise and gain access to your mobile accounts
  • conduct social engineering and remote attacks, as they can be digitally generated and electronically transferred
  • compromise multiple profiles at a time
  • leverage malicious software through arbitrary code execution

SIM swapping

SIM swapping is an attack against your mobile phone account that transfers your phone number to a threat actor’s SIM card or eSIM without your knowledge or permission. Some other common terms used for SIM swapping include SIM jacking, SIM napping and SIM porting.

If a threat actor is successful with a SIM swapping attack, they can use their device to control communications meant for you, including through impersonation. This scam is also used to access other accounts, such as your bank account, that might use your phone number as a method to verify your identity.

How SIM swapping happens

Threat actors leverage the following methods to conduct SIM swapping attacks.

Calling your provider

Threat actors attempt SIM swapping using a similar process that providers follow when they transfer a user’s phone number from their old device to a new one during an upgrade. Threat actors can try to transfer a victim’s phone number to their own device by calling the mobile network provider and fraudulently impersonate the victim. They can bypass common security questions used to verify your identity by researching the personal information you’ve shared online.

Stealing your credentials

Threat actors can also try to access your mobile account details on the provider’s website to initiate and authorize a SIM swap. They use credential stuffing, where criminals use stolen usernames and passwords, or collect personal information that has been shared online and on social media to answer security questions during account authentication.

Exploiting insider access

SIM swapping can occur due to insider threat. Employees and other insiders with internal access to a mobile service provider can falsely authorize changes to customer accounts and sell swapped SIMs.

Consequences of SIM swapping

If you are a victim of SIM swapping, a threat actor will receive your phone calls, messages and notifications on their device. Since mobile devices are often used as an authentication measure, a threat actor can impersonate you and gain access to your accounts and information, putting both you and your organization at risk.

Individual risks

As an individual, being a victim of SIM swapping possesses several risks. A threat actor can:

  • change and steal other account credentials
  • prevent you from accessing and managing your accounts
  • steal your money and financial information
  • control and handle information managed through personal accounts
  • impersonate you to spread the scam to your contacts

Organizational risks

Depending on your organization’s posture on device-use (for example, company-owned or personal devices) and remote work, it is important to evaluate the level of sensitivity of the data being handled. If threat actors compromise a mobile service that handles your organization’s information, they can:

  • impersonate the individual behind the account
  • spread phishing scams and malware to other accounts and devices
  • gain access to sensitive and confidential information
  • compromise systems and processes
  • damage your business’ reputation and trust with customers and partners

The signs of SIM swapping

There are signs you can look out for that signify that a threat actor may be trying to or has swapped your SIM. These include:

  • abnormal reduction in messages on your device
  • lack of verification messages when using multi-factor authentication (MFA)
  • phishing messages asking to verify your account with a PIN or clicking a link to login
  • messages indicating activity on your account that you don’t remember
  • changes to account information you did not make
  • losing access to online accounts (for example, banking, email and social media)
  • transactions on accounts that are unknown
  • disconnection from cellular network

If your SIM has been successfully swapped, you will lose cellular service as well as Wi-Fi calling capabilities. It is important to note that being connected to Wi-Fi can keep your data connection active. If you switch between cellular service and Wi-Fi automatically and frequently, you may not immediately recognize when your SIM is compromised.

How to protect your SIM

It is important to take preventative security measures to reduce the risks of being a victim of SIM swapping. The best ways to protect yourself from SIM swapping include:

  • using any additional verification requirements your mobile provider offers to help protect your account
  • requesting your mobile provider to enable port protection or a SIM lock on your accounts, if available
  • enabling MFA that includes methods other than those that rely on your phone number (for example, a PIN, biometric or authentication app)
  • keeping sensitive information related to account security questions private (for example, date of birth, home address and mother’s maiden name)
  • using separate and unique email addresses for financial accounts and social media
  • creating different passwords and passphrases for each of your accounts
  • keeping up with your provider’s security advisories and Cyber Centre guidance and alerts

Organization-specific security measures

Alongside the security measures mentioned, there are some specific security practices your company should consider to help prevent SIM swapping.

  • Have a clear device usage policy for what data can be handled on certain devices
  • Enforce cellular contracts for company-owned devices that prohibit account migration without your organization’s approval
  • Implement mandatory maintenance sessions for company-owned devices
  • Use authenticator applications that generate one-time passcodes for MFA rather than verification measures connected to the phone number (for example, text message and phone call)
  • Deploy hardware security keys to secure and authenticate highly sensitive accounts if necessary
  • Classify and label data according to sensitivity levels and clearly establish how data belonging to each level should be handled
  • Offer cyber security training

Learn more

]]>https://cyber.gc.ca/en/geekweek/geekweek-11<![CDATA[GeekWeek 11]]>2026-02-13T13:56:36Z

geekweek banner

Detection and Deception

GeekWeek provides an opportunity for participants to take few days away from their day-to-day and work with public sector, industry, critical infrastructure and international partners to explore innovative ideas in the cyber security space.

Venue

Photo of Vanier Facility

Canadian Centre for Cyber Security
1625 Vanier Parkway, Ottawa
ON K1L 7P1

Event date

May 27 to June 5, 2026

If you’re interested in future Geek events, reach out to contact@cyber.gc.ca.

 

Registration information

Given the technical nature of the workshop, GeekWeek is an invitation-only event.

Keynote speaker

To be confirmed.

Participating organizations

To be confirmed.

Topics and themes

The following topics and themes have been proposed for GeekWeek 11.

  • Cyber physical systems
    • Industrial spectrum monitoring
    • Industrial control systems and operational technology security for energy
    • Early warning threat sharing for industrial control systems and operational technology security environments
    • Connected vehicules
    • Hunting the hunters
    • Firmware security
  • Cyber toolboxes and analytical environments
    • Memory analysis
    • Industrial control systems honeypot
    • Home modems and routers protection
    • Internet scanner
    • Digital Forensics and Incident Response in Cybersecurity
  • Cyber threat hunting
    • Detecting and decoding advanced persistent threat (APT) malware
    • Malicious infrastructure and threat hunting
    • Cross-organization data harvesting and analytics
    • It’s all about money
  • Cyber threat analytics
    • Cyber security posture
    • Cyber threat storytelling (a.k.a it’s all about graphs!)
    • Using large language models for malware analysis
    • Malicious email identification and triage enhancement with large language models (LLMs)
    • Cyber news aggregation and summarization with large language models
    • Automated signature generation
    • AI-powered fraud prevention for Canadians
    • Monitoring, analytics and scaling security in the cloud
  • Open-source solutions: Giving back to the cyber security community
    • Cyber range development
    • Cyber tools development: Borealis/Clue, Chameleon/Beever, Howler
  • Cyber defence turnkey solutions
    • Cyber defense Fly-Away kit
    • Secure operations centre (SOC) in a box
      • Platform
      • Pipeline for data collection
      • Analytics
      • Machine learning-based analytics

For more general information about GeekWeek, visit the GeekWeek page.

]]>https://cyber.gc.ca/en/guidance/cyber-threat-marine-transportation<![CDATA[The cyber threat to marine transportation]]>2026-02-12T15:03:18Z

Table of contents

Audience

This report is part of a series of cyber threat assessments focused on Canada’s critical infrastructure. It is intended for leaders in the marine transportation sector, cyber security professionals with maritime infrastructure to protect, and the general reader with an interest in the cyber security of critical infrastructure. For additional information on technical mitigation of these threats, consult the Canadian Centre for Cyber Security’s (Cyber Centre) guidance or contact the Cyber Centre.

Contact

For follow-up questions or issues, contact the Cyber Centre by email at contact@cyber.gc.ca.

Assessment base and methodology

The key judgements in this assessment rely on reporting from multiple sources, both classified and unclassified. The judgements are based on the knowledge and expertise in cyber security of the Cyber Centre. Defending the Government of Canada’s information systems provides the Cyber Centre with a unique perspective to observe trends in the cyber threat environment, which also informs our assessments. The Communications Security Establishment Canada’s foreign intelligence mandate provides us with valuable insight into adversary behaviour in cyberspace. While we must always protect classified sources and methods, we provide the reader with as much justification as possible for our judgements.

Our judgements are based on an analytical process that includes evaluating the quality of available information, exploring alternative explanations, mitigating biases and using probabilistic language. We use terms such as “we assess” or “we judge” to convey an analytic assessment. We use qualifiers such as “possibly,” “likely,” and “very likely” to convey probability.

The assessments and analysis are based on information available as of August 31, 2024.

Estimative language

The chart below matches estimative language with appropriate percentages. these percentages are not derived via statistical analysis, but are based on logic, available information, prior judgements, and methods that increase the accuracy of estimates.

Long description immediately follows
Long description - Estimative language chart
  • 1 to 9% Almost no chance
  • 10 to 24% Very unlikely/very improbable
  • 25 to 39% Unlikely/improbable
  • 40 to 59% Roughly even chance
  • 60 to 74% Likely/probably
  • 75 to 89% Very likely/very probable
  • 90 to 99% Almost certainly

Key judgements

  • We assess that financially motivated cybercriminals are the most likely cyber threat to affect the marine transportation sector. We assess that cybercriminals will almost certainly continue to exploit marine transportation and supporting organizations through extortion tied to ransomware, in addition to selling or exploiting stolen personal or proprietary business information. We assess that ransomware is almost certainly the most likely disruptive cyber threat to affect marine transportation operations.
  • The marine transportation sector’s importance to Canada’s economic and strategic supply chains makes it a high priority target for state-sponsored cyber threat activity. We assess that state-sponsored cyber threat actors will very likely continue targeting the Canadian marine transportation sector and supporting organizations to steal logistical and operational data that can be leveraged for economic advantage, and to steal intellectual property that can be used to support state commercial, military, and intelligence priorities.
  • We assess that the marine transportation sector is a strategic target for disruption or destruction by state-sponsored cyber threat actors. However, we judge that these actors would likely only intentionally disrupt or damage Canadian marine transportation infrastructure in times of crisis or conflict between states.
  • We assess that non-state cyber threat actors will very likely continue targeting the Canadian marine transportation sector in connection to international events and conflicts, primarily though distributed denial-of-service (DDoS) attacks and website defacements.

Introduction

The marine transportation sector (MTS) plays a pivotal role in Canada’s economy by supporting the movement of goods and travelers to and from domestic and international markets. Marine transportation and its supporting activities contributed over $8.3 billion to Canada’s gross domestic product in 2022 and accounted for 24% of Canadian merchandise imports and 18% of Canadian merchandise exports in 2023.Footnote 1 Marine transportation is a key method of connection for communities and industries across Canada’s expansive geography and is the sole option for resupply in some northern communities.Footnote 2 The MTS’s importance to Canada makes the cyber security of Canadian ports, vessels, supporting infrastructure, and the organizations that operate them a matter of critical importance for Canada’s national and economic security.

Cyber threat activity against the MTS can have significant consequences. Cyber-enabled fraud and scams are costly for victims,Footnote 3 and disruptive cyber threat activity such as ransomware can interfere with marine transportation operations, implicating safety and causing costly disruptions to supply chains. For example, in 2017, the NotPetya wiper malware affected organizations worldwide, including global shipping company A.P. Møller-Maersk.Footnote 4 Maersk was forced to entirely rebuild the affected computer systems and experienced global operational interruptions. Maersk experienced an estimated $250 to $300 million USD in damages, and unknown additional damages on the part of Maersk customers stemming from supply chain interruptions and shipping delays.Footnote 5

Top of page 

Digitalization is expanding the sector threat surface

The MTS is digitalizing its operations to improve efficiency and address environmental challenges such as decarbonization. Digitalization refers to the incorporation of data-informed decision making, connected technology, and automation throughout the scope of marine transportation operations. Digitalization is supported by the wide deployment of sensors that collect operational and environmental data—for example, smart buoys, video-based container recognition systems, and shipboard sensors—that provide enhanced situational awareness and allow for centralized management over marine transportation operations.Footnote 6 It also involves the adoption of digitally transformed operational technology (OT) and industrial systems within ports and on vessels, such as ship-to-shore cranes and physical access control systems.

Digitalization is expanding the MTS’s threat surface. Increased adoption of connected OT systems provides cyber threat actors more opportunities to exploit those systems to disrupt their functioning, or to use them to gain access to business or OT networks. New methods of connection such as very short aperture terminal satellite Internet connections extend the reach of cyber threat actors to vessels and OT systems even in remote areas. Further, the growing volume of operational and environmental data being collected and shared within and across organizations, and the systems supporting that growth, are valuable targets for commercial or strategic espionage and potential targets for disruption.

Position, navigation and timing systems are vulnerable to interference

The MTS relies on the integrity and availability of various position, navigation and timing (PNT) systems, including the Automatic Identification System (AIS) and the Global Positioning System (GPS). Accurate PNT information is critical for safe vessel navigation and is essential for new technologies such as autonomous vessels and smart port systems. AIS and GPS signals are vulnerable to interference because they typically lack encryption or any mechanism for validating the content or originator of a signal.

Interference with PNT systems falls into 2 categories:

  • Signal jamming is a form of denial-of-service attack that prevents a target system from receiving an intended communication by overwhelming the receiver using a malicious signal, making PNT information inaccessible to the victim.
  • Signal spoofing is a form of data manipulation that deceives a target system into accepting a malicious signal rather than the intended communication. This can result in incorrect location information being provided to a user, which may cause them to adjust course and potentially navigate into dangerous areas.

There has been an increase in the number of reported PNT interference incidents affecting civilian marine and air transportation in the past several years. Some reported incidents are likely incidental effects of military electronic warfare measures near conflict areas, including around Ukraine. However, PNT interference may also be used to hide criminal maritime activities or support state geopolitical objectives.Footnote 7 For example, in July 2019, the British-flagged Stena Impero was seized by Iran in the Strait of Hormuz for violating Iranian territorial waters. Analysis by security researchers suggests that the Stena Impero may have diverted course into Iranian territorial waters because they were provided spoofed positional information through AIS, possibly to justify seizure of the vessel by Iran.Footnote 8

As the MTS continues to digitalize, the associated threat surface from proprietary information and data being shared with third-party service providers expands.

We assess that medium and high-sophistication threat actors will very likely attempt to exploit third parties to steal sector information, or to gain access to organizations within the sector by exploiting the digital supply chain.

Arrangements where suppliers have remote access to organizational networks, or where they provide a product with consistent data exchange between organizations, increase the opportunities for supplier-based compromise by cyber threat actors.Footnote 9 This may include organizations that provide information technology services such as cloud or managed service providers, software-as-a-service providers, and suppliers for digitally transformed technology.

Top of page 

The threat from cybercriminals

We assess that financially motivated cybercriminals are the most likely cyber threat to affect the MTS. We assess that cybercriminals will almost certainly continue to exploit marine transportation and supporting organizations through extortion tied to ransomware, in addition to selling or exploiting stolen personal or proprietary business information.

The MTS is an attractive target for extortion by cybercriminals because of the economic importance of supply chains and the dependence of its clients on the continuity of shipping operations. Some cybercriminals specifically target organizations such as ports or shipping companies that may be willing to pay large ransoms to recover from disruptions as quickly as possible. However, most cybercriminal activity opportunistically targets organizations regardless of their size by exploiting vulnerable Internet-exposed devices or through bulk phishing or password spraying campaigns.Footnote 10

Top 10 ransomware threats to Canada in 2024 by rank

  1. AKIRA
    Ransomware-as-a-service: Yes

  2. PLAY
    Ransomware-as-a-service: Yes

  3. MEDUSA
    Ransomware-as-a-service: Yes

  4. LOCKBIT
    Ransomware-as-a-service: Yes

  5. BLACK BASTA
    Ransomware-as-a-service: Yes

  6. RANSOMHUB
    Ransomware-as-a-service: Yes

  7. CACTUS
    Ransomware-as-a-service: Unknown

  8. CL0P
    Ransomware-as-a-service: No

  9. HUNTERS INTERNATIONAL
    Ransomware-as-a-service: Yes

  10. QILIN
    Ransomware-as-a-service: Yes

Cybercriminals are continuously evolving their tactics to increase their ability to extract profit from victim organizations. Illicit marketplaces for cybercrime tools and services reduce the barrier to entry for cybercriminal activity, and the proliferation of prebuilt cyber tools such as ransomware-as-a-service (RaaS) variants increases the impact even low sophistication cybercriminals can have on their victims.Footnote 10 In the RaaS model, a cybercrime group maintains their own version of ransomware and leases it to other cybercriminals in exchange for a portion of ransom payments they receive. In the January to March 2024 period, 8 of the top 10 most impactful ransomware variants by number and severity of incidents were assessed as being RaaS.Footnote 10

Ransomware is the most likely disruptive threat to marine transportation

We assess that ransomware is almost certainly the most likely disruptive cyber threat to affect the MTS.

Ransomware attacks can cause operational disruptions by preventing access to business systems and information, disrupting operational communications within or between organizations, or by preventing operators from accessing or safely operating industrial systems. Although the primary means of extortion against ransomware victims is data or device encryption, cybercriminals frequently use other methods to pressure victims into providing a ransom payment. This includes exfiltrating sensitive files and data prior to deploying the ransomware and threatening to sell the stolen information if payment is not received.Footnote 11

There are several recent examples of ransomware attacks disrupting marine transportation operations. In July 2023, a ransomware attack against the Japanese Port of Nagoya caused the port to entirely stop its container operations for several days.Footnote 12 The Nagoya Harbor Transportation Association disclosed that the attack was conducted with LockBit 3.0, one of the most widely deployed RaaS variants.Footnote 13

Cybercriminals have also targeted organizations that provide managed services and software for clients across the MTS and disrupted the availability of those services. In January 2023, a ransomware attack forced a Norwegian maritime software provider to shut down servers used by their ship management product.Footnote 14 The outage affected 70 of the organization’s clients and approximately 1,000 vessels, with clients only able to access the software’s offline functionalities.Footnote 15 We assess that cybercriminals will very likely continue targeting organizations that provide services to large numbers of clients within the MTS to maximize the effects of their activity and to increase pressure on victims to provide ransom payment.

Significant ransomware attacks against the marine transportation sector

  • In July 2021, a ransomware attack against a South African logistics company disrupted operations at container terminals in Durban, Ngqura, Port Elizabeth, and Cape Town. The Durban Port alone accounts for approximately 60% of all South African container traffic and was reduced to 10% of its operational capacity for almost a week.Footnote 16
  • In January 2022, a ransomware attack against European oil and gas organizations resulted in disruptions to port-based oil storage and transportation infrastructure, disrupting oil and gas supply chains.Footnote 17
  • In March 2023, a ransomware attack against a Dutch shipping company resulted in data related to business contracts and employee personal information being stolen.Footnote 18
  • In April 2023, a ransomware attack against a United States (U.S.) shipbuilding company Fincantieri Marinette Marine resulted in short-term production delays and the unauthorized disclosure of personal information for over 16,000 individuals.Footnote 19

Data theft supports additional cybercriminal activity

In addition to directly defrauding or extorting victims, cybercriminals benefit from stealing and exploiting stolen organizational data to conduct further threat activity against the victim organization, its business partners, and employees. For example, stolen information related to organizational devices and networks can be used to plan additional compromises, and information on an organization’s business plans and activities can be used to craft convincing lures for phishing emails against clients and employees. Stolen information may also be sold through dark web forums to other cybercriminals, competitor organizations, or state-sponsored cyber threat actors. In a limited number of cases, cybercriminals have used network access and stolen information to facilitate physical criminal operations such as cargo theft and smuggling.Footnote 20

Top of page 

The threat from state-sponsored cyber actors

The MTS’s importance to Canada’s economic and strategic supply chains makes it a high-priority target for state-sponsored cyber threat activity.

State-sponsored cyber threat actors are capable of highly sophisticated threat activity that is difficult to detect and attribute and may maintain persistence within compromised environments for years before being detected.Footnote 21 State-sponsored threat actors, including from the People’s Republic of China (PRC), Russia, and Iran, have consistently targeted the MTS for espionage, to intimidate or project power against adversaries, and to disrupt adversary commercial and military supply chains.

Espionage for commercial and strategic advantage

We assess that state-sponsored cyber threat actors will very likely continue targeting the Canadian MTS and supporting organizations to steal logistical and operational data that can be leveraged for economic advantage, and to steal intellectual property that can be used to support state commercial, military, and intelligence priorities.

Foreign states can exploit stolen logistical and operational information from the MTS, including data on the movement of goods and people, business development plans, and other forms of proprietary information. This information may provide foreign industry competitive advantage or leveraged for economic or diplomatic advantage over Canada in bilateral relations such as trade negotiations.Footnote 22 Likely targets for state-sponsored commercial espionage include port authorities, port terminal operators, shipping lines, regulators, and organizations involved in the sharing, storage, or analysis of marine transportation data.

Stolen intellectual property and research information from Canada’s robust ship building, marine research, and innovation base can be directly leveraged by foreign states to improve the efficiency and competitiveness of foreign industry or sold to third parties to co-opt the financial gain Canadian organizations would have realized through commercializing their intellectual property. State-sponsored actors have demonstrated a particular interest in intellectual property and research information with a dual-use military application or that would otherwise support foreign state interests, even if the intent of the research is not explicitly military in nature. This may include, for example, research related to the use of drones in marine operations, improving the ability for vessels to operate in arctic conditions, or measuring and predicting environmental changes in the Arctic. Likely targets for state-sponsored espionage targeting intellectual property includes ship builders, research and innovation hubs, and university researchers.

Examples of state-sponsored activity against the marine transportation sector

  • In January and February 2018, PRC threat actors stole data from an organization contracted by the U.S. Navy related to submarines and undersea warfare.Footnote 23
  • In March 2019, security researchers reported that PRC state-sponsored threat actors targeted over 20 universities worldwide attempting to steal maritime research with military application.Footnote 24
  • In March 2023, security researchers attributed malware found in several European commercial cargo shipping companies to PRC advanced persistent threat group Mustang Panda.Footnote 25
Top of page 

Pre-positioning disruptive or destructive cyber capabilities

We assess that the MTS is a strategic target for disruption or destruction by state-sponsored cyber threat actors.Footnote 26

However, we judge that these actors would likely only intentionally disrupt or damage Canadian marine transportation infrastructure in times of crisis and conflict between states. Disruptive or destructive cyber threat activity against the MTS by state-sponsored actors may be used to intimidate and demoralize the public, to disrupt economic and strategic supply chains, or to damage or destroy marine transportation infrastructure. State-sponsored actors pre-position for this activity by identifying and gaining access to Internet-connected OT systems, or IT networks from which they can laterally move to OT systems. Once in the target network, they collect information on assets within the network to identify opportunities for disruptive or destructive action. Likely targets for state-sponsored pre-positioning and disruption include connected OT and infrastructure at major Canadian ports and supply chain bottlenecks, especially those that may be involved in military mobilization.Footnote 27

We assess that state-sponsored cyber threat actors are almost certainly improving their capacity to disrupt or destroy adversary critical infrastructure through active reconnaissance including network intrusion, developing disruptive tools and techniques, and maintaining access against targets and systems of interest.

On February 7, 2024, the Cyber Centre and international partners released a joint advisory about PRC Volt Typhoon state-sponsored cyber threat actors compromising and maintaining access to U.S. critical infrastructure, including within the MTS.Footnote 28 The advisory assesses with high confidence that Volt Typhoon activity has aimed to pre-position cyber capabilities to “enable the disruption of OT functions across multiple critical infrastructure sectors” in the event of conflict. Volt Typhoon activity has been noted by private sector partners as early as May 2023, targeting sectors including manufacturing, government, and marine transportation. Footnote 29

We assess that the direct threat to Canada’s critical infrastructure from PRC state-sponsored threat actors is likely lower than that to U.S. infrastructure. However, given the integration of the Canadian and U.S. economies, malicious activity targeting U.S. infrastructure would likely also affect Canada. For example, disruptions to U.S. ports may result in shipments being diverted to Canadian ports, straining capacity and risking supply chain disruptions.

Foreign ownership

We assess that state-sponsored cyber threat actors are likely to attempt to exploit foreign ownership connections to steal organizational data or attempt to gain network access to Canadian marine transportation organizations.

Some states, including the PRC and Russia, can legally compel their industries to cooperate with state intelligence services.Footnote 30 This creates a threat that some foreign-owned digital service providers could be leveraged to access Canadian customers’ data, to access customer networks, or to deny service to customers to disrupt their operations.Footnote 31

Top of page 

The threat from non-state cyber threat actors

We assess that non-state cyber threat actors will very likely continue targeting the Canadian MTS in connection to international events and conflicts, primarily though DDoS attacks and website defacements.

Ideologically motivated non-state actors, sometimes referred to as hacktivists, have become an increasingly common feature of the cyber threat environment. In 2023, pro-Russia non-state (PRNS) actors were responsible for 2 wide-spread DDoS attack campaigns against Canada intended to undermine Canadian support for Ukraine. These DDoS attacks primarily affected the public facing websites of government and private organizations across the country, including within the MTS and affecting several Canadian ports.Footnote 32 However, DDoS attacks by PRNS actors in September 2023 had additional disruptive effects to airports where check-in kiosks lost connectivity and caused delays. Footnote 33

Distributed denial-of-service attack primer

Volume-based DDoS attacks disrupt access to a target system, often a public website, by flooding the server with requests to the point where it is unable to respond. Volume-based DDoS attacks frequently rely on multiple attacker-controlled systems, often by using botnets, to provide sufficient traffic volumes to degrade the target system.

Slow DDoS attacks use fewer, more complex requests to occupy a server’s resources and prevent legitimate users from accessing it. Slow DDoS attack traffic can be difficult to distinguish from legitimate traffic, making it difficult to detect and mitigate.

Internet Protocol (IP) address range DDoS attacks target the full IP range of a target organization rather than being aimed towards a single server. By targeting the IP range, attackers can affect any of the target’s Internet-facing devices, including gateway devices, public facing web applications, and Internet-based interfaces for OT systems.

Some non-state actors have attempted to maximize the disruptive impact of their DDoS attacks by targeting Internet-exposed IT infrastructure. This activity increases the risk that DDoS attacks will inadvertently affect other Internet-exposed systems and services, including edge devices, web-based applications such as Port Information Management Systems, and Internet-facing interfaces for connected industrial systems.

In May 2024, the Cyber Centre and partners issued a joint advisory warning of PRNS actors targeting Internet-exposed industrial systems. These actors opportunistically identify targets using publicly available scanning tools to search for Internet-exposed systems with vulnerable configurations. For example, they may look for systems that use default or weak passwords and without multi-factor authentication.Footnote 34

We assess that non-state threat actors are very likely to continue developing their capacity to disrupt Internet-exposed industrial systems, and likely that they will attempt to disrupt Internet-exposed industrial systems within Canada.

It is important to note that non-state cyber threat actors may not have the expertise to correctly identify or understand the system they have compromised, may exaggerate claims of disruptive effects, and may entirely fabricate claims that they have compromised or disrupted Internet-exposed OT. False or exaggerated claims can serve to build the reputation of the groups involved and may still have a disruptive effect by causing fear and degrading trust in the system.

Top of page 

Outlook

The cyber security of Canada’s MTS is critical for Canada’s national and economic security. The MTS’s economic and strategic importance to Canada also makes it a compelling target for cyber threat actors with financial, ideological, or disruptive intent. As the sector continues to digitalize its operations and its threat surface grows, cyber threat actors will have additional opportunities to compromise marine transportation organizations and new ways in which to maximize the disruptive or destructive impact of their activities. This threat is compounded by the sectors already complex and interconnected nature, which creates risk that disruptions to key organizations or systems within the MTS will widely affect the safety and continuity of marine transportation operations.

Many cyber threats can be mitigated through awareness and best practices in cyber security and business continuity. The Cyber Centre encourages all critical infrastructure network owners to take appropriate measures to protect your systems against the cyber threats detailed in this assessment.

Please refer to the following online resources for more information and for useful advice and guidance.

General cyber threat information

Digitalization and connected OT

Supply chain and supplier-based threat

Cybercrime

State-sponsored cyber threats

DDoS attacks

Top of page 
 
Top of page
]]>https://cyber.gc.ca/en/guidance/cyber-incident-reporting-guidelines-key-information-sharing-requirements-itsm00140<![CDATA[Cyber incident reporting guidelines: Key information sharing requirements – ITSM.00.140]]>2026-01-29T14:32:45Z

Alternate format: Cyber incident reporting guidelines: Key information sharing requirements – ITSM.00.140 (PDF, 506 KB)

Foreword

This is an UNCLASSIFIED publication issued under the authority of the Head, Canadian Centre for Cyber Security (Cyber Centre). For more information, please email or phone our Contact Centre:

email contact@cyber.gc.ca |Mobile 613-949-7048 or 1‑833‑CYBER‑88

Effective date

This publication takes effect on January 29, 2026.

Revision history

  1. First release: January 29, 2026

Overview

Organizing and sharing information during a cyber incident involves a structured approach that ensures the effective communication of relevant details to the Canadian Centre for Cyber Security (Cyber Centre). The purpose of this publication is to clarify the types of information the Cyber Centre considers “actionable.”

Table of contents

List of annexes

Introduction

For participating entities, this publication should be shared and circulated internally for consultation and pre-approval from your executive team, including legal and operational teams. You should also share this publication with managed security service providers and ensure cross-organizational support for the approach and pre-approval of the type of information to be shared.

In advance of a cyber incident, your organization should decide whether you can and will share these types of information to:

  • best inform next steps
  • assist in network rebuild and recovery
  • benefit the resilience of the broader cyber ecosystem. For more details, please read Annex A: Pre-cyber incidents.

In addition, information sharing serves as a centralized resource for gathering data on cyber threats and vulnerabilities. We recommend that your organization disseminate information amongst the members of your sector. The goal is to enable collaborative efforts to secure critical infrastructure (CI) and protect against cyber threats. The recommended aspects of intra-community information sharing are described in Annex B: Recommended information sharing.

 
Top of page 

Information sharing during a cyber incident

During a cyber security incident, the participating entity could disclose artifacts to the Cyber Centre that would be used to investigate and provide clarity and enrichment to the nature of the compromise. This includes contextual information and technical artifacts.

Contextual information

This category includes evidence that provides context to the incident, which assists your organization in understanding the circumstances and implications of the compromise. Contextual information typically consists of user activity anomalies, communications (for example, email) and content. This information helps to provide comprehensive reporting, inform on attribution, and validate the malicious behavior.

This might include the following information:

  • summary of the observed activity or incident
  • information that would provide clarity regarding the form of threat (if known), such as the
    • malware or denial of service
    • actor involved
    • motivation
    • vector and impact
  • how the attacker gained access (whether through phishing, exploiting vulnerabilities or other means)
  • timeline of events leading up to, during and after the incident
  • scope of the incident, including the type of systems affected and the data that was compromised, including
    • what operations are impacted
    • what disruptions have resulted from this compromise, including to third-party software
  • observed network traffic details (if available)
  • list of mitigations taken, if any, by the incident handlers
  • current status of the incident
  • list of indicators of compromise (IOCs) gathered during the investigation
  • next steps to be taken
  • contact information

Technical artifacts

This category includes all data related to the technical aspects of the incident.

Table 1: Required actionable information and data artifacts details the specific types of actionable information and data artifacts that the Cyber Centre requires from your organization in the event of a cyber security incident. Additionally, the table highlights the analytical process the Cyber Centre takes to analyze the artifacts and the expected outcomes that stem from the analysis.

It is important to note that:

  • Internet Protocol (IP) addresses and domains supplied as IoCs are presumed not to be owned by the organization, and that the artifacts shared with the Cyber Centre do not contain any information pertaining to Canadian individuals or persons located in Canada.
  • At no time will the Cyber Centre share raw or identifying victim data with any external entity
    • The Cyber Centre is bound by provisions in the Communications Security Establishment Act [1] and the Privacy Act [2] that govern our activities. CSE may also establish non-disclosure agreements (NDA) with critical infrastructure partners to protect confidential information during information sharing activities.
 
Table 1: Required actionable information and data artifacts
Technical artifacts Internal analytics process Expected outcomes
Suspicious/malicious IPs
  • Cross-reference malicious IP with the Cyber Centre’s knowledge base to validate and provide insights, including but not limited to classified indicators
  • Confirm maliciousness

  • Share with participating entity and the CI community for action

  • Share any additional indicators when applicable
Suspicious/malicious domains
  • Cross-reference malicious domains with the Cyber Centre’s knowledge base including but not limited to classified indicators to validate and identify command and control (C2) infrastructure

  • Analyze the behaviour (redirection pattern, domain name system (DNS) queries) to gain insights into the types of malware being distributed through the phishing campaigns and the geographical spread of the threat
  • Confirm maliciousness

  • Share with participating entity and the CI community for action

  • Share with participating entity and the CI community for action
Suspicious/malicious file hashes
  • Cross-reference malicious file hashes with the Cyber Centre’s knowledge base including but not limited to classified indicators to validate and gather the source, behaviour and associated risks

  • Compare the hashes of files with those of known malware for detection and identification
  • Confirm maliciousness

  • Share with participating entity and the CI community for action

  • Share any additional indicators when applicable
Suspicious/malicious URLs
  • Cross-reference malicious URLs with the Cyber Centre’s knowledge base including but not limited to Classified indicators to validate and understand the methods used to host and distribute malware
  • Confirm maliciousness

  • Share with participating entity and the CI community for action

  • Share any additional indicators when applicable
Suspicious/malicious documents and files (malware samples)
  • Run detection heuristics to evaluate the level of maliciousness

  • Cross reference to reveal tactic, techniques, and procedures (TTPs), such as the type of malware used, its motives, or its functionality and how it evades detection
  • Confirm maliciousness

  • Reveal patterns, tactics, techniques and behaviours

  • Share hash value of malicious documents and files

  • Share with participating entity and the CI community for action, to update antivirus signatures, and to refine security policies
Security logs (event logs, system logs, access logs, Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) logs, network and firewall logs, endpoint detection and response (EDR) logs, DNS and virtual private network logs, database logs and mail server logs, etc.)
  • Analyze and apply use case and analytics that complement the commercial tooling and detect evidence of suspicious/malicious activities
  • Reveal patterns, tactics, techniques, and behaviours

  • Reveal malicious artifacts (IPs, domains, hashes, URLs, etc.)

  • Share with participating entity and the CI community for action
Forensic artifacts: Disk images, memory dumps, registry entries, system drives, etc.
  • Conduct forensic analysis to find evidence of compromise and reconstruct the timeline of events, to determine the extent of the access and exfiltration, the methods used to gain access and identity of the threat actor
  • Reveal patterns, tactics, techniques, and behaviours

  • Reveal malicious artifacts (IPs, domains, hashes, URLs, etc.)

  • Share with participating entity and the CI community for action
 
Top of page 

Annex A Pre-cyber incident

Before any confirmation that a cyber incident has occurred, the participant organization is encouraged to share information presented in the following sub-sections of this annex with the Cyber Centre. This information can:

  • identify gaps
  • calibrate the efficiency of the detection
  • increase the signal-to-noise ratio
  • lower false positives to avoid alert fatigue

Your organization should also share any other information that can be used to retrace a series of events.

Alert rules

Configuration and criteria are set within the organization’s security monitoring system, such as a security information and event management (SIEM) system or an IDS, used to trigger alerts for potential security incidents. This includes the triggers, their thresholds, filters and correlation rules such as:

  • excessive login failures
  • geographical irregularities
  • unusual outbound traffic
  • changes in file integrity

Consider implementing endpoint detection and response (EDR) or extended detection and response (XDR) system to assist in detecting and responding to anomalous system activity.

Security logs

Digital records that capture activities and events related to IT security, such as:

  • network devices (for example, firewalls, routers, and switches)
  • servers and workstations, security appliances (for example, IDS, IPS, and antivirus software)
  • applications (for example, database and web server logs)

Annex B Recommended information sharing

This annex includes the recommended information sharing best practices. By sharing various types of information, critical infrastructure community members can significantly enhance their collective cybersecurity posture, reduce the risk of cyber attacks, and respond more effectively to incidents.

Threat intelligence reports

Threat intelligence reports offer detailed analyses of specific threats, including the TTPs used by cyber adversaries. These reports can provide insights into the

  • nature of the threat
  • affected systems
  • mitigation strategies
  • recommended protective measures

Indicators of compromise

IoCs are specific artifacts or pieces of information used to detect cyber threats, such as:

  • malicious IP addresses
  • uniform resource locators (URLs)
  • file hashes
  • email signatures

Sharing IoCs helps members to quickly identify and respond to potential threats.

Best practices and security recommendations

Information on effective security measures, policies, and practices that organizations can implement to protect themselves from cyber threats. This includes configuration guidelines, security controls, and preventive strategies.

Vulnerability information and patches

Sharing details about newly discovered vulnerabilities, potential impacts, and available patches or workarounds. This helps organizations to address vulnerabilities promptly before they can be exploited by threat actors.

Incident reports

Summaries of security incidents experienced by members, including the nature of the incident, how it was detected, the actions taken, and lessons learned. Sharing incident reports can help others to better prepare for and respond to similar incidents.

Anonymous sharing mechanisms

Some members may prefer to share sensitive information anonymously to protect their privacy or for legal reasons. Consider providing mechanisms for anonymous sharing, ensuring that valuable information can still be disseminated without exposing the source.

Automated threat intelligence sharing platforms

Utilizing platforms like structured threat information expression (STIX) and trusted automated exchange of indicator information (TAXII) for the automated exchange of threat intelligence. These platforms facilitate real-time sharing of threat data in a standardized format, enabling faster detection and mitigation of threats.

Collaborative analysis and research

Joint efforts to analyze specific cyber threats or trends, leveraging the collective expertise and resources of the energy sector members. This collaborative approach can lead to a deeper understanding of complex threats and more effective countermeasures.

]]>https://cyber.gc.ca/en/guidance/spotting-malicious-email-messages-itsap00100<![CDATA[Spotting malicious email messages (ITSAP.00.100)]]>2026-01-28T18:26:13Z

Email is a convenient communication tool for individuals and organizations. It provides an easy way to exchange documents, images, links and various files. However, threat actors can use email for malicious purposes. They frequently target organizations and their networks to steal information. Threat actors are technologically savvy, conscious of vulnerability and aggressively agile. A successful intrusion can quickly lead to data and privacy breaches.

As an employee, you may have access to sensitive corporate information, which can make you a target. You should be wary of malicious emails, which threat actors use to infect devices and systems to access information. Knowing how to spot malicious emails and phishing attempts can help protect your organization's information and networks.

On this page

How threat actors use malicious emails

Threat actors use malicious emails to conduct a variety of malicious activities, including to:

  • steal your sign-in details or credentials
  • spread malware, including viruses, ransomware and spyware, to infect your device or spread to other devices on your network
  • steal your information, corrupt or damage your files

Phishing attacks

Phishing is the act of sending fraudulent communications that appear to be legitimate. Phishing emails often contain malicious attachments or links to malicious websites. Threat actors carry out phishing attacks to trick you into disclosing sensitive information, such as credit card numbers, social insurance numbers or banking credentials. Phishing attacks can take the form of emails, texts or phone calls, but this publication focuses on malicious emails.

Threat actors can be highly skilled at creating emails that look legitimate. These emails may contain company logos or trademark information. The subject lines are relevant, and the messages are pertinent. Given our desire to trust and the sheer number of emails we receive daily, it can be easy to believe the content we read in these emails, click on embedded links, or open attachments. However, the attachments may contain malicious software, and the links may direct you to malicious websites.

Some types of malware can scan your contacts and automatically send an infected message to everyone on your contact list. Even if an email comes from someone you know, you should always think twice before clicking links or opening attachments. Configuring your email to preview emails, access links and open attachments could inadvertently allow a threat actor to:

  • remotely access sensitive device information
  • execute malware
  • use your device as a foothold to access other network resources

Phishing emails come in various forms. Common methods include:

  • Spear-phishing: A threat actor sends emails to specific targets, such as an individual, a group or an organization. A spear-phishing email is crafted using the recipient's personal or professional characteristics and interests. Threat actors often use publicly available information from the individual's social media accounts. Spear-phishing emails require more effort from threat actors, but recipients are more likely to respond to the email, open attachments or click on links.
  • Whaling: A threat actor sends emails to high-profile individuals or senior executives. They create targeted and convincing emails by using personal information about the individual or the organization they work for. Threat actors may use publicly available information from the organization's website or social media accounts.
  • Quishing: A phishing attack using malicious "quick response" (QR) codes in emails that re-directs you to a malicious website when the QR code is scanned. Check the website URL to make sure it is the intended site.

Remember, no one is immune. Although anyone can be the target of phishing attacks, the following individuals are more commonly targeted:

  • senior executives and their assistants
  • helpdesk staff
  • system administrators
  • users who have access to sensitive information
  • users who have remote access
  • users whose jobs involve interacting with members of the public
Top of page
 

How to spot malicious emails

Threat actors will try to make malicious emails look legitimate. As such, it is important to know how to spot a potentially dangerous one.

Verify the sender's email address to confirm it matches the official address of the organization or individual they claim to be. Know how the organizations and businesses you interact with typically contact you and what type of information they may ask for. For example, a bank should never send links to online banking and ask you to login. You should always access your banking platform through its official app or website.

Malicious emails can be difficult to identify, but there are some clues that can help you:

  • an unfamiliar or misspelled name or email address of the sender
  • an invalid username or domain name in a sender's email address
  • altered or unprofessional company logos
  • generic or odd greetings
  • poor grammar or spelling
  • urgent tone and direction to act quickly
  • urgent messages about current "hot-button" issues related to personal or political causes, major domestic or international events or crises, or organizational challenges
  • unusual requests (for example, most companies do not ask for sensitive or personal information in an email or insist that you collect a package or pay an overdue invoice)

Keep in mind that malicious emails may not always contain telltale poor grammar or spelling, particularly if they were created using generative artificial intelligence (AI) tools.

Always be suspicious of unsolicited emails requesting personal or confidential data. Take proactive steps to verify their legitimacy before responding or supplying any information. If you receive an email requesting personal information, search for the organization's official website and contact them using the phone number provided. This way, you can confirm if the request is genuine.

How to protect against malicious emails

You can protect yourself and your organization from malicious emails by implementing the following best practices.

Handle suspicious emails with care

When in doubt, avoid opening suspicious emails and contact the sender by another means (for example, by phone) to confirm they contacted you.

Do not click on links, attachments or QR codes in emails

If you are being asked to log into an account for an unsolicited reason, do not click the link, do not open attached files and avoid scanning QR codes. Instead, visit the organization's website by manually entering the URL in your web browser or by searching through a search engine.

Report suspicious emails

If you receive a suspicious email or suspect malicious activity on a work device or a work account, report the incident to your organization's IT and security teams. Follow their instructions and do not forward the email to coworkers. You can also report phishing emails to the Cyber Centre or the Canadian Anti-Fraud Centre.

Use email filters to block malicious content and spam

Many email programs offer filtering capabilities that allow you to block certain addresses or only accept email from addresses in your contact list. Be careful who you share your email address with, and do not sign up for every mailing list and rewards program offered by retailers. Some businesses will sell your email address to third parties. You can create disposable or "dummy" email addresses to reduce spam. Many online email services also allow you to create email aliases that can be directed to a specific email folder instead of your main inbox.

Delete items in your junk folder

Many email platforms let you configure settings to automatically empty your junk folder after a set number of days. If you choose to do so, you should still check your junk folder so that you do not miss potentially important messages.

Set up client portals

If your organization requires clients to frequently provide information or documents, set up an online client portal to safely collect them This way, employees will not have to question every email attachment they receive.

Establish clear policies

Your organization should define clear policies on configuration settings and AI use to limit the risk of malicious email messages. These should include:

  • installing and properly configuring a firewall and anti-malware software
  • configuring a protective domain name system (DNS) on your devices, modems and routers
  • enabling a software allowed list and regularly updating all software
  • implementing quarantine functions in your organization's anti-malware software
  • using trusted and reputable AI detector tools to verify whether content is human or AI-generated
  • omitting sensitive information when using AI tools

Additional best practices

  • Use secure messaging portals instead of email for communicating your personal information
  • Use bookmarks or a search engine to access websites rather than clicking on links
  • Be suspicious of emails that are not addressed directly to you or do not use your correct name or salutation
  • Do not open attachments or links from an unknown sender or if they have strange file names or multiple file extensions
  • Configure your office suite to prevent macros from running without confirmation or to not run macros from email messages
  • Deactivate automatic downloads and execution of attachments and images
  • Configure your inbox to not load external images to mitigate the risk of tracking pixels (embedded codes in logos or images that can track your location and behaviour)
Top of page
 

How to handle malicious emails

If you receive an offensive, abusive or potentially criminal message, inform your local police. Save the message as authorities may ask you to provide a copy to help with any subsequent investigations. Do not send the message to anyone else.

If you accidently interact with a malicious email, remain calm and take the following actions:

  • Stop using your device
  • Disable Wi-Fi or disconnect network cables so the device cannot communicate with the Internet
  • Power off the device
  • Contact your IT security department if you are using a corporate device. They can disable accounts and other device features
  • Change your password, passphrase, or PIN using a different device
  • Scan the device using anti-malware software if possible
  • Restore network connections only when you believe you have a clean system
  • Perform any available updates and security patches on your device
  • Monitor your accounts regularly for suspicious activity

Learn more

Top of page
 
]]>https://cyber.gc.ca/en/guidance/ransomware-how-prevent-and-recover-itsap00099<![CDATA[Ransomware: How to prevent and recover (ITSAP.00.099)]]>2026-01-28T18:16:57Z

Ransomware is a type of malware that denies a victim access to a system or data until they pay a sum of money. When ransomware infects a device, it renders the system unusable or encrypts its storage, preventing access to the information and systems. Threat actors have evolved their tactics and often leverage data theft as the primary method of extortion.

Threat actors can exploit vulnerabilities and leverage many attack vectors to infect your network, systems, and devices with ransomware. Regardless of skill, this can be done by using malicious code and services purchased from the dark web. This is known as ransomware-as-a-service. Additionally, threat actors can use artificial intelligence tools to write effective ransomware. This automates the discovery of weak points in a network, bypassing defences, deploying malware and erasing evidence of the intrusion.

This publication provides tips to help your organization prepare for and recover from ransomware attacks.

On this page

How ransomware infects devices

Threat actors can use a compromised device to spread the ransomware to other connected systems and devices on the same network. Ransomware can infect devices when users:

  • open legitimate-looking but malicious attachments in messages
  • click on malicious links or attachments embedded in websites
  • open personalized and targeted content in phishing emails, texts and social media

Threat actors shape their malicious content by scouting social and professional contacts for information they can exfiltrate. They may also monitor communication habits before deploying the ransomware.

If a device is infected with ransomware, you will receive a ransom notice on your screen indicating your files have been encrypted and are inaccessible until the ransom is paid. Cybercriminals often request payment in the form of cryptocurrency because of the anonymity it provides. Cryptocurrency enables cybercriminals to move profits internationally, expanding their reach and complicating law enforcement efforts. Other ransom payment methods often include prepaid credit or gift cards. Threat actors typically give a deadline for paying the ransom, after which they may increase the ransom amount, destroy your files or leak your data.

Top of page
 

How to prepare your organization

There are several approaches you can take to better protect your networks, systems and devices. The following is a list of actions you can take to strengthen your cyber security.

Plan ahead

Developing an incident response plan for your organization is the cornerstone to your cyber defence strategy. An incident response plan helps you detect and respond to cyber security incidents. Your organization should consider major events that could cause an unplanned outage and require you to activate your incident response.

It should include a risk assessment, backup, recovery and communications plans. It should also designate roles for your employees and provide them with detailed instructions in the event of an incident. Your plan should be available offline in the event your systems are unavailable. Additionally, your organization should develop and frequently test a business continuity and disaster recovery plan.

Prepare for recovery

Once an incident has been contained or resolved, your organization should have a recovery plan in place, which should be tested by conducting simulations or walk-through exercises. The scenarios should test the effectiveness of your response and highlight areas for improvement.

Back up your data

Having reliable backups can significantly enhance your ability to recover from a ransomware attack. A backup is a copy of your data and systems that can be restored and provides access to your critical systems in the event of an incident. You should back up your data frequently to ensure it is as close to real time as possible. Create many security barriers between your production systems and your backups. Ensure your backups are encrypted and stored offline without connection to the Internet or local networks. If your backups are connected to your networks, threat actors can infect them, which will hinder your recovery efforts. Testing your backup process is also crucial to a quick and effective recovery.

Provide security awareness training for employees

Provide employees with tailored, continuous training on cyber security and device management. This will ensure they don't fall victim to malicious activities such as phishing emails and infected downloads. To learn more about cyber security event management training, consult the Cyber Centre Learning Hub. The Learning Hub offers a comprehensive event management course that can be tailored to your organization's business and information technology (IT) needs.

Consider cyber insurance

Research insurance providers and policy details to determine whether cyber insurance would benefit your organization. An insurance policy may add an additional layer of protection and provide your organization with incident response expertise in the event of a ransomware attack. However, you should make sure insurance policy documents are properly protected in both of your systems. If not, sophisticated ransomware actors could obtain sensitive information on coverage amounts and leverage it in ransom negotiations. Be aware that insurance companies may deny coverage if they deem that your organization did not have adequate cyber security measures in place.

Top of page
 

How to protect your organization

Ransomware is among the most common type of malware and can be one of the most damaging cyber attacks to your organization. Use the following guidance to protect your organization from ransomware attacks.

Enforce strong authentication methods

Activate phishing-resistant multi-factor authentication (MFA) and use strong and unique passphrases or passwords on all devices and for every account.

In addition to using MFA, you should encourage employees to use a password manager. Password managers can help users remember and secure passwords or passphrases. Your organization should also consider implementing password vaults for administrative accounts. Password vaults provide greater protection as the passwords or passphrases are cycled and synchronized with your systems.

Implement the principle of least privilege

Applying the principle of least privilege can help you manage and monitor user accounts and access. Provide employees with access to only the functions and privileges necessary to complete their tasks. One way to accomplish this is to implement role-based access control which maps users' access rights to their role within the organization.

Restrict administrative privileges

You should limit the number of administrative or privileged users for operating systems and applications. Users should never have privileged access on their desktop or laptop systems. Users with administrative privileges should have a separate administrative account with separate credentials, regardless of whether your organization has a cloud, on-premises or hybrid environment.

You should also create different levels of administrative accounts to limit the level of exposure if an administrative account is compromised. In addition, you should Implement required confirmation for any actions that need elevated permissions.

Managing and controlling administrative privileges (ITSAP.10.094)

Update and patch systems and devices

Check for updates and patches to improve usability and performance and repair known bugs and vulnerabilities in your software, firmware and operating systems. Threat actors can easily exploit unpatched or unsupported systems and devices.

How updates secure your device (ITSAP.10.096)

Deactivate macros

Ensure you deactivate macros as your default to reduce the risk of ransomware being spread through Microsoft Office attachments. Newer versions of Microsoft Office will deactivate macros from the Internet by default.

How to protect your organization from malicious macros (ITSAP.00.200)

Segment networks

Divide your network into several smaller components. This makes it more difficult for ransomware to spread across the entire network. Your organization should have an inventory of its essential business information that is classified and categorized based on its level of sensitivity or privacy impact. Segment and group infrastructure services that have the same information protection requirements or that must adhere to the same communications security policies.

Action no. 5 segment and separate information (ITSM.10.092)

Set up security tools

Install antimalware and antivirus software on your devices to detect malicious activity and secure your network with a firewall to protect connected devices. Consider installing domain name system (DNS) filtering on your mobile devices to block malicious websites and filter harmful content. The Canadian Internet Registration Authority offers a free protective DNS service, Canadian Shield, that prevents you from connecting to malicious websites that may infect your devices or steal personal information.

Implement Domain-based Message Authentication, Reporting and Conformance (DMARC), an email authentication and reporting protocol that helps protect your organization's domains from spoofing, phishing and other malicious activities.

Ensure users access your network using your virtual private network (VPN). A VPN creates a secure connection between 2 points and can be used to protect sensitive data while it is in transit.

Seek professional cyber security assistance

Engaging with a cyber security professional early on may allow you to recover your systems and data more quickly than relying on your internal IT staff when facing a cyber incident.

How to recover from a ransomware attack

Consider the following steps to help remove and reduce the spread of ransomware.

Isolate the devices immediately

Take your devices offline to stop the ransomware from spreading to other connected devices. We recommend you do not power down the device once it's isolated. This allows forensic evidence to be preserved.

Some ransomware strains are designed to stay dormant on a device and quietly spread to other network‑connected devices before encrypting files. In these cases, you may not be able to stop the ransomware from spreading.

Report the incident

Consider reporting cyber incidents to law enforcement, such as local police or the Canadian Anti-Fraud Centre, as well as to the Cyber Centre online through My Cyber Portal

If you are comfortable doing so, share your findings, including the tools, techniques and procedures used by the threat actor, with the Cyber Centre

Communicate the incident to the employees listed in your incident response plan and give them clear direction as to their roles and responsibilities to help manage the incident. This should already be defined within your recovery plan.

Change passphrases

Reset credentials including passphrases on all systems, devices and accounts. Threat actors often save this information for future attacks.

Identify the type of ransomware

Use the information in the ransom note (such as listed URLs) and the new file extensions your encrypted files inherited to research possible reoccurring attacks and identify the ransomware. This information will also be useful for law enforcement and/or your contracted managed security service if you have one.

If you locate a decryption tool online, or if law enforcement can provide you with one, proceed to remediation.

If there is no decryption tool available online for your strain of ransomware, sanitize your device and reinstall the operating system if law enforcement or a managed security service is not involved.

Remediate the point of entry

Before reconnecting your systems and devices to your network or the Internet, identify how the threat actor entered your environment. Once the vectors have been identified, you should apply appropriate security measures to prevent a repeat attack.

Restore from your backup

Store your backups offline to mitigate the chance of ransomware infecting your backup files.

Analyze/scan your backup files and ensure they are free of ransomware or any other malware.

Once you are confident, restore your systems and devices from your secure backup.

Update and patch

Apply any available updates to your devices, hardware and software. Patch your operating system and ensure all antivirus, antimalware and firewall software is up to date.

Review the incident and provide ongoing training

Review the incident with your employees.

You should also provide ongoing training that addresses preventative actions against ransomware attacks, such as learning how to identify suspicious emails and attachments.

Use common threat examples and past occurrences to keep up to date and prepared for the future.

Top of page
 

Risks of paying the ransom

The decision to pay a cyber threat actor to release your files or devices should not be taken lightly. Before you consider paying ransom, we recommend you contact your local police department to report the cybercrime. Paying the ransom will not guarantee access to your encrypted data or systems. Even if you pay, threat actors may still:

  • demand more money
  • continue to infect your devices and systems or those of other organizations
  • retarget your organization with a new attack
  • copy, leak or sell your data

Learn more

Consult the following guidance to learn more:

Top of page
 
]]>https://www.canada.ca/en/communications-security/news/2025/12/cyber-centre-releases-ransomware-threat-outlook-2025-to-2027.html<![CDATA[Cyber Centre releases Ransomware Threat Outlook 2025 to 2027]]>2026-01-28T16:06:55Z
]]>https://cyber.gc.ca/en/guidance/ransomware-playbook-itsm00099<![CDATA[Ransomware playbook (ITSM.00.099)]]>2026-01-28T16:05:00Z

Alternate format: Ransomware playbook (ITSM.00.099 - PDF, 1.29 MB)

Overview

Ransomware is a type of malware that denies a user’s access to a system or data until they pay a sum of money. It can have a devastating impact on organizations and individuals. Vital data and devices can be rendered inaccessible, leaving organizations unable to conduct business or serve clients.

We have seen an increased number of ransomware attacks affecting Canadian organizations and individuals. The Cyber Centre’s National Cyber Threat Assessment 2025-2026 (NCTA) specifically notes that ransomware is the top cybercrime threat facing Canada’s critical infrastructure. Ransomware directly disrupts critical infrastructure entities’ ability to deliver critical services, which can put the physical and emotional wellbeing of victims in jeopardy. In the next 2 years, threat actors carrying out ransomware attacks will remain a significant threat to Canada.

Threat actors have adjusted their tactics to include coercing victim organizations to pay a ransom by threatening to release stolen data or authentication credentials to publicly embarrass the organization. The NCTA notes that threat actors will very likely continue leveraging advancements in areas like artificial intelligence (AI) and cryptocurrency while developing new extortion tactics to increase their financial reward. Ransomware incidents have become more sophisticated, targeted and complex. It is increasingly difficult for organizations to defend against and recover from these attacks, especially if an organization has limited cyber security resources.

Threat actors have also become more covert in their operations. They start by gaining access to an organization’s communications systems to identify critical systems and high-value data that could cause reputational damage if leaked to the public. Threat actors then deploy the ransomware to the datasets and systems of highest importance or value, compromising the organization. In addition, threat actors actively monitor the organization’s communications and planned recovery actions to undermine response efforts and further infiltrate networks and connected devices.

The information provided in this publication is intended to inform organizations and help them reduce the risks of ransomware attacks, lessen the impact of these attacks, and take preventative actions. It can also help organizations to articulate business and security requirements and implement relevant policies and procedures related to cybercrime.

This publication introduces ransomware, threat actor motivations and gains, and measures to prevent these attacks and protect your organization. This publication is broken down into 3 sections:

  • Ransomware explained: In this section, we define ransomware and outline the common vectors used to infect networks and devices.
  • How to defend against cyber threats: In this section, we provide a list of preventative measures you can take to protect your organization and offer checklists for specific mitigation measures. When you apply these measures, you enhance your cyber hygiene and protection against cyber incidents and threat actors, including ransomware.
  • How to recover from ransomware incidents: This section includes guidance on immediate actions organizations can take when ransomware is discovered, recovery measures, and methods to evaluate the incident and enhance security measures. By following the recommendations in this section, organizations can better respond to an incident and decrease the risk of your organization being a repeat victim of ransomware.

If you believe you are a victim of ransomware:

  1. Read the advice and guidance on how to recover in How to defend against cyber threats
  2. Report the ransomware incident:
    1. to your local police
    2. to the Canadian Anti-Fraud Centre
    3. to the Cyber Centre
  3. Once your recovery efforts are in place, read How to recover from ransomware incidents for advice on how to improve your cyber security environment

Table of contents

List of figures

 

Ransomware explained

Ransomware is a type of malware that denies a user’s access to files or systems until a sum of money is paid. Ransomware has evolved to also include incidents where data theft and extortion is used in place of encryption. Ransomware incidents can devastate your organization by disrupting your business processes and critical functions that depend on network and system connectivity. For more information on the evolving ransomware threat in Canada, read Ransomware threat outlook 2025-2027.

How ransomware works

When ransomware infects a device, it either locks the system or encrypts the storage, preventing access to the information and systems on your devices. Threat actors can also use your compromised network to spread the ransomware to other connected systems and devices.

The following actions can lead to ransomware infecting your networks and devices:

  • visiting unsafe, suspicious, or compromised websites
  • opening attachments or files from familiar or unfamiliar sources that have been infected
  • clicking on links in emails, social media and peer-to-peer networks
  • inserting an infected peripheral device (for example, a USB flash drive) into a different device
  • exposing your systems to the Internet unnecessarily or without robust security and maintenance measures, such as
    • not implementing intrusion detection and prevention systems (IDPS)
    • operating end-of-life or unpatched devices
    • not using multi-factor authentication (MFA)

If your organization falls victim to ransomware, users or administrators will receive a notification indicating that files have been encrypted and will be inaccessible until the ransom is paid. You may also receive a message on your lock screen indicating that your device is locked and inaccessible until the ransom is paid. The message will instruct you to pay a ransom to unlock the device and retrieve the files.

Cybercriminals often request payment in the form of cryptocurrency because it can be difficult to trace the transfer. The Financial Transactions and Reports Analysis Centre of Canada stated in 2023 that the most prevalent form of money laundering involving virtual currencies is the movement of proceeds derived from fraud and ransomware attacks. You could also be asked to pay with prepaid credit cards or gift cards. Threat actors will give you a time limit to pay the ransom, after which they may increase the ransom amount, destroy your files permanently or leak your data. More sophisticated tactics may include double extortion. A threat actor not only encrypts a victim’s data but also steals it before encryption. This means the victim faces 2 threats: having to pay to decrypt their data and pay again to prevent public release of the stolen data.

The National Cyber Threat Assessment (NCTA) 2025-2026 states that threat actors are constantly evolving their strategies and adapting their techniques to maximize profits and evade law enforcement detection. These financial incentives combined with the flexibility of the ransomware-as-a-service (RaaS) model have almost certainly bolstered threat actors’ resiliency in the face of law enforcement disruptions.

Ransomware attacks have become more sophisticated and often employ a combination of attack vectors. These may include sending a phishing email to your organization or conducting attacks on authentication, which is when the threat actor uses login attempts or password guessing to access your systems.

Ransomware can also spread to the systems and networks of other organizations connected by supply chains. For example, an organization that provides services to clients via interconnected networks and client management systems could be targeted by ransomware. The threat actor could then use the interconnected networks or client management systems to infect other organizations within the supply chain with ransomware. These organizations would then be locked out of their systems, disrupting their operations.

The new generation of artificial intelligence (AI), agentic AI, introduces a transformative risk to cyber security by enabling ransomware operations that are:

  • autonomous: AI agents are no longer reliant on human intervention and can act independently throughout the attack lifecycle
  • efficient: activities like reconnaissance, exploitation, encryption, which once took days or weeks, can now be compressed into minutes
  • adaptive: these agents can assess their environment, select optimal tactics, evade detection and recover from failed attempts dynamically
  • covert: AI with capabilities to erase traces and obfuscate behaviour make forensic investigations much more difficult
Top of page
 

In practice, agentic AI can discover weak points in a network, bypass defences, deploy malware and erase evidence of the intrusion, all in a single AI-managed activity stream. However, just as agentic AI poses a new challenge for cyber security, it also offers potential defensive benefits. Security teams could deploy autonomous AI agents to monitor networks, detect anomalies or even create decoy systems that mislead attackers. They can detect early indicators of intrusion, such as sudden file encryption, unauthorized access attempts, or abnormal lateral movement within systems. Unlike traditional monitoring tools, agentic AI doesn’t rely solely on known signatures; it uses behavioural analysis and anomaly detection to identify novel or stealthy threats that might otherwise go unnoticed.

When a ransomware threat is detected, agentic AI can autonomously initiate a rapid incident response. This may include isolating infected endpoints from the network, terminating malicious processes, restoring files from secure backups and notifying human security teams. These actions, which typically take minutes or hours when performed manually, can be executed in seconds, significantly reducing the impact of an attack.

It is crucial to carefully assess the risks and establish appropriate oversight when integrating AI into an organization’s ransomware detection and mitigation chain. Consider the following safeguards:

  • Data categorization: Categorize data at every stage (training, validation, inference and monitoring) to evaluate risk factors related to privacy, security, robustness and ethical considerations.
  • Beyond standard software assurance: Assess input data quality, model use cases, and system dependencies. Map AI-vetting procedures to the Cyber Centre’s IT security risk management: A lifecycle approach (ITSG-33) security controls, tailored to your organization’s risk profile.
  • Continuous monitoring: Employ automated tools for anomaly detection, output drift and system telemetry. Closely monitor for unauthorized model updates or unexpected behavioural changes. Robust auditing, logging and incident response mechanisms must be established for accountability and forensic analysis.
  • Guardrails and controls: Implement technical guardrails for data inputs/outputs, application programming interfaces (APIs) and, where applicable, enforce Model-Context-Protocol (MCP) standards. Guardrails should account for the model’s multilingual functionalities and prevent misuse in both human and computer languages.
  • Human-in-the-loop oversight: Ensure critical response decisions involve qualified personnel to minimize risks associated with false positives/negatives, hallucinations or adversarial manipulation of the large language models. Prevent high-impact automated decisions without human review.
  • Periodic retraining: For locally managed models, perform routine retraining using validated, diverse, and unbiased datasets to maintain resilience and reduce systemic risks.
  • Governance and accountability: Develop and maintain organizational policies, roles, and accountability structures focused on overseeing risk management across the AI lifecycle, in accordance with the National Institute of Standards and Technology's (NIST) AI Risk Management Framework (RMF) and Cyber Centre guidance. If deployed as part of the Government of Canada (GC), ensure that the Treasury Board of Canada Secretariat (TBS) Directive on Automated Decision-Making is adhered to.

Agentic AI represents a major shift in the cyber security landscape, offering both enhanced offensive capabilities for attackers and powerful new defensive tools for organizations.

Figure 1 below provides a visual representation of how ransomware can infect an organization’s networks and devices. It highlights the 3 main access vectors commonly used in ransomware incidents:

  • attacks on authentication (password guessing)
  • exploiting vulnerabilities in your software
  • executing phishing attacks

Figure 1 also highlights the 3 stages of a ransomware incident:

  1. The threat actor gains access to your network
  2. They take control of your systems and connected devices
  3. They deploy the malware payload to infect your systems and connected devices with ransomware

Once the threat actor has full control of your network, systems and devices, they can encrypt your data, delete available connected backup files and often steal your organization’s data. They may threaten to leak this data if you do not pay the ransom, or they may say they will decrypt your data and restore your access to it if you pay the ransom.

Figure 1 : How ransomware incidents occur

Long description immediately follows
Long description - How ransomware incidents occur

This image depicts the methodology that a threat actor generally uses to gain access to your network, systems and connected devices. There are 3 stages to a ransomware incident. The threat actor:

  • gains entry to your network, systems or devices
  • takes control and deploys the ransomware
  • encrypts your data, destroys your backups and steals your organizational data then demands a ransom payment to have your access restored

During the first phase of the ransomware incident, a threat actor usually finds their entry point to your network through:

  • brute force (password guessing)
  • vulnerabilities in your software
  • phishing attacks
    • the threat actor attempts to solicit confidential information from an individual, group or organization by mimicking or spoofing a specific, usually well-known brand, usually for financial gain
    • phishers attempt to trick users into disclosing personal data, such as credit card numbers, online banking credentials and other sensitive information, which they may then use to commit fraudulent acts

Once the threat actor has gained access to your network, they move onto the second phase of the ransomware attack: taking control of your systems and connected devices. They deploy the malware payload and infect your systems and connected devices with ransomware.

Once they have full control, the threat actor will move onto the third phase of the ransomware attack by encrypting your data, deleting available or connected backup files and often stealing your organization’s data. They may threaten to leak this data if you do not pay the ransom, or they may say they will decrypt your data and restore your access to it if you pay the ransom.

Top of page
 

Common ransomware vectors

Threat actors can exploit many vulnerabilities and leverage many attack vectors to infect your network, systems, and devices with ransomware. The following are examples of the most common ransomware vectors used by threat actors.

Cybercrime-as-a-service

With cybercrime-as-a-service (CaaS), specialized threat actors sell stolen and leaked data and ready-to-use malicious tools to other cybercriminals online, enabling their illicit activities. The CaaS ecosystem is underpinned by flourishing online marketplaces.

Ransomware-as-a-service

RaaS is a CaaS business model in which threat actors, regardless of their skills, can purchase malware from developers on the dark web. The developers receive a portion of the ransom paid by the victim. Most of the top ransomware groups affecting Canada operate on a RaaS business model where a core group of ransomware actors sell or lease their ransomware variant to affiliates who launch attacks. The NCTA 2025-2026 judges that the continued popularity of RaaS is almost certainly contributing to the rise in ransomware incidents by lowering the technical and administrative barriers to entry for more actors to carry out attacks.

Phishing

Phishing is a type of social engineering attack that uses text, email or social media to trick users into clicking a malicious link or attachment, revealing sensitive information or making a change in a system. Phishing attempts are often generic mass messages and can appear to be legitimate and from a trusted source, such as a bank. For more information on phishing, read Don't take the bait: Recognize and avoid phishing attacks (ITSAP.00.101).

Drive-by download

Drive-by download occurs when a user unknowingly visits an infected website and unintentionally downloads and installs malware onto their device or system.

Malvertising

Malvertising injects malicious code into legitimate online advertisements. When a user clicks the ad, malware spreads to their device. Some malvertising does not even rely on user interactions and can distribute malicious code simply by being displayed.

Exposed services

Exposed services, such as Remote Desktop Protocol (RDP) and content management systems, allow access to your systems. Threat actors can use a variety of tactics, such as exploiting common vulnerabilities and password spraying, to access your devices via these exposed systems and deploy ransomware.

Email spoofing

Threat actors can use managed service provider (MSP) identities and other third-party identities to spoof emails or conduct phishing attacks against your organization. To better protect your organization from these types of threats, read our publication Cyber security considerations for consumers of managed services (ITSM.50.030).

Supply chain attacks

Supply chain attacks allow threat actors to infiltrate a service supply organization and force an update to connected customers, which can then infect their systems and devices with ransomware. The Cyber Centre provides guidance on how to secure your organization’s supply chain in our publication Cyber supply chain security for small and medium-sized organizations (ITSAP.00.070).

Top of page
 

Ransomware targets

In the NCTA 2025-2026, the Cyber Centre assessed that ransomware directed against Canada will almost certainly continue to target large enterprises and critical infrastructure providers. This, however, does not mean that other organizations or individuals are safe from the threat of ransomware. Any organization can be the victim of ransomware given the need for data to carry out core business functions. The NCTA states that in the next 2 years, ransomware actors will almost certainly escalate their extortion tactics and refine their capabilities to increase pressure on victims to pay ransoms and evade law enforcement detection.

As with most cybercrimes, ransomware attacks are financially motivated. Threat actors will target organizations of any size and demand a ransom amount based on what they believe an organization will pay to recover its encrypted data.

Ransomware attacks can have major impacts, including:

  • privacy and data breaches
  • reputational damage
  • productivity loss
  • legal repercussions
  • recovery costs
  • damage to infrastructure and operations

Ransomware actors are mostly opportunistic and do not necessarily target specific industries. However, ransomware is the top cybercrime threat facing Canada’s critical infrastructure because it can immobilize critical business operations, destroy or damage important business data and reveal sensitive information. In addition to the financial losses associated with repairing and restoring systems and operations, ransomware attacks can disrupt critical services and jeopardize the safety and wellbeing of victims and those that rely on their services.

Critical infrastructure is an attractive target for ransomware actors because they perceive these entities as more willing to pay large ransoms to prevent disruptions to critical operations. According to the NCTA, ransomware victims in 2023 were becoming less likely to pay ransom demands. The perceived opportunities to earn high profits, combined with victims’ reduced willingness to pay, has almost certainly encouraged more technically sophisticated ransomware groups to elevate their extortion techniques and hire skilled affiliates capable of targeting critical infrastructure entities to extract larger ransom payouts.

Small and medium-sized organizations are also targets, as threat actors consider their security measures to be weaker and more susceptible to attacks. Small and medium-sized Canadian organizations that are victims of ransomware will likely continue to give into ransom demands rather than face losing business or having to rebuild their networks. They likely also fear the potentially destructive consequences of refusing payment.

Cyber threat actors often steal information during a ransomware attack. Threat actors can hold data for ransom, sell it or use it to gain an unfair competitive advantage by exploiting proprietary or patented information. The theft of organizational information, including intellectual property and customer and client data, can have both short- and long-term financial consequences for victims. These include impacts to global competitiveness, reputational damage and identity theft.

Vendor concentration is increasing organizations’ vulnerability to cyber threats like ransomware. A small number of large digital service providers, each with a large user base, provide many technology services. A cyber incident involving a single, dominant service provider can therefore affect an entire sector. Cyber threat actors target dominant vendors to steal customer data or demand ransom payments. The compromise of dominant service providers can amplify the impact of cyber security incidents. Cyber threat activity against services that are digital chokepoints (single points of failure within supply chains) can cause cascading and system-wide disruptions to the economy and society and endanger national security.

Finally, the cyber threat surface is expanding. In addition to the ongoing adoption and deployment of the Internet of Things (for example, connected vehicles), the boom in AI platforms and services is forecasted to drive demand for supporting infrastructure and lead to the transfer of even more data to cloud environments. It is also likely that AI-focused organizations are now more prominent targets for cyber threat actors and ransomware.

Ransomware payment

The decision to pay a cybercriminal to release your files is difficult, and you will likely feel pressured to give into their demands. Before you even consider paying, contact your local police department to report the cybercrime. Paying the ransom will not guarantee access to your encrypted data or systems.

The decision to pay the ransom is up to your organization, but it is important to be fully aware of the risks associated with paying. For example, threat actors may use wiper malware, which alters or permanently deletes your files once you pay the ransom. Paying the ransom also validates RaaS as a business model, which will encourage its growth and fund new attacks. Payment may also be used to fund other illicit activities, possibly including organized crime, terrorism or state-sponsored violence. Furthermore, it may be unlawful to pay ransom under laws against terrorism, money laundering, funding criminal organization activities, or sanctions legislation. Even if you pay, threat actors may still:

  • demand more money
  • continue to infect your devices and systems or those of other organizations
  • retarget your organization with a new attack
  • copy, leak or sell your data

The NCTA 2025-2026 displays the relative number of Canadian ransomware incidents reported to the Cyber Centre by Canadian victims between 2021 and 2024. Based on our data, the number of ransomware incidents has increased, on average, by 26% each year. Since many ransomware incidents go unreported, it is almost certain that the true number of ransomware incidents impacting Canada is higher than what is displayed. The Canadian Survey of Cyber Security and Cybercrime (CSCSC), conducted by Statistics Canada on behalf of Public Safety Canada, reported that the total recovery costs associated with cyber security incidents in 2023 doubled to $1.2 billion CAD.

Top of page
 

How to defend against cyber threats

Ransomware is among the most common types of malware and can be one of the most damaging cyber attacks to your organization. Single mitigation measures are not robust enough to combat the evolving threat of ransomware. Your organization should adopt a defence-in-depth (multi-layer) strategy to protect its devices, systems, and networks from ransomware and other types of malware and cyber attacks. Your strategy should include multiple layers of defence with several mitigation measures or security controls at each layer.

Cyber defence planning

There are many approaches you can take to better protect your networks, systems, and devices. The following is a list of security controls you can implement to strengthen your cyber security posture.

Develop your backup plan

Develop and implement a backup plan for your organization. A backup is a copy of your data and systems that can be restored in the event of an incident. There are several types of backups you can implement to protect your organization’s information:

  • Full: You may want to do a full backup periodically (weekly or monthly) and before major system upgrades. A full backup is the most expensive and time-consuming option, depending on the amount of information being backed up and your storage requirements.
  • Differential: A differential backup only creates a copy of data that has changed since your last full backup.
  • Incremental: With incremental backups, you are only storing the data that has changed since your last full or differential backup. Each increment is saved as an incremental volume. If you need to restore data, you must process each increment, which can be time consuming.
Storing your backups

There are 3 options for storing your backups: online, offline, and in the cloud.

Online backups are:

  • stored within the physical space of your organization
  • readily available should you need to initiate your recovery process
  • susceptible to data loss in the event of a natural disaster or power surge
  • vulnerable to ransomware if connected to your systems or networks

Offline backups (also known as cold backups) are:

  • stored in separate physical locations from your organization’s main centre
  • disconnected from your networks

Although data loss and theft are still possible, but having backups offline can prevent threat actors from accessing and infecting your backups with ransomware.

Cloud backups are:

  • stored on a cloud platform, often maintained by a cloud service provider (CSP)
  • available through your CSP’s server and can be accessed from anywhere
  • encrypted in the cloud for additional security, but data loss and cyber attacks (including ransomware) can still occur
Protecting your backups

Many ransomware variants are designed to locate, spread to and delete your system backups. Threat actors see this action as additional assurance to receive payment from your organization. If the ransomware spreads to your backups, you will be unable to restore and recover your systems and data, which ultimately halts your business operations. Most commonly, backups stored online or in the cloud are susceptible to ransomware. Storing your organization’s backups offline offers you the most protection against ransomware incidents.

Your organization should implement an offline backup process. Your backups will not be connected to your networks or devices, which ensures ransomware cannot locate and delete your backups. Ensure your organization has multiple backups stored offline and conducts the backup process frequently, to guarantee data is as close to real time as possible. Testing your backups is also a crucial element to your backup and recovery process. To ensure an additional layer of protection, you should encrypt your backups. The Cyber Centre’s Guidance on becoming cryptographically agile (ITSAP.40.018) and the Cyber Security Readiness Goals Cross-Sector Toolkit provide information on strong and agile encryption for data in transit.

Having a secondary backup in the cloud is also a recommended approach to enhancing your ability to recover. These backups will ideally be managed by a CSP within their secure cloud infrastructure. CSPs will provide an additional layer of security for your organization. Note that your organization is always legally responsible for protecting its data. You should ensure that the service provider you select can support your security, backup and recovery requirements with proper safeguards. You should also consider data residency, which refers to the geographical location where your data is stored. Your organization may have regulatory and policy requirements to ensure data is stored in Canada. If you plan to contract a vendor for offsite storage, make sure that they have security measures, incident management processes and a disaster recovery plan in place.

Note: Your CSP can also be a victim of ransomware, which can indirectly impact your organization. You may not be able to access the data you have stored in the cloud, which can significantly impact your ability to do business. You may also face issues with data integrity and confidentiality.

Recommendation: The recommended approach to backing up your information is to have multiple backups in multiple locations. You should have 2 or more backups stored offline and inaccessible by your networks and internet connection. You could then have a secondary backup in the cloud with your CSP. You should implement a schedule to test your backups on a regular basis (for example, monthly). Having 1 or more backup files available provides your organization with an increased chance of recovering and getting back to business more quickly if you are the victim of ransomware, or any other cyber incident.

For more information on developing your backup plan, see Tips for backing up your information (ITSAP.40.002).

Top of page
 

Develop your cyber incident response plan

Developing an incident response plan for your organization is the keystone to your cyber defence strategy. You should also consider developing a disaster recovery plan for your organization. In these 2 plans, your organization considers major events that could cause an unplanned outage and could require you to activate your recovery response. Your incident response plan helps you detect and respond to cyber security incidents. Your disaster recovery plan focuses on how the organization recovers and resumes critical business functions after an incident.

There are many benefits to developing an incident response plan:

  • Effective incident management lessens the impact of a cyber incident
  • A practiced plan will help you make good decisions when under the pressure of managing a real incident
  • Key actions are approved in advance, allowing financial authorities and resources to be available in the immediate steps of your incident response
  • A well-managed response, with clear communication throughout, builds trust with stakeholders and customers
  • Learning from incidents identifies gaps in and issues with your response capability

Your incident response plan should cover several key elements. The main goal is to recover from an incident as quickly as possible. The following checklist provides an overview of the key elements you should include in your incident response plan. It is not a comprehensive list of incident response requirements, but it does provide a structured approach and action items that your organization can implement.

By following this checklist in the preliminary stages of your incident response plan, you can identify your risks, devise a plan of action to mitigate them and prepare your organization for an efficient recovery that will allow you to get back to business quickly.

For more information on developing your incident response plan, read Developing your incident response plan (ITSAP.40.003).

Cyber incident response plan checklist

Use the following incident response plan checklist to ensure your incident response is complete.

  • Conduct a risk assessment:
    • identify key systems and assets that are critical to your business operations
    • analyze the likelihood and impact of these systems being compromised
    • prioritize your response efforts to ensure the most critical systems and assets are protected and backed up offline frequently and securely
  • Develop policies and procedures:
    • develop an incident response policy that establishes the authorities, roles and responsibilities for your organization
    • establish and communicate pre-authorizations to contract assistance to key incident response contacts
  • Establish your cyber incident response team (CIRT):
    • create a CIRT to
      • assess, document, and respond to incidents
      • restore your systems, recover information
      • reduce the risk of another ransomware incident occurring
    • include employees with various qualifications and have cross-functional support from other business lines
    • designate backup responders to act for any absent CIRT members in the event of an incident
  • Deliver training:
    • tailor your training programs to your organization’s business needs and requirements and to your employees’ roles and responsibilities
    • ensure your training includes the cyber security controls listed (for example, spotting malicious emails and phishing attacks and using strong passphrases)
    • for advice and guidance on cyber security event management training, email the Cyber Centre Learning Hub at education@cyber.gc.ca. The Learning Hub offers a comprehensive event management course that can be tailored to your organization’s business and information technology (IT) needs
  • Identify stakeholders:
    • identify the internal and external key stakeholders who will be notified during an incident. You may have to alert third parties, such as clients and MSPs
    • depending on the incident, you may need to contact law enforcement and possibly a lawyer
  • Develop a communications plan:
    • detail how, when and with whom your team communicates
    • include a central point of contact for employees to report suspected or known incidents
    • ensure you have external contact information for all members and backup members of your CIRT, key personnel and key stakeholders
    • prepare sample media statements that can be tailored to cyber incidents as they occur
    • consider retaining a third-party ransomware recovery organization that can guide you through your incident response and recovery process
Incident response process

Your incident response process will follow a 4-phase lifecycle.

Phase 1: Prepare

  • Assign policies
  • Define goals
  • Test backup processes
  • Test patch and update processes
  • Track vulnerabilities
  • Develop test exercises

Phase 2: Observe

  • Develop a monitoring strategy (for example, frequency, included networks)
  • Monitor your networks and connected devices for threats
  • Generate event and incident reports regularly
  • Analyze the data and determine whether you need to activate your response

Phase 3: Resolve

  • Analyze your findings to fully understand the incident
  • Determine which mitigation measures need to be put in place (for example, disconnect devices)
  • Run antimalware and antivirus software
  • Patch vulnerabilities
  • Restore your systems and data via your backup
  • Preserve evidence and document steps taken

Phase 4: Understand

  • Identify the root cause of the incident
  • Evaluate your incident response and highlight areas requiring improvement
  • Meet with your response team and develop lessons learned and future initiatives to improve your response

Use these 4 phases to structure your plan and your response. A primary part of your incident response should include reporting cybercrimes:

Top of page
 

Develop your recovery plan

Your recovery plan should complement your backup plan and incident response plans. When developing your recovery response, consider many variables and clearly identify and document what is to be recovered, by whom, when and where.

Guidelines for your recovery plan

Use the following guidelines for your recovery plan.

Planning

  • Identify stakeholders, including clients, vendors, business owners, systems owners and managers
  • Identify your response team members and their roles and responsibilities
  • Take inventory of your hardware and software assets
  • Identify and prioritize critical business functions, applications and data
  • Prepare emergency documentation—such as a contact list for all employees, clients, service providers and suppliers—to ensure you can react quickly and efficiently in the event of a ransomware incident
  • Conduct a tabletop exercise to ensure all participants are aware of their roles and required actions in the event of a ransomware attack
  • Invest in cyber security insurance if you determine it to be beneficial for your organization. This may add an additional layer of protection and may also provide your organization with incident response expertise in the event of a ransomware attack

Measuring

  • Set clear recovery objectives
  • Define data backup and recovery strategies
  • Test your plan

Communicating

  • Develop a communications plan to inform key stakeholders
  • Develop a training program for employees to ensure everyone is aware of their roles, responsibilities and the order of operations during an incident
  • Connect with your MSPs to identify areas where they can assist you with your recovery efforts
  • Engage IT security specialists prior to an event to ensure you have subject-matter experts weighing in on your response and recovery efforts

To create an effective plan, you should identify your organization’s critical data, applications and functions. Critical data may include financial records, proprietary assets and personal information. Critical applications are the systems running key functions that are imperative to your business. You will need to restore critical data, applications and functions immediately to ensure business continuity in the event of an unplanned outage or incident. You should consider conducting a risk assessment to help identify critical business functions and the relevant threat and vulnerability risks.

To ensure your response is effective, your organization should run through specific scenarios such as a cyber attack, a significant power outage or a natural disaster. This will help you identify key participants and stakeholders, address significant risks, develop mitigation strategies and determine recovery time and effort.

You can conduct a business impact analysis (BIA) to predict how disruptions or incidents will harm your operations, business processes, systems and finances. Almost all recovery processes will require a significant period without Internet connectivity to evict the attackers. Plan for this downtime in your BIA.

In your BIA, you should also assess the data you collect and the applications you use to determine their criticality and choose priorities for immediate recovery. It is also critical to take note of your recovery efforts, documenting what went well and what areas require improvement.

To learn more about developing your recovery plan, read Developing your IT recovery plan (ITSAP.40.004).

Top of page
 

Manage user and administrator accounts

Oversee the creation and assignment of user and administrator accounts with secure access in mind. Consider creating separate accounts for non-administrative functions (for example, access to email and limited access to internal systems) to reduce the risk of ransomware infecting your administrator accounts and the system access associated with those accounts. You should limit administrator accounts to those who need full or specialized access to your organization’s network, systems and devices. Ensure you have complete segregation of duties for backup administrators relative to primary/production administrators. Pay particular attention to possible common or federated authorization management systems, such as directory services or cloud identity providers.

Your organization should use dedicated administrative workstations (DAWs) to create secure environments exclusively for privileged operations. Removing public Internet access from administrative workstations can substantially reduces risk of compromise. Remote access to privileged accounts should be performed on DAWs governed entirely by the system’s security policies and used exclusively for this purpose.

If a threat actor gains access to an administrative account, they can use the elevated privileges to affect your organization’s operating environment, attack your network or access sensitive information. Attackers can also learn what detection and recovery activities exist on your systems, which may help them avoid discovery and prevent you from stopping further attacks.

To manage access to your systems and data, apply the principle of least privilege. That is, only provide employees with access to the functions and privileges necessary to complete their tasks. You should also use the principle of least privilege when allowing remote access to your devices. Ensure you activate MFA at all access points into your network. Consider using single sign-on (SSO) access where possible to enhance the security of your devices and connected networks. Restrict administrative privileges and require confirmation for any actions that need elevated access rights and permissions.

When assigning administrator accounts or privileged access to users, your organization should take the following measures:

  • use strong authentication methods for your accounts
    • use MFA for all administrative accounts
    • use a unique passphrase for each privileged account
    • change default passwords to unique passphrases for applications and devices
    • authenticate users before they are granted access to applications or devices
  • ensure that unique, identifiable accounts are attributed to individual users
  • log and monitor actions on privileged accounts
  • provide training on expected behaviours for privileged account users
  • remove special access privileges when users no longer require them
  • decommission and delete user accounts when someone leaves the organization

To address the modern challenges of securing remote workers, protecting hybrid cloud environments and defending against cyber security threats, we recommend you implement a zero trust (ZT) security model. ZT’s central tenet is that no subject (application, user or device) in an information system is trusted by default. Trust must be reassessed and verified every time a subject requests access to a new resource. The degree of access provided is dynamically adjusted based on the level of trust established with the subject. ZT involves adopting a new mindset to security by always assuming a breach and focusing on protecting resources (for example, services and data). For more information about ZT security models, read A zero trust approach to security architecture (ITSM.10.008). In addition to managing your accounts, it is also imperative to manage the decommissioning and disconnecting of obsolete or retired systems and devices. These systems and devices must be removed from your network, sanitized and disposed of securely.

For more information on managing access and administrative accounts, read:

Top of page
 

Cyber security controls

When implementing and maintaining a defence-in-depth model, your organization must layer security controls throughout your networks to protect the security, confidentiality, integrity and availability of your networks, devices and information.

As shown in Figure 2 below, a variety of security controls, layered throughout your networks, can better defend your organization from ransomware. Some of the cyber security controls identified in Figure 2 can be applied at various stages or in various areas within your network and systems. For example, logging, alerting and network segmentation should be applied in all layers of your defence-in-depth strategy.

To proactively mitigate threats during the first stage of a ransomware incident, it is essential to have key preventative measures and cyber security controls in place before an incident occurs. By implementing the following controls as part of your security environment, you can strengthen your organization’s ability to detect, contain, and minimize the impact of ransomware threats early on.

  • Provide your employees with tailored cyber security training to ensure they are aware of attack vectors like phishing and know how to identify suspicious emails or links
  • Use strong passphrases to deter authentication attacks
  • Implement MFA for your organization’s devices and systems
  • Create an application allow list to control who or what is allowed access to your networks and systems. Application allow lists help to prevent malicious applications from being downloaded and infecting your server
  • Scan your hardware, software and operating system for vulnerabilities. Apply patches and updates to mitigate the risk of the vulnerabilities being exploited by a threat actor
  • Segment your network to ensure sensitive and high-value information is in a separate zone of your network
  • Set up monitoring and logging functionality for your systems and networks and ensure you receive automated alerts if any anomalies are detected
  • Protect systems that are connected or exposed to the Internet with
    • encryption
    • firewalls
    • IDPS
    • frequent vulnerability assessments
  • Deactivate macros to decrease the risk of ransomware being spread through attachments and ensure that users cannot reactivate them
  • Block advertising to prevent ads, especially malvertising, from being displayed

To help mitigate the threats that take place during the second stage of a ransomware incident, you can implement the following measures to better protect your systems and networks and prevent ransomware from spreading across your network and connected devices:

  • Use security tools, such as antivirus and antimalware software
  • Use firewalls and IDPS on your networks to help protect potential entry points against threat actors
  • Apply the principle of least privilege

In the third stage of a ransomware incident, the top pre-emptive mitigation measure for your organization is its backup plan. Ensure you have multiple copies of your backups stored offline. By having your backups disconnected from all networks, network-based threat actors will be less likely able to delete them or infect them with ransomware. Ensure that you test your backups and restore processes on a regular basis. Address any issues immediately to ensure your backup files are ready for your organization to recover quickly in the event of a ransomware incident.

The following section provides more detailed guidance on the various security controls your organization can implement. For more information on security controls, read:

Figure 2: Security controls to reduce the risk of a ransomware incident

Long description immediately follows
Long description - Security controls to reduce the risk of a ransomware incident

Figure 2 shows the same methodology that a threat actor uses to conduct a ransomware attack but highlights where security controls can be implemented to mitigate and attempt to prevent the ransomware attack from occurring.

In the first stage of a ransomware incident, under the “gains access” section of this diagram, there are some preventative mitigation measures that can be put in place to protect your organization. The following is a list of cyber security controls that can be implemented at the forefront of your cyber security environment:

  • Provide your employees with tailored cyber security training to ensure they are aware of attack vectors like phishing and how to identify suspicious emails or links
  • Use of strong passwords, or preferably passphrases, to attempt to prevent threat actors from being successful in brute force attacks
  • Implement MFA for your organization’s devices
  • Create an application allow list to control who or what is allowed access to your networks and systems. Application allow lists help to prevent malicious applications from being downloaded and infecting your server
  • Scan your hardware, software and operating system for vulnerabilities. Apply patches and updates to mitigate the risk of the vulnerabilities being exploited by a threat actor
  • Segment your network to ensure sensitive and high-value information is in a different zone of your network
  • Setup monitoring and logging functionality for your systems and networks and ensure you receive automated alerts if any anomalies are detected
  • Protect your systems that are connected or exposed to the Internet with
    • encryption
    • firewalls
    • MFA
    • frequent vulnerability assessments
  • Disable macros to decrease the risk of ransomware being spread through Microsoft Office attachments

In the second stage of a ransomware incident, under the “takes control” section of this diagram, there are some mitigation measures you can implement to enhance the protection of your systems and networks and to prevent ransomware from spreading across your network and connected devices:

  • Implement security tools, such as antivirus and antimalware software and firewalls, to your networks to add layers of protection to potential entry points for threat actors
  • Apply the principle of least privilege in which you provide individuals only the set of access privileges that are essential for them to perform authorized tasks

In the third stage of a ransomware incident, under “threat actor impacts organization,” the number 1 mitigation measure you can implement for your organization is your backup plan. Ensure you have multiple copies of your backups stored offline and, if possible, in the cloud through a CSP. By having your backups disconnected from your network, threat actors cannot delete them or infect them with ransomware. Ensure you test your backup and restore processes frequently and adjust any issues immediately to ensure your backup files are ready for your organization to recover quickly in the event of a ransomware incident.

Top of page
 

Create an application allow list

An application allow list is a corporate portfolio of approved software. The list is enforced so that only approved software gets installed in an organization’s various systems. An allow list selects and approves specific applications and application components (for example, executable programs, software libraries or configuration files) to run on organizational systems. Application allow lists help to prevent malicious applications from being downloaded and infecting your server.

Your organization can create a list of applications that are authorized for use in the workplace or that are known to be from a trustworthy vendor. When a user launches an application, it is compared against the allow list and is only permitted if it appears on the list. Hashing is used to verify the application’s integrity and generates a value from a string of text that is unique to every application. If an application is updated or patched, the hash changes to ensure that you are only running the newest version of the application. A complementary measure to application allow listing is enforcing the use of approved signatures from approved software vendors for all types of software.

By implementing an application allow list, your organization will enhance your cyber defence posture and prevent incidents such as ransomware.

For more information on applications allow lists, read Implement application allow lists (ITSM.10.095).

Use protective domain name system

Domain name system (DNS) is a protocol that maps domain names that are easily read by the human eye to Internet Protocol (IP) addresses that are easily read by machines. DNS is often referred to as the address book for the Internet. DNS is used for both human-initiated actions (for example, visiting a website) and machine-initiated actions (for example, running an update).

Protective DNS is a tool that your organization can implement to block employees from visiting potentially malicious domains on the Internet when using corporate devices. Protective DNS identifies malicious domains against your organization’s blocklist, which is a listing of domains and IP addresses that users are not permitted to visit using corporate assets or while on an organizational network. For more information on DNS, read Protective Domain Name System (ITSAP.40.019) and Domain Name System (DNS) tampering (ITSAP.40.021).

You should also consider implementing protective DNS filtering on any mobile devices used by your employees, especially if they can connect to your network and systems remotely. You can do this by manually configuring DNS settings on your organization’s devices, through a mobile device management (MDM) tool. For more information on protecting mobile devices, read Security considerations for edge devices (ITSM.80.101).

Canadians can use a free public DNS application called Canadian Shield. The application is provided by the Canadian Internet Registration Authority (CIRA) and ensures personal devices always use a trusted DNS and filter out malicious IP addresses. Canadian Shield can be set up on your router or gateway to better protect your entire network. We recommend applying its Protected DNS resolver, which is designed to offer enhanced malware and phishing blocking. Replacing the default DNS server settings on your devices with a trusted DNS server can better protect your devices.

Establish perimeter defences

Protecting your network, connected systems and devices against cyber threats can seem daunting. Perimeter defences protect the boundary between 2 network security zones through which your traffic is routed. Defending this boundary with basic security protocols like firewalls, antivirus and antimalware software and IDPS significantly enhances your overall protection. Installing anti-phishing software is another way to strengthen your organization’s cyber security. Anti-phishing software blocks phishing emails to prevent attacks from occurring or spreading further.

Ensure that users access the network using your organization’s virtual private network (VPN). A VPN acts as a secure tunnel through which you can send and receive data on an existing physical network. Using a VPN provides a secure connection between 2 points, such as your laptop and your organization’s network.

Implement logging and alerting

Implementing continuous monitoring of your networks will help you establish a baseline of acceptable activity patterns within your organization. Establishing monitoring capabilities, such as intrusion detection systems (IDS) for your networks, can help your organization manage risk. Your monitoring system should generate logs that can be reviewed by IT specialists and management when necessary. You should limit access to your logs to those who need to review them.

You should also implement automatic alerting within your monitoring practices so that anomalies in activity patterns are flagged and reviewed. Automatic alerting should also identify potential vulnerabilities and events that require you to take risk mitigation action. The alerts will indicate that something out of the ordinary has occurred. Your organization can then review these anomalies to determine what occurred, whether there is a risk to the organization, and what can be done to mitigate the risk. Your organization’s logging and alerting system should not permit modifications to be made to your logs once they have been received from the system. Logs should be timestamped to assist you in understanding what led to an event or an incident.

If your organization becomes the victim of ransomware or another type of cyber incident, your logs could provide insight into how the incident occurred. They could also show what controls or mitigation measures can be implemented to better protect your networks and systems from future incidents.

For more information on implementing logging and alerting, read Network security logging and monitoring (ITSAP.80.085).

Assess vulnerabilities

A vulnerability assessment can identify and prioritize known vulnerabilities that cybercriminals could exploit to gain access to applications, systems, and data. This assessment can involve:

  • vulnerability scanning to identify known vulnerabilities within applications
  • penetration testing, which simulates attacks that cybercriminals might perform to evaluate how well the infrastructure withstands them
  • security assessments and audits to identify misconfigurations that could lead to security vulnerabilities
  • intrusion detection to monitor for intrusions and intrusion attempts
  • threat hunting to identify and eradicate threats using computer forensics, cyber threat intelligence and malware analysis

Segment your networks

Segmenting your network involves dividing your networks into smaller sections or zones so that traffic is directed and flows through the different sections of the network. This allows you to stop traffic flow in certain zones and prevent it from flowing to other areas in your network. In the same manner, segmentation also allows you to isolate and stop the spread of malware to different sections of your network, and to control and restrict access to your information. When segmenting your network, ensure your IT and operational technology (OT) networks are identified, separated and monitored. These networks should be air-gapped, meaning that you should physically or conceptually isolate secure computer networks from unsecure networks, such as those that connect to the Internet. In addition to segmenting your IT and OT networks, you should also identify interdependencies between them and implement measures that can be put in place during a cyber incident to protect critical information and functions.

For more information on segmenting your networks, read Segment and separate information (ITSM.10.092).

Top of page
 

Constrain development and scripting environments and deactivate macros

If your organization uses the Microsoft Windows operating system, you may want to consider constraining your development and scripting environments. With Windows specifically, Microsoft developed an automated system administration capability through an interface powered by their shell scripting language, known as PowerShell. It is a powerful and important part of the system administration toolkit. It can be used to fully control Microsoft Windows systems and has many benefits for organizations. However, threat actors can exploit PowerShell and inject malicious code into your devices’ memory. More concerning is the fact that PowerShell is a trusted source and therefore a threat actor’s code injection typically will not be blocked by antivirus or antimalware software or by your systems’ event logs. To make it harder for malicious PowerShell behaviour to be obfuscated, organizations should ensure that standard users are allowed to modify the relevant registry keys or the transcript folder.

Organizations should also consider using protected event logging to prevent sensitive information, such as passwords in script blocks that are logged to the event log, from being leaked.

Many organizations also have development tools, such as Python, Perl, PHP and .NET, that threat actors can exploit for malicious purposes. Isolate these tools from the user environment.

Macros are another security consideration when using Windows. Macros are written sequences that imitate user keystrokes and mouse commands to automatically repeat tasks in applications. Macros are used in many Microsoft Office products to automate processes and data flows. They are embedded in the code of the files, enabling users to create shortcuts for specific tasks (for example, sort worksheets alphabetically, unmerge all merged cells or unhide all rows and columns).

Threat actors can create malicious macros and include them in documents that they may then send to employees in your organization. To decrease the risk of ransomware being spread through Office attachments, you should set your user defaults to deactivate macros and ensure that users cannot re-activate them. You should also ensure that macros cannot contain sensitive information, such as personal credentials, and use organization-developed or signed macros that are verified by technical authorities within your organization.

For more information on macros, read How to protect your organization from malicious macros (ITSAP.00.200).

Patch and update

To protect your connected devices from ransomware, you should check the operating system, software and firmware regularly for updates and install security patches. There are a variety of patches available, but the following 3 types are most applied:

  • bug fix patch: repairs functionality issues in software (for example, an error that causes unexpected device behaviour)
  • security patch: addresses security vulnerabilities to protect the system from threats (for example, malware infecting devices through security flaws)
  • feature patch: adds new functions to the software (for example, enhancements to application performance and speed)

For more information on patching and updating your devices, read Patch operating systems and applications (ITSM.10.096).

Manage passwords and passphrases

Your organization should implement passphrases in place of passwords where possible. Using strong passphrases is 1 step in protecting your systems and sensitive information, but it is not enough to prevent a threat actor from gaining access. Password guessing is a common tactic used by threat actors to gain access to networks and systems. If using passphrases is not possible, you should use strong, unique passwords combined with MFA.

Subsection ‘Manage user and administrator accounts’ provides details on adopting MFA in your account and access management practices. In combination with using MFA, you should encourage employees to use a password manager. Password managers can be beneficial for remembering and securing passwords or passphrases required to access your networks and systems.

Your organization should also consider implementing password vaults for administrative accounts. Password vaults ensure a higher level of protection since the passwords or passphrases are cycled and synchronized with your systems. This ensures a password or passphrase can only be used once. It also provides tracing capabilities that can determine who used a password or passphrase at a given time for specific access.

For more information on the implementation and use of password managers, read Password managers: Security tips (ITSAP.30.025) and Best practices for passphrases and passwords (ITSAP.30.032).

Top of page
 

Protect email domains

Threat actors may leverage misconfigurations or gaps in cyber security protocols to advance their goals. They often target email systems with the aim of gaining unauthorized access, stealing sensitive information or disrupting communication channels. Email accounts house a large amount of private information, including personal data, financial details and confidential business exchanges. Ensuring secure email communications is important to prevent breaches that could compromise the integrity of these exchanges. Email security also protects against malware and phishing attacks, which are frequently initiated via deceptive emails.

Consider implementing technical security measures to protect your organization’s domains from email spoofing, prevent the delivery of malicious messages sent fraudulently on behalf of your domain and identify the infrastructure used by threat actors. These measures also help prevent phishing emails from being delivered to your organization. You can reduce a threat actor’s chance of carrying out successful malicious email campaigns by implementing the following 3 security protocols that act jointly to protect email domains from being spoofed. For more information, read Quick guide to email configuration (ITSAP.60.003).

Sender Policy Framework

Sender Policy Framework (SPF) is a system that uses features of DNS and allows domain owners to specify which servers are authorized to send emails on behalf of their domain. If you receive an email from an IP address that is not specifically permitted by the SPF record, it is likely not legitimate. When an email is sent, the recipient's mail server checks the SPF record of the sender's domain to see if the sending mail server is on the authorized list. If the sending mail server is included in the SPF record (a "pass"), the email is considered legitimate and is usually delivered. However, if the sending mail server is not listed in the SPF record (a "fail"), the recipient's mail server may handle the email cautiously, possibly rejecting it or marking it as spam.

DomainKeys Identified Mail

DomainKeys Identified Mail (DKIM) is an email authentication protocol that enhances the security of email messages by allowing the sender to digitally sign them. When an email system that supports DKIM receives a DKIM-signed message, it retrieves the record associated with the message’s DKIM header and verifies the message’s signature using the published public key. This DKIM check cryptographically confirms that the message was sent by an authorized sender and was not altered in transit. If the signature is not valid, or if no DKIM record is available, the message will fail DKIM. Messages that fail this DKIM check may be rejected.

DKIM ensures the integrity of email communication, making sure that emails have not been tampered with. It allows recipient servers to check the message's authenticity and to confirm it originates from the claimed domain. This helps prevent spoofing and impersonation attempts.

Domain-based Messaged Authentication, Reporting and Conformance

Domain-based Messaged Authentication, Reporting and Conformance (DMARC) policy and verification can enhance your security protocols and protect your email domains from being spoofed. It builds on DKIM and SPF to ensure emails are authenticated before transmission, guaranteeing that they originated from the intended domain, and are sent to legitimate recipients. If an email passes through the DMARC validation, it will be delivered to the intended recipient. If the email fails DMARC validation, the receiving email system applies the policy specified in the sending domain’s DMARC record and will either deliver the email, deliver the email but mark it as suspicious or reject the email. Unlike some other solutions that rely on a single point of failure, DMARC uses a resilient strategy that covers both the source and target sides of email communication. It conducts a comprehensive security check on sender information, recipient details, subject lines, body text and other message characteristics.

For more information on email domain protection, read Implementation guidance: Email domain protection (ITSP.40.065) and Email security best practices (ITSM.60.002).

Top of page
 

How to recover from ransomware incidents

Recovering from a ransomware incident can be a lengthy process and recovering your organization’s brand and reputation can take even longer. Assuming your organization will eventually encounter some form of malware can help you develop your planned response and could speed up your recovery processing time. By adhering to the guidance provided in this document, your organization will not only reduce the time it takes to recover from an attack but can also reduce the likelihood of an attack or minimize the impact of an infection.

Recovery process

As described in subsection ‘Develop your recovery plan’, having reliable backups that are secured and stored offline can significantly enhance your ability to recover from a ransomware attack. If your organization has been hit with ransomware, there are immediate steps you can take to minimize the impact of the infection.

Immediate response actions

Threat actors can infiltrate your network and can gain insight into components and data in your systems, devices that are connected to your system and your communications. Once you become aware of an infiltration, you should assume that the threat actor is still on your network and is aware of what is happening in your organization. As such, you should implement an alternative communication method (for example, external email accessed by a device not connected to your network) that cannot be accessed by them. This will also block the threat actor from gaining insight into your intended incident response plans and recovery actions. Your organization can follow the checklist below when taking immediate action, ideally within the first few hours, against a ransomware attack.

Immediate response checklist: Detection, analysis, containment and eradication

Determine what is infected and isolate systems and devices

  • Determine which devices and systems are infected with the ransomware
  • Isolate all systems and devices
  • Disconnect the infected systems and devices from the Internet and any internal network connection to reduce the risk of the infection spreading to other connected devices
  • Determine what data, including data in transit, has been impacted by the ransomware
  • Establish the likelihood that the confidentiality or integrity of the data has been compromised. Inform data managers and stakeholders of potential impacts
  • Deactivate your VPNs, remote access servers, SSO resources and cloud-based or public-facing assets as additional measures to contain the ransomware infection

Report to law enforcement

  • Report the ransomware attack to local law enforcement. Ransomware is considered a cybercrime and may be investigated by law enforcement
  • Report the ransomware attack to the Canadian Anti-Fraud Centre and the Cyber Centre online via My Cyber Portal
  • If you have been infected with a known type of ransomware, check if law enforcement can provide you with a decryption key

Assemble your CIRT

  • Communicate the incident details to your CIRT (established while creating your incident response plan)
  • Provide clear direction to CIRT members on their roles and responsibilities in managing the incident
  • Document the known details to ensure your CIRT has an initial understanding of what has occurred
  • Triage the systems impacted by the ransomware for restoration and recovery. This will guide your CIRT on where to focus immediate actions

Change credentials

  • Reset credentials, like passwords and passphrases, for administrator and user accounts
  • Ensure you are not changing any credentials that are required to restore your backup or that may lock you out of systems needed during the recovery process
  • Create temporary administrator accounts to begin your recovery and monitor whether the threat actor is leveraging your original accounts

Wipe and reinstall

  • Safely wipe your infected devices to remove any malware, bugs or viruses
  • Reinstall the operating system to rid your devices of the infection
  • Update the basic input/output system and reload firmware

Run security software

  • Run antivirus and antimalware diagnostics on your backup to make sure it is clean before you begin the restore process
  • Restore your systems into a clean, network-isolated location and then ensure they are at the very latest patch state for all software. This can be time consuming and may “break” system dependencies that will have to be resolved
  • Scan any files that might have been accessed by the threat actor or extracted from a compromised system
  • Download the Cyber Centre’s free malware detection and analysis tool Assemblyline
  • Address any items flagged by the scans
Top of page
 

Recovery actions

Although isolating your infrastructure from the Internet can temporarily disrupt your business, it is the most important course of action. Isolation will temporarily remove the threat actor’s access to your infrastructure, allowing you to gain control and further your incident investigation, response and recovery.

Once you have completed the steps identified in the checklist above and you are certain that your backups and devices are clear of any malware or viruses and are at the most recent patch state, you should begin your recovery process, as outlined in the following subsections.

Remediate the point of entry

To recover successfully and avoid reinfection, you will need to identify how the threat actor was able to enter your network, systems and devices and address the vulnerability immediately. Ensure you remediate the point of entry prior to reconnecting your systems or devices to your network or the Internet to thwart the threat actor’s ability to gain access in the same manner.

Implement your backup plan

Ensure your organization is protected by having a detailed backup plan in place. You will execute this plan if your main systems and data storage are compromised and need to be restored with your copied information. The backup plan will ensure your organization can restore critical systems and data and get back to business quickly. You should recover your systems using offsite backups that are not connected to your networks. Prior to restoring from a backup, scan and analyze it with a known uncorrupted system to ensure it has not been compromised by the threat actor.

Restore your systems

Following your incident response plan, identify the critical systems and data that need to be recovered first. Ensure that these systems and data have not been impacted by the ransomware attack and that they do not have signs of any other malware infection.

There are several options to consider when implementing your recovery strategy. You should choose a recovery strategy that meets your business needs and security requirements.

Engage cyber security professional assistance

Procuring professional services from a highly rated cyber security agency or professional can be helpful when preparing for and responding to a ransomware incident. If your organization has a cyber insurance policy, your provider will often include the assistance of a third-party cyber security professional in the event of an incident like a ransomware attack. They will provide you with incident response expertise and a recovery strategy tailored to your organization. They may also deploy an incident handling team to lead your organization’s response and recovery process. If you do engage professional cyber security assistance, ensure you clearly identify the service expectations, roles and responsibilities. The introduction of cyber insurance as a proactive measure of protection against ransomware can encourage enterprises to align their cyber security postures with insurance policy standards. However, if insurance policy documents are not properly protected, sophisticated ransomware actors could obtain that sensitive information on coverage amounts and leverage it in ransom negotiations to maximize their payment from companies.

Inform stakeholders

When an incident occurs, and especially when it compromises your systems and data, it is imperative that you inform key stakeholders, clients and employees. You should consider preparing a statement in advance that can be tailored to the incident, as well as a contact list of all stakeholders to be notified. Ransomware attacks can jeopardize your organization’s reputation, so your communications plan must be implemented swiftly following an incident. This will ensure your stakeholders are informed and able to enact their own incident response plans, if necessary.

Analyze the incident

It is crucial to determine the root cause of the incident. Identify how the threat actor gained access to your network and deployed the ransomware. A ransomware incident is often an indication of a more serious hack or intrusion by the threat actor. If you do not identify how a threat actor gained access or apply appropriate security measures to prevent it from happening again, threat actors may continue to exploit the vulnerability.

Note that to succeed in forensics, a high-integrity forensic record of events must be available. As for backups, monitoring and logging must have strong segregation of duties to withstand the hostile attention of attackers.

A vital step in your incident analysis is determining what systems, accounts and information the threat actor accessed. This will allow you to determine the extent of the damage, such as what accounts were compromised and what data was exfiltrated. In turn, this will inform your approach to control the attack, prepare and implement a proper response and execute a successful recovery.

Top of page
 

Summary

Ransomware is an ever-present threat to all organizations, regardless of their size. Ransomware incidents can lead to financial loss, data breaches and reputational damage for your organization. Preparing your organization and applying proactive measures to protect your network, connected devices and information is critical for your ability to respond to and recover from ransomware.

If your organization has fallen victim to ransomware, conducting a lessons-learned exercise post-recovery is an excellent way of implementing further mitigation measures and correcting actions and strategies that did not go as planned. Revise your incident response plan based on these lessons learned to ensure your organization has the most robust response and recovery plans possible.

Consider reporting cyber incidents to law enforcement, such as local police or the Canadian Anti-Fraud Centre, and to the Cyber Centre online via My Cyber Portal. If you are comfortable doing so, share your findings, including the tools, techniques and procedures used by the threat actor, with the Cyber Centre. This will assist the Cyber Centre in providing alerts and guidance to the public and will help individuals and organizations protect their assets from the same ransomware attack. Sharing your lessons learned can benefit other organizations and the broader cyber security community.

Effective date

This publication takes effect on December 11, 2025.

This is an UNCLASSIFIED publication that has been issued under the authority of the Head of the Canadian Centre for Cyber Security (Cyber Centre). For more information, contact the Cyber Centre:

This version supersedes Ransomware playbook, dated November 30, 2021.

Revision history

  1. First release: November 30, 2021
  2. Second release: January 28, 2026
Top of page
]]>https://cyber.gc.ca/en/guidance/ransomware-threat-outlook-2025-2027<![CDATA[Ransomware Threat Outlook 2025-2027]]>2026-01-28T16:00:00Z

Alternate format: Ransomware Threat Outlook 2025-2027 (PDF, 1.8 MB)

 

Table of contents

Executive summary

This assessment is an update to the Canadian Centre for Cyber Security's (Cyber Centre) Baseline cyber threat assessment: Cybercrime, published in 2023. It is intended to provide an update on the ransomware threat to Canada and to inform Canadian organizations about the early history of ransomware, emerging and projected trends, and ransomware’s impact on Canada and Canadian organizations. It will also debunk common myths and misconceptions on cyber hygiene and responding to cyber incidents. While this report is intended to inform Canadian organizations of all sizes, including public sector entities and critical infrastructure, all Canadians can benefit from reading this report and increasing their knowledge of the ransomware ecosystem.

For the purposes of this assessment, ransomware generally refers to a type of malware that denies a user access to a system or data until a sum of money is paid. However, the Cyber Centre recognizes that ransomware has evolved to also include incidents where data theft and extortion are used in place of encryption.

Ransomware emerged as an informal method of cybercrime that used basic encryption and extortion. However, it has quickly evolved over the past decades into an interconnected and sophisticated ecosystem where threat actors communicate and conduct payments through borderless online spaces that are difficult to access on the dark web.

We assess that threat actors carrying out ransomware attacks impacting Canadian organizations are almost certainly opportunistic and financially motivated. All Canadian organizations, regardless of size or sector, are at risk of being targeted by ransomware. In addition to impacting the infrastructure, data, supply chain, and operations of organizations, a ransomware attack can also impact Canadians’ livelihoods by disrupting the critical services they depend on.

Assessment base and methodology

The key judgments in this assessment rely on reporting from multiple sources, both classified and unclassified. The judgments are based on the knowledge and expertise in cyber security. Defending the Government of Canada’s information systems provides the Cyber Centre with a unique perspective to observe trends in the cyber threat environment, which also informs our assessments. The Communications Security Establishment Canada’s (CSE) foreign intelligence mandate also provides valuable insight into adversary behaviour in cyberspace. While we must always protect classified sources and methods, we provide the reader with as much justification as possible for our judgments.

Our judgments are based on an analytical process that includes evaluating the quality of available information, exploring alternative explanations, mitigating biases and using probabilistic language. We use the terms “we assess” or “we judge” to convey an analytic assessment. We use qualifiers such as “possibly,” “likely,” and “very likely” to convey probability.

Assessments and analyses in this report are based on information available as of September 4, 2025.

Estimative language

The chart below matches estimative language with approximate percentages. These percentages are not derived via statistical analysis but are based on logic, available information, prior judgments, and methods that increase the accuracy of estimates.

Long description immediately follows
Long description - Estimative language chart
  • 1 to 9% Almost no chance
  • 10 to 24% Very unlikely/very improbable
  • 25 to 39% Unlikely/improbable
  • 40 to 59% Roughly even chance
  • 60 to 74% Likely/probably
  • 75 to 89% Very likely/very probable
  • 90 to 99% Almost certainly
Top of page
 

About the Cyber Centre

The Cyber Centre is Canada’s technical and operational authority on cyber security. Part of CSE, we are the single unified source of expert advice, guidance, services, and support on cyber security for Canadians and Canadian organizations. The Cyber Centre works in close collaboration with Government of Canada departments, critical infrastructure, Canadian businesses, and international partners to prepare for, respond to, mitigate, and recover from cyber events. The Cyber Centre is outward-facing and welcomes partnerships that help build a stronger, more resilient cyberspace in Canada. In line with the National Cyber Security Strategy, the Cyber Centre represents a more cooperative approach to cyber security in Canada. The Cyber Centre helps raise Canada’s cyber security bar so that Canadians can live and work online safely and with confidence.

 
Top of page

Message from the Head of the Cyber Centre

At a time when cybercriminals continue to target Canadian businesses, critical infrastructure, and government systems, education on these threats has never been more important. As Canada’s national authority on cyber security, the Cyber Centre is committed to helping Canadians understand, prepare for, defend against, and respond to the digital threats that impact our economy, our institutions, and our daily lives.

Among these threats, ransomware continues to stand out as one of the most disruptive, costly, and persistent challenges facing Canadian organizations of every size. This is why this report, the Ransomware Threat Outlook 2025 to 2027, provides a forward-looking view of the ransomware landscape we anticipate in the next 2 years. Our analysis draws on reporting from across Canada and around the world, classified intelligence from our foreign partners, and insights from the private sector. Together, these perspectives let us identify not only the tools, tactics, and procedures of today’s most prolific cybercrime operators, but also the likely trends and evolutions that will define this threat tomorrow.

As you will read in this report, ransomware is big business. Despite some concerning trends, Canadians can rest assured that the Cyber Centre is keeping pace to address these threats and is developing new tools to defend Canadian networks and systems.

Our objectives are clear: to equip decision makers with the knowledge they need to manage their risk, to strengthen Canada’s resilience, and to safeguard the trust Canadians place in our digital systems. Only by working together can we blunt the impact of ransomware and ensure Canada is secure and resilient in an ever-evolving cyber landscape.

In partnership,

Rajiv Gupta
Head, Canadian Centre for Cyber Security

 
Top of page

Key judgments

  • The ransomware threat in Canada continues to increase and evolve quickly. Threat actors are leveraging various sophisticated tactics to carry out cybercrime. We assess that ransomware actors operating against Canadian targets are almost certainly opportunistic and financially motivated. All organizations, as well as individuals, in Canada almost certainly risk being targeted by ransomware at some point and should bolster their cyber resilience accordingly.
  • Ransomware threat actors have demonstrated adaptability to changes in the digital landscape and will very likely continue leveraging advancements in areas like artificial intelligence (AI) and cryptocurrency while developing new extortion tactics to increase their financial reward.
  • We assess that basic cyber hygiene practices like regular software updates, implementing multi-factor authentication (MFA) and backups, and being cautious of phishing attempts continue to help Canadians and Canadian organizations strengthen their baseline cyber threat readiness. Cyber security practices are not just an optional extension of one’s business. They are integral to protecting critical data and operations, and to safeguarding Canadians who are reliant on the services of organizations responsible for this data.
  • Understanding and mitigating the ransomware ecosystem requires continued cooperation and diligence among law enforcement, government agencies, private organizations, and the Canadian public. We assess that threat actors carrying out ransomware attacks will remain a significant threat to Canada in the next 2 years.
 
Top of page

The threat ecosystem

Between the 1990s and the 2020s, cybercrime changed drastically, bringing about significant shifts in how threat actors and Canadians engage with one another. Understanding the evolution of ransomware provides insight into how cybercriminals take advantage of technological advancements and how changes in the ecosystem have increased the prevalence and pervasiveness of cyber threats. It also helps identify key indicators for future trends.

The evolution of ransomware

  • 1989: Harvard professor, Dr. Joseph L. Popp sent around 20,000 malware-infected floppy disks that used symmetric cryptography to encrypt file names to AIDS researchers in 90 countries. Victims were instructed to send a cheque of up to $378 to a post office box in Panama to receive a decryptor disk to restore their systems. The only individuals who reportedly paid the ransom were investigators. Dr. Popp was arrested and charged with blackmail. This was one of the first documented ransomware attacks. However, following Dr. Popp’s arrest, ransomware incidents remained relatively uncommon until the widespread adoption of the Internet in the 21st century.Footnote 1
  • 2009: The emergence of Bitcoin in 2009 as the first decentralized cryptocurrency, and the surge in popularity of alternative cryptocurrencies in the subsequent years, significantly enhanced cybercriminals’ ability to process payments and launder money from illicit online activities. By providing threat actors with avenues for untraceable funds, Bitcoin helped ransomware become a profitable industry.Footnote 2
  • 2012: The Reveton ransomware was deployed as a malware that installs itself on a victim’s network when they click on a compromised website. The ransomware impersonated law enforcement agencies purporting to have seized control of the device due to the user’s supposed criminal online activity. Victims were threatened with jail time and were ordered to pay a ransom through a prepaid debit card. According to open-source reporting, the operators of Reveton sold the malware to third parties, increasing the number of victims. This marked the first reported occurrence of Ransomware-as-a-Service (RaaS).Footnote 3
  • 2013: The CryptoLocker ransomware first infected Windows computers in September 2013, using malicious attachments in spam and phishing emails as the primary method of delivery. CryptoLocker was one of the first ransomware variants to use sophisticated encryption. Once a device was encrypted, a ransom note would appear, ordering victims to pay a sum to regain access to their files. Cryptocurrency was included as a payment option. The FBI reports that within the first 2 months of operation, the threat actor group had amassed over USD 27 million in ransom. CryptoLocker was distributed through the GameOver Zeus botnet, which was attributed to a Russian cybercriminal. In June 2014, a multinational law enforcement collaboration announced that it successfully disrupted the GameOver Zeus botnet and seized CryptoLocker servers.Footnote 4
  • 2015: The group behind the SamSam ransomware emerged as the first group to consistently engage in targeted attacks against critical infrastructure and larger corporations, including government entities and healthcare organizations in the United States and Canada. This behaviour is now commonly known as “big game hunting” since critical infrastructure and other sensitive organizations are perceived to be more likely to pay larger ransom demands to avoid critical service disruptions or protect sensitive information. In 2018, 2 Iranian men were indicted in the United States on federal charges for deploying the SamSam ransomware to over 200 victims and causing over USD 30 million in lossesFootnote 5.
  • 2017: The May 2017 WannaCry attack was publicly identified as the fastest-spreading and largest-scale global ransomware incident at the time. Once a device was infected, WannaCry—which exploited a Microsoft vulnerability—spread rapidly through a network, infecting other vulnerable machines without human interaction. Although Microsoft had patched the vulnerability months prior, users who failed to install the update were susceptible to the attack. In a single day, the attack infected over 230,000 computers in 150 countries, bringing unprecedented global attention to ransomware.Footnote 6
  • 2019: After an American security company failed to meet payment deadlines set by the Maze ransomware group, the group published around 700 MB of the company’s stolen data on their dedicated leak site to increase pressure on the company to comply with the ransom demand. This is the first known instance of a ransomware group publicly releasing victim data and using double extortion methods. Threat actors publishing sensitive corporate information also eliminated backups as an effective sole mitigation tacticFootnote 7.
  • 2020s: The popularization of RaaS and the development of affiliate-based business models that license malware and distribute profits has lowered the technical barriers to entry for cybercriminals. The rise of initial access brokers has also increased the efficiency of active ransomware groups. By selling network access to threat actors, these brokers reduce the time required to execute an attack. The spread of secure communication platforms and dark web marketplaces and forums has also enhanced threat actors’ ability to actively sell their services, network with cybercriminals, and engage with victims.Footnote 8

The modern ransomware landscape

The modern ransomware landscape is a highly sophisticated and interconnected threat ecosystem that is constantly evolving. Understanding current and emerging trends in the ransomware landscape can help Canadians recognize and better prepare for ransomware risks.

Multi-extortion ransomware attacks

As Canadian organizations expand and bolster their baseline cyber resilience, cybercriminals continually look to modify and adapt their tradecraft to best extort victims across their entire supply chain. We assess that the transition from single extortion to multi-extortion methods is indicative of cybercriminals’ increased sophistication and of their motivation to increase both the impact of their attacks and the likelihood of victims paying the ransom.

According to open-source reporting, potential multi-extortion strategies include distributed denial-of-service (DDoS) attacks and contacting third-party entities associated with an organization—including its suppliers, partners, or customers—for ransom.Footnote 9 In addition to financial losses and sensitive data leaks, multi-extortion attacks can damage an organization’s reputation due to service outages or the revictimization of victims.

Exfiltration-only attacks

Although most ransomware groups will likely continue to use encryption in their ransomware, we assess that the trend of threat actors adopting exfiltration-only attacks is a notable shift in behaviour. In November 2024, the ransomware group Hunters International focused primarily on exfiltration-only attacks and extortion.Footnote 10 In January 2025, Hunters International very likely rebranded to World Leaks, an extortion-based group that provides its custom-built data exfiltration tool to affiliates for them to use against victims.Footnote 11 Open-source reporting attributes the growing trend toward exfiltration-only attacks to how quickly and simply these attacks can be deployed and executed compared with encryption-based attacksFootnote 12.

Evolutions in victim demography

Critical infrastructure and large corporations remain attractive targets for ransomware actors. However, based on recent developments in victim demography, we assess that no organization is immune to cyber incidents. Businesses with fewer cyber security resources may face more challenges in responding to sophisticated ransomware attacks.

Ransomware actors often leverage initial access points such as unpatched software, compromised credentials, phishing, or remote desk protocol. This can generate particular vulnerabilities for entities with minimal capabilities to invest in information technology (IT) infrastructure or cyber security training for employees.Footnote 13

The impacts of ransomware—including operational downtime, supply chain delays, diminished consumer trust and recovery costs—can have serious impacts on small and medium businesses and could be the deciding factor on whether these businesses are able to remain commercially viable.Footnote 14 Organizations with few internal cyber security specialists also often hire third-party managed service providers (MSPs) to handle IT and information management services. Because of their expansive client networks and access to sensitive information, MSPs are attractive targets for cybercriminals.Footnote 15

Artificial intelligence

We assess that, as AI becomes more sophisticated and more integrated into Canadian organizations, some cybercriminals will almost certainly adopt AI capabilities to target victims and lower technical barriers to entry into the ransomware ecosystem. Threat actors have been leveraging improvements in generative AI, particularly large language models, across various stages of ransomware attacks, including:

  • developing malware
  • generating deepfakes
  • automating negotiations with victims
  • conducting vulnerability research
  • implementing social engineering strategies

This contributes to reducing the skill and resource constraints that cybercriminals typically face.Footnote 16

Decentralized finance and cryptocurrency

We assess that ransomware actors will continue to leverage cryptocurrency because of the anonymity it offers compared with mainstream financial assets. Increased regulatory pressures and law enforcement action against virtual financial crimes have further encouraged threat actors to find ways to hide their transactions.Footnote 17

Cryptocurrency helps cybercrime profits transcend borders, increasing the scope of threat actors’ illicit activities and posing challenges for law enforcement investigations. In 2023, the Financial Transactions and Reports Analysis Centre of Canada stated that the movement of proceeds derived from fraud and ransomware attacks is the most prevalent form of money laundering involving virtual currencies.Footnote 18

Virtual assets
Cryptocurrency
Cryptocurrencies are digital tokens that depend on cryptographic techniques to pseudo-anonymously transfer funds through a public ledger (blockchain) that records transactions between cryptocurrency wallet addresses. Cybercriminals often use cryptocurrency like Bitcoin (BTC) for illicit transactions.Footnote 19
Privacy coins
Privacy coins are a type of cryptocurrency that provide greater anonymity because they operate on their own blockchain to conceal users’ identities and transaction histories. Examples include Monero (XMR), Zcash (ZEC), and Dash (DASH)Footnote 20.
Obfuscation and laundering techniques
Chain hopping
Chain hopping is when cybercriminals transfer funds from one blockchain to another to obfuscate the funds’ illicit origins.Footnote 21
Mixers
Mixers are services that break links between the original and final address of cryptocurrency funds to hide the funds’ illicit originsFootnote 22.

Geopolitical influence on ransomware

Geopolitical conflicts are increasingly extending into the digital environment as more governments engage in cybercrime, including ransomware, as an alternative means to retaliate against adversaries or bypass international sanctions. Cybercriminal engagement varies by state: some states provide resources and protection to cybercriminals directly while others quietly permit cybercrime as long as it aligns with their political interests and does not impact victims within their country.Footnote 23

During the Russian invasion of Ukraine in 2022, the ransomware group Conti publicly threatened to retaliate against Western countries that launched cyber attacks against Russian critical infrastructure.Footnote 24 According to open-source reporting, amid ongoing conflict in the Middle East, a ransomware group linked to the Islamic Republic of Iran began offering higher proceeds to actors who engaged in cyber attacks on Iran’s adversaries.Footnote 25

The Cyber Centre continues to monitor how geopolitics impact cybercrime and the degree to which state actors engage with cybercriminals in pursuit of their countries’ strategic objectives.

 
Top of page 

The state of ransomware in Canada

The majority of the top ransomware groups impacting Canada are almost certainly financially motivated and opportunistic. We assess that the core membership of these groups is most likely Russian speaking and operating out of the Commonwealth of Independent States (CIS), although their affiliates operate globally.

As outlined in the Cyber Center’s National Cyber Threat Assessment 2025-2026, law enforcement actions and geopolitical events can cause fluctuations in cybercrime activity. However, we assess that ransomware incidents in Canada are on the rise overall and continue to increase annually across most sectors.

Ransomware payments have fluctuated over the past 4 years, which could be a result of fewer or smaller payments made by victims combined with an increase in the total number of Canadian victims. Although most financially motivated ransomware actors operate opportunistically, Canadian critical infrastructure will likely continue to be a desirable target due to the perception that these organizations are more inclined to pay ransom demands to minimize disruptions.

The Cyber Centre observed an increase in the number of ransomware incidents in 2024 compared with 2023. We assess that it is very likely that RaaS has lowered technical barriers to entry for threat actors into the ransomware ecosystem and allowed for the proliferation of sophisticated tactics, techniques, and procedures (TTPs) that are leveraged against Canadians and Canadian organizations. We assess that, due to underreporting, the number of ransomware incidents and payments is almost certainly higher than what is shown in the figures below.

Figure 1: Growth from 2021 of Canadian ransomware incidents known to the Cyber Centre
Growth from 2021 of Canadian ransomware incidents known to the Cyber Centre - Long description immediately follows
Long description - Figure 1: Growth from 2021 of Canadian ransomware incidents known to the Cyber Centre

A chart indicates that, despite a small reduction in total recorded ransomware incidents in 2022, there has been a 26% average year-over-year increase from 2021 to 2024, and that average is estimated to continue through 2025.

In 2024, the top 3 ransomware threats to Canada were:

  • Akira: Akira is a RaaS group that emerged in April 2023 and is very likely connected to the disbanded ransomware group Conti.Footnote 26 The group operates 2 ransomware variants. It exfiltrates victim data before encrypting victim devices and leverages stolen data to perform double extortion.Footnote 27 Akira has been used to impact industries in manufacturing and telecommunications globally and in Canada.Footnote 28
  • Play: Play is a ransomware group that emerged in June 2022 as a closed group and shifted to a RaaS model in November 2023. The group operates a ransomware variant by the same name and leverages a double extortion model.Footnote 29 Play has been used to impact organizations in the information and technology and professional services sectors globally and in Canada.Footnote 30
  • Medusa: Medusa is a RaaS group that emerged in June 2021. The group operates a ransomware variant by the same name and leverages a double extortion model. Medusa has been used to impact various critical infrastructure organizations, as well as information and communications technology sectors globally and in Canada.Footnote 31

Ransomware can have severe impacts on an organization’s business operations and the security of their sensitive information. It can also damage an organization’s reputation. All of this can impact an organization’s competitiveness across its sector and within the broader Canadian economy.Footnote 32

Canadian Survey of Cyber Security and Cybercrime

Statistics Canada conducts the Canadian Survey of Cyber Security and Cybercrime (CSCSC) on behalf of Public Safety Canada. This survey gathers information on the financial and operational effects of cybercrime on Canadian businesses. It also gathers information on the readiness of Canadian businesses toward implementing proactive cyber security and managing security incidents. The most recent CSCSC data, published in October 2024, uses information gathered in 2023 from a sample of over 12,000 Canadian organizations. The survey provides key insights into the prevalence and impacts of cyber incidents, including ransomware, in addition to evolutions in security postures and procedures among Canadian businesses.Footnote 33

13% of businesses reporting cyber security incidents identified ransomware as the method of attack, a 2% increase since the 2021 CSCSC.

Following an increase of CAD 200 million from 2019 to 2021, the total recovery costs associated with cyber security incidents in 2023 doubled to CAD 1.2 billion.

Approximately 22% of businesses reported that formal training was provided to non-IT workers to improve and progress their cyber security skills.

There was an 11% decrease in organizations employing cyber security workers, primarily due to the use of third-party cyber security consultants and MSPs.

 
Top of page 

Cyber snapshots

Across Canada, organizations are increasingly forced to reckon with the evolving cyber threat landscape. Ransomware can have serious consequences for business functions, supply chain management, and customer confidence when cybercriminals disrupt operations, steal or leak sensitive information.

We assess that ransomware actors will continue to target Canada and Canadian organizations in the next 2 years. Examining publicly reported case studies of ransomware incidents can help contextualize the impacts to business functions and communities that rely on these organizations’ services. Understanding the real-life implications of ransomware can help Canadians recognize the severity of the issue and recognize how they, their businesses, and their communities may be impacted.

Public sector

Example one

A Canadian entity in the public sector reported that they were the victim of a cyber security breach. The breach caused widespread technical outages, leaving services unavailable for months. Rather than pay the ransom, the entity chose to rebuild their systems.

Following the initial detection of suspicious activity, the entity engaged with its incident response team, external security consultants, law enforcement, and legal counsel to investigate and contain the breach.

An impact assessment revealed that threat actors initially accessed the network but remained dormant for months before exfiltrating data. The stolen data included information on staff and their dependants. The data also included information on customers, contractors, stakeholders, volunteers, and job applicants, including personal, medical, and financial information.

Example two

A Canadian public sector organization was the target of a ransomware attack that significantly disrupted operations.

Within days, the organization contained the incident and recovered most of their services from system backups. It maintained that no ransom was paid and that, following a forensic analysis, it found no evidence that the threat actors retrieved any sensitive or personal information.

Despite the restoration of some services, certain systems remained unusable for months after the incident. Recovery and rebuilding costs were estimated in the millions of dollars.

Private sector

Two Canadian logistics companies experienced a breach involving customers’ personal information.

The entities reported the attack to the potentially affected parties, relevant federal authorities, and the Office of the Privacy Commissioner of Canada (OPC). The OPC launched an immediate investigation to evaluate the effectiveness of the precautions in place to safeguard the sensitive information.

A ransomware group claimed responsibility for the attack and alleged to have stolen a significant volume of documents.

Retail sector

A large Canadian health retailer reported a ransomware attack that forced operations to be shut down for days while systems were rebuilt.

The organization refused to pay the ransom and deployed countermeasures to protect their networks from additional compromise. External experts and law enforcement were engaged to contain the threat and restore systems. The entity stated that the ransomware attack compromised data related to their human resources and finance departments, including some employee data.

Education sector

An education technology organization announced that a threat actor had leveraged a compromised credential for a customer support portal to gain access to sensitive data. The impacted databases contained information from millions of individuals.

The organization reported the incident to relevant law enforcement authorities, and made the decision to pay the ransom. Despite assurances from the threat actor that the stolen information would be deleted, it was announced that the threat actor continued to contact victims in an attempt to re-extort them with the same data from the initial incident.

Energy sector

A Canadian entity in the energy sector confirmed that it was the victim of a ransomware attack that resulted in the leak of sensitive personal and banking information from many current and former customers. The entity notified all impacted customers and offered credit monitoring and identity protection at no cost.

The entity confirmed that they did not pay the ransom demand and enacted their incident response protocols, engaging with cyber security experts to assess the impact of the attack and rebuild and restore impacted systems.

 
Top of page 

Myths and misconceptions

A key step to Canadians bolstering their baseline resilience to cyber attacks is debunking common misconceptions and beliefs. This includes Canadians building a better understanding of their proximity to threats and the sensitivity of their personal or business information, as well as taking important steps for incident response.

“We’re too small to be a target”

We assess that any Canadian organization, small or large, can likely be susceptible to cyber threats and the impacts of ransomware. Although some ransomware groups maintain a self-proclaimed “moral code,” whereby they refrain from targeting certain organizations (for example, hospitals, charities, government agencies, religious institutions), others will target any organization.Footnote 34

Groups that are more technically sophisticated and well resourced may conduct proactive research on companies to identify those most likely to pay ransom demands. Meanwhile, other threat actors prioritize increasing dedicated leak site posts, regardless of victim size, to bolster their reputation.

Smaller businesses often use MSPs to manage parts of their operations, or integrate parts of their supply chains with multiple other entities. This can increase the threat surface for these businesses if those third parties experience compromises.

Resources:

“We don’t need all these cyber security tools and rules”

Every time Canadians leave their homes, it is very likely that they mitigate any potential risks by closing their windows, locking their doors, and turning on their security systems.

Similarly, implementing basic cyber hygiene practices can significantly reduce the likelihood of ransomware attacks. Routine training and education for employees help foster personal diligence and strengthened cyber security awareness. This can have a tremendous impact in preventing common forms of entry for ransomware, including:

  • spoofed websites
  • phishing messages
  • compromised login credentials

Flagging suspicious content and taking a moment to think critically and validating URLs and email addresses as well as are simple steps that individuals can take to prevent malware infections.Footnote 35 Other measures that individuals and organizations can take to protect themselves against ransomware include:

  • routine backups
  • automatic updates
  • security tools

Resources:

“Paying the ransom is the easiest way to get our data back”

There is no guarantee that threat actors will unlock systems or return stolen data if organizations that experience a ransomware attack pay the demanded ransom. Threat actors can copy the data and use it to revictimize an organization or its customers for more money.Footnote 36

Cyber insurance as a proactive protection measure against ransomware can encourage organizations to align their cyber security postures with insurance policy standards. However, if insurance policy documents are not properly protected on an organization’s website or systems, sophisticated ransomware actors could obtain information on coverage amounts and leverage it in ransom negotiations to maximize their payment.Footnote 37

“I don’t run a business, so why should I care about ransomware?”

In the current digital landscape, countless organizations likely collect and store your sensitive information. If those corporations suffer a ransomware attack, your personal data could be indirectly compromised. A ransomware attack can lead to spillover effects that can impact Canadians, regardless of their job or their diligence with data. When cyber attacks disrupt organizations that provide essential services, they can severely limit public access to pharmaceuticals, transportation, internet services, and other critical resources.

“I don’t care if my data is out there—they can have it”

Organizations are increasingly responsible for handling immense amounts of personal data from Canadian customers, from sensitive financial details to contact information and health records. In the aftermath of a ransomware attack, threat actors often sell compromised consumer data on the dark web. Once your data has been compromised, it will very likely remain in this ecosystem. This increases your vulnerability to threats like targeted phishing email campaigns, which can then impact your clients, family, and friends.Footnote 38

Business owners should be concerned about their data security since a compromise of their information (such as intellectual property) can directly impact their reputation, financial security, and market competitiveness.

Reporting ransomware

If you or your organization experience a ransomware attack, we advise you to report it to your local authorities, the Canadian Anti-Fraud Centre, and the Cyber Centre (through My Cyber Portal or by email at contact@cyber.gc.ca).

Reporting cyber attacks allows relevant authorities to properly investigate attacks and identify the source of the compromise to protect your organization and others from future incidents.

Understanding the ransomware landscape in Canada depends on our comprehension of the size and nature of threat actors. By reporting cyber attacks, you help contribute to a safer, smarter Canada.

 
Top of page 

Outlook

We assess that ransomware will remain a significant threat to Canada, requiring substantial attention from Canadians in the coming years. As organizations become more integrated into the digital landscape, increasing exploitation opportunities for threat actors, their infrastructure and sensitive data will very likely continue to be at risk of compromise by ransomware.

Cyber threat actors have, and will continue to, evolve their TTPs, including extortion tactics and victim demography, to increase the impact of their attacks and their opportunities to reap financial reward. However, Canadian organizations can do a lot to protect themselves from these threats. It is crucial that Canadian organizations looking to safeguard their systems and information consider cyber security at the core of everything they do. This includes implementing fundamental cyber security practices such as patching operational technology, enabling automatic updates and MFA, and encouraging secure-by-design. Canadian organizations should also take advantage of the tools available to them — such as the malware detection and analysis tool, Assemblyline, developed by the Cyber Centre — to continuously monitor their networks and stay vigilant of evolving threats.

Continued collaboration between domestic law enforcement, the private sector, and international allies will be required to bolster understanding of the threat ecosystem and to coordinate appropriate proactive and responsive actions to prevent the global impact and spread of ransomware.

The Cyber Centre works around the clock to detect and defend against ransomware and other similar cyber threats. One of the ways we do this is by providing pre-ransomware notifications to warn potential victims during the initial stage of a ransomware incident. Through these notifications, cyber defenders can pinpoint and stop ransomware attacks before any data is compromised. In the 2024 to 2025 fiscal year, we issued 336 pre-ransomware notifications to over 300 Canadian organizations, resulting in an economic savings of up to CAD 18 million.

For more information on how Canadians and Canadian organizations can protect themselves against the ransomware threat and bolster their overall cyber resilience, we encourage them to consult our Cyber Security Readiness Goals, Ransomware Playbook, and other cyber security guidance available on the Cyber Centre website.

 
Top of page 

Glossary

Artificial intelligence (AI)
A subfield of computer science that develops intelligent computer programs to behave in a way that would be considered intelligent if observed in a human (for example, solve problems, learn from experience, understand language, interpret visual scenes).
Big game hunting
The practice of targeting critical infrastructure and other sensitive organizations because they are perceived to be more likely to pay larger ransoms to avoid critical service disruptions or to protect sensitive information.
Botnet
A network of computers forced to work together on the command of an unauthorized remote user. This network of compromised computers is used to attack other systems.
Commonwealth of Independent States (CIS)
A regional organization established in 1991 that comprises 9 member states previously part of the Soviet Union: Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Tajikistan, and Uzbekistan.
Cryptocurrency
Virtual assets that use cryptography to protect and affirm their ownership. Units of cryptocurrency are called “coins,” such as Bitcoin and Ether. Cryptocurrency transactions are generally recorded on their respective blockchains. “Tokens” represent a certain value of “coins” and can be used to buy certain goods and services. Cryptocurrencies operate on a peer-to-peer system and are not managed by a central authority like a bank, government, or country.
Cyber insurance
A specialized product intended to help businesses manage losses caused by computer networking threats such as data breaches and cyber extortion. Cyber insurance can cover a range of cyber events, including confidential data breaches, cyber extortion, and technology disruptions.
Dark web
An unindexed segment of the Internet that is only accessible through specialized software or network proxies. Due to the inherently anonymous and private nature of the dark web, it facilitates a complex ecosystem of cybercrime and illicit goods and services trade.
Decryptor
A specialized tool designed to help businesses recover encrypted files without having to pay attackers for decryption keys.Footnote 39
Dedicated leak sites
Websites where ransomware threat actors publish data stolen from companies that refuse to pay the ransom. These sites can contain sensitive information such as login credentials, intellectual property, and personal and financial data. They put victim organizations at risk of security breaches, identity theft, financial fraud, reputational damage, and legal consequences.Footnote 40
Deepfakes
Content that has been digitally manipulated and is intended to deceive. This includes artificially generated images, audio, and videos.
Distributed denial of service (DDoS)
A type of cyber attack in which threat actors aim to disrupt or prevent legitimate users from accessing a networked system, service, website, or application.
Double extortion
When ransomware actors exfiltrate files before encrypting them and threaten to leak sensitive information publicly if the ransom is not paid.
Encryption
Converting information from one form to another to hide its content and prevent unauthorized access.
Exfiltration
The unauthorized transfer of data from a network, system, or device.Footnote 41
Generative AI
A class of AI models that emulate the structure and characteristics of input data to generate synthetic content. This can include images, audio, text, and other digital content.Footnote 42
Initial access brokers
Threat actors that sell access to corporate networks.Footnote 43
Large language models
Artificial neural networks that are trained on very large sets of language data using self- and semi-supervised learning. Large language models initially generated text via next-word prediction but can now take prompts so that users can complete sentences or generate entire documents on a given topic. Training on exceptionally large datasets allows the model to learn sophisticated linguistic structures and the biases or inaccuracies found in that data.
Malware
Malicious software designed to infiltrate or damage a computer system, without the owner’s consent. Common forms of malware include computer viruses, worms, Trojans, spyware, and adware.
Managed service providers (MSP)
Companies that offer a range of information management and information technology services. This includes physical, virtual, or cloud infrastructure, as well as providers who manage stored data primarily in a virtual environment.
Multi-factor authentication (MFA)
A tactic that can add an additional layer of security to your devices and accounts. Multi-factor authentication requires additional verification (like a PIN or fingerprint) to access your devices or accounts. Two-factor authentication is a type of multi-factor authentication.
Phishing
An attempt by a third party to solicit confidential information from an individual, group, or organization by mimicking or spoofing a specific, usually well-known brand, typically for financial gain. Phishers attempt to trick users into disclosing sensitive personal data, such as credit card numbers or online banking credentials, which they may then use to commit fraudulent acts.
Ransomware
Type of malware that denies a user access to a system or data until a sum of money is paid.
Ransomware-as-a-Service (RaaS)
A core group of developers sell or lease their ransomware variant to other threat actors, called affiliates. The core developers will allow affiliates to deploy their ransomware in exchange for upfront payment, subscription fees, a cut or profits, or all 3.
Social engineering
The practice of obtaining confidential information by manipulating legitimate users. A social engineer will often trick people into revealing sensitive information over the phone or online. Phishing is a type of social engineering.
Symmetric cryptography
A cryptographic key is used to perform a cryptographic operation and its inverse operation (for example, encrypt and decrypt, create a message authentication code and verify the code).
Tactics, techniques, and procedures (TTP)
The behaviour of an actor. A tactic is the highest-level description of this behaviour, while techniques give a more detailed description of behaviour in the context of a tactic, and procedures an even lower-level, highly detailed description in the context of a technique.Footnote 44
Vulnerability
A flaw or weakness in the design or implementation of an information system or its environment that could be exploited to adversely affect an organization’s assets or operations.
]]>https://cyber.gc.ca/en/guidance/cyber-security-considerations-drone-use-itsap00143<![CDATA[Cyber security considerations for drone use (ITSAP.00.143)]]>2026-01-27T19:41:05Z

Drones are mobile vehicle systems that can function with varying degrees of autonomy from human operators. Depending on their design and function, they may also be called remotely operated systems, remotely piloted aircraft systems, or uncrewed ground/underwater vehicles.

Before deploying a drone, you should conduct a threat risk assessment (TRA). A TRA will help to identify potential security threats and determine the appropriate cyber security measures required to mitigate them. Understanding the risks associated with the use of drones for business or operational purposes will enhance your organization’s ability to protect your systems, data, and networks.

On this page

Types of drones

There are many styles of drones that have different forms and serve varying purposes. They can be generally categorized into 3 main types based on their design and intended use: commercial, own-made and professional.

Commercial drones

These drones are produced by commercial organizations and used to support business and individual activities. Commercial drones have a wide range of applications, depending on the field or line of business. Some examples include aerial photography, agricultural spraying and package delivery. Commercial drones generally use commodity parts with low-security supply chains.

Own-made drones

These drones are built and created by individuals or organizations, often for personal use. Own-made drones can also be organization-made and used to control features that would typically be managed by third parties. These drones generally use a mix of custom-made hardware, software and parts, which allows for more visibility into supply chains.

Professional drones

Professional drones are used in critical environments, such as military or search and rescue. These drones are used for tasks like perimeter surveillance, emergency response and industrial inspection. They typically feature components that have complete visibility and control of supply chain contents.

Professional drones can be used for many purposes, including:

  • recreation
  • surveillance
  • commerce
  • data collection
  • infrastructure monitoring and inspection
  • emergency response
  • public safety
  • security

How drones work

Drones can operate without a physical connection to a controller (for example, untethered and remote). They work semi-autonomously by using stability control, following a pre-programmed path or by human control. Some drones are capable of fully autonomous modes of operation, using onboard systems to navigate and perform tasks without real-time human input. An example of autonomous mode are drones that follow a pattern. Some drones connect to the Internet or require data to be transmitted through the Internet. Most rely on satellite systems to provide global positioning and timing services.

A drone’s functionality is supported by 2 main components: on-board and off-board systems.

On-board systems include:

  • central control computer
  • communication modules
  • movement and stability controls
  • positioning and navigation tools (like GPS and visual or acoustic sensors)
  • data collection tools (like camera and microphones)

Off-board systems include:

  • a control station (like a computer or mobile device)
  • a user interface for monitoring and issuing commands
  • data display and storage systems

Risks associated with drones

Drones are susceptible to a variety of cyber threats that can compromise their functionality and the data they collect. Most notably, drones can pose significant risk to your organization when connected directly or indirectly to your network. They are untrusted devices meaning their connection can be leveraged by threat actors as an attack vector or used to gain remote access to your environment.

Another common risk involves drones being misled through satellite navigation interference. For example, signals can be jammed or spoofed to create false signals and prevent communications from reaching the drone. This can cause the drone to go off course without realising that it has changed trajectory. Unintentional electromagnetic interference can also disrupt drone communication signals.

If your drone is compromised, threat actors may be able to:

  • take control of the drone from the current authorized operator
  • steal authentication and encryption mechanisms used by drones to gain access
  • acquire images, the location of the operator and other data captured by sensors
  • access sensitive information through drone images that contain metadata, revealing operational activities (for example, timestamps and location coordinates)
  • exploit vulnerabilities in other systems by injecting malware

Artificial intelligence risks

Drones with artificial intelligence (AI) functionality may be vulnerable to different attack methods. Manipulated inputs to the drone can cause AI models to misinterpret data, leading to incorrect decisions. Consider the following examples of AI-related attacks.

Data manipulation

Images can be manipulated to deceive AI navigation systems by altering sensor inputs or physical objects. This can cause navigation systems to misinterpret information and may lead to incorrect or unexpected operational outcomes.

Data poisoning

Threat actors can corrupt training data through data poisoning attacks. This can result in faulty AI decision-making.

Swarm attacks

Threat actors can conduct swarm attacks which enable multiple AI-functioning drones to operate autonomously and collaboratively to overwhelm defences.

Denial of service attacks

Threat actors can gain unauthorized access to perform arbitrary code execution (for example, using commands or code to disable the drone or its process) due to traditional software vulnerabilities.

Management platforms and software risks

Drone management platforms or the software used to operate and manage drones rely on:

  • remote connections
  • cloud platforms
  • flight telemetry sensors
  • cloud infrastructure

These platforms and software can present further threat surfaces to your drones and data. If compromised, your drones and data are at risk of having their images and coordinates stolen, losing control and losing sensitive information. Some of these platforms may use sensitive authentication credentials used to access higher security levels, which can be a greater risk to your data if compromised.

Considerations for vendor selection

When selecting a drone vendor or manufacturer you should ask cyber security related questions, such as:

  • Does the drone manufacturer engage in secure-by-design and secure-by-default practices?
    • Products that incorporate secure-by-design and secure-by-default prioritize the security of customers as the core business requirement
  • How does the drone minimize the effects of satellite spoofing and jamming attacks?
  • Has a vulnerability analysis been performed on the drone, controller and any peripherals and has it been shared by an independent and verified third party?
  • Is a list of all components and dependencies used in the software application available from the manufacturer?
    • This is required to reflect the scope of vulnerabilities or mitigations in the software used for the drone and related systems
  • Is supply chain information available for the drone and peripherals?
    • Knowledge of the supply chains used in manufacturing the drone and related system offers information on potential vulnerabilities
  • What documentation exists to ensure that proper cryptographic methods have been validated, applied and subjected to thorough testing?

Regarding user functionality and what security measures you might have to keep up with, consider the following questions:

  • Do the drone, controller and peripherals require frequent updates?
    • You should only update the firmware and software if necessary (for example, for security patches)
    • Perform updates on separate, isolated systems to protect sensitive information and operations
  • Can the drone, controller or peripheral firmware updates be reversed or returned to the previous version?
    • Before installing patches, review the related details for necessary security features, as updates can include undesirable features or introduce other vulnerabilities
  • Are proprietary software and drivers required to be installed on the systems to handle data with the drone?
    • A device with access to your systems could expose those systems to threat actors
  • Can a static code analysis (for example, examining the source code to identify vulnerabilities) be performed on the firmware or other software used to control or interact with the drone?
    • This offers stronger cyber security and can be easily scanned and analyzed for vulnerabilities by a variety of third parties
  • Is strong encryption used to store and communicate drone images?
    • Encryption secures the data being stored on and transferred to and from the drone
  • Can the drone store images and data by using on-board memory (for example, an SD card)?
    • Using a secure peripheral to store and import data to a scanned external device can be more secure than using proprietary software
  • Does the drone, controlling system and any peripherals connect to a cloud platform?
    • Connecting to a cloud platform can introduce cloud-based vulnerabilities and threats

Considerations with own-made drones

When choosing to create or use an own-made drone, you should consider the following cyber security measures:

  • Ensure that the source code is open source and has been audited by a verified organization
  • Ensure that strong encryption practices are used to encode images stored and transmitted
  • Test the drone thoroughly and make improvements where necessary
  • Consider redundant and fail-safe systems (for example, ensure the system will function as needed if one or more parts fail)
  • Make sure emergency remote takeover systems for human supervision exist
  • Ensure the system architecture is well documented and includes all components
  • Monitor and log activities for continuous security enhancements (for example, incident response)

Securing your drone

There are many cyber security considerations when setting up and securing your drone. The following actions can strengthen the security of your drone and your data:

  • Use a dedicated or stand-alone controller for your drone rather than a mobile device used for other purposes
  • Establish an isolated environment or zone for drone use so you can control and monitor network access
  • Ensure the networks that the drones and related systems use are separate from networks used by other trusted systems to isolate the threat from other sensitive environments
  • Use strong encryption to secure the data transferred to and from the device
  • Set up a separate and secure isolated environment to transfer, install and scan recorded data and required applications (for example, updates and patches)
  • Use an SD card or external peripheral to transfer sensitive data rather than cloud connections
  • Disable default cloud connections
    • If you need to use the cloud, use on-premises cloud platforms with strong encryption to protect data in transit and at rest
  • Mitigate jamming or spoofing attacks by integrating tools (for example, microelectromechanical systems or fibre-optic cables) that recognize other signals and can be used for alternate guidance methods

Consider the following security tools to stay vigilant and monitor your drone data and activity:

  • Take note of the information that could be accessed by the drone and shared with third parties when configuring your device
  • Be suspicious of what data is being shared with remote servers and use a virtual private network to transfer the data
  • Request a copy of the source code for the firmware and other drone software so your IT team can run a static code analysis
  • Request evidence of a comprehensive third-party vulnerability assessment
  • Monitor suspicious activity by implementing an intrusion detection and prevention system on the network used by drones to detect and block the traffic immediately
  • Use monitor logs to indicate vulnerabilities, further secure sensitive information and patch areas that need greater security
  • Implement a zero trust architecture if handling sensitive data and to mitigate AI related risks

Learn more

]]>https://cyber.gc.ca/en/guidance/what-do-when-your-organization-has-been-compromised-cyber-attack-itsap00009<![CDATA[What to do when your organization has been compromised by a cyber attack (ITSAP.00.009)]]>2026-01-21T16:49:12Z

Cyber attacks are common and can impact organizations of all sizes, within all sectors. This publication provides guidance on the actions you should take in the critical moments after a compromise is detected to lessen the impact on your organization.

On this page

What to do after discovering a compromise

The moments immediately after a compromise is detected are crucial to minimizing the impacts. Take the following steps immediately after detection.

Keep the system powered on

Your device holds volatile forensic evidence that can be used to help determine the source and scale of the suspected compromise. Although it may seem obvious to restart your device to see if the problem persists, it’s important to keep all potentially compromised devices turned on. You should take note of important information that may otherwise be lost.

To best preserve this evidence:

  • Lock the system
  • Do NOT shut down the system
  • Do NOT reboot the system
  • Do NOT log the current user out

Do not destroy any forensic evidence during the entirety of the investigation. Logging off, or even temporarily removing the device’s power source, will clear it of all volatile data.

Verify the incident

Contact your IT department to perform a thorough sweep on impacted devices. They can confirm if the issue is truly an incident and whether the host device is compromised. To assist IT in verifying the incident, ensure you have the following information:

  • When you first suspected a compromise
  • Which devices you think are compromised
  • Who had access to the compromised device(s) and information
  • Who currently has access to the device(s) and do they require access
  • When did you last perform system and software updates
  • What types of information do you suspect were stolen
  • How many people do you think were affected and do you have their contact information
  • Who is the designated point of contact for your organization
  • Does the designated point of contact have the authority to permit and conduct forensic imaging for the sake of investigation
Top of page
 

Recommended IT response to a compromise

Once your IT department has verified that an incident has occurred and there is a compromise, they should take the following steps to respond. These steps will help to minimize the impact of the compromise on your organization.

Contain the incident

Depending on the device or scale of the compromise, you may need to use a combination of these techniques for complete isolation:

  • Isolate all compromised devices and systems from the network by using tools that support a quarantine feature
  • Place the compromised devices in a separate virtual local area network
  • Deactivate the network interface card
  • Disallow Wi-Fi connection or remove the network cable
  • Review access and control privileges in your organization and limit access where possible
  • Revoke access to any third-party apps or services connected to the compromised accounts and review and manage app permissions

Inform necessary stakeholders

When an incident occurs, ensure you inform those in your organization that need to know. Consult with legal and financial counsel if necessary. Consider contacting relevant service providers, such as cloud service providers or managed service providers, who may offer additional assistance and security measures during your investigation.

The Privacy Act applies to the Government of Canada and private sector organizations are governed by the Personal Information Protection and Electronic Documents Act (PIPEDA). Private sector organizations are required to:

  • report to the Privacy Commissioner of Canada any data breach involving personal information that poses a risk of significant harm to individuals
  • notify individuals affected by the breach
  • retain records related to the breach

Collect evidence

Before starting an investigation, your organization should have a dedicated forensics workstation to minimize contamination with other devices. Also, your organization should ensure that the appropriate authority has approved of these investigative actions. We recommend taking note of all the actions taken, including the purpose of each task. Your IT department can also take the following actions to collect investigative evidence.

Acquire volatile evidence

Volatile evidence is data that is only present when the device is powered on and running, such as random access memory (RAM). It is vital that the compromised device stay powered on until all volatile forensic evidence is collected and preserved. The collected evidence should be stored on an external device for safekeeping.

Acquire non-volatile evidence

Non-volatile evidence is data that persists even when there is a loss of power, for example, disk images (a bit-by-bit copy of data on disk).

Check for BitLocker encryption

BitLocker is a full-volume encryption feature on Microsoft Windows products designed to protect data by providing encryption for entire volumes. If you are collecting BitLocker encrypted data, make sure to have the BitLocker recovery key on hand.

Top of page
 

Learn more

Top of page
]]>https://cyber.gc.ca/en/guidance/developing-your-it-recovery-plan-itsap40004<![CDATA[Developing your IT recovery plan (ITSAP.40.004)]]>2026-01-16T19:03:08Z

Unplanned outages, cyber attacks, and natural disasters can happen unexpectedly. Your organization may lose information or experience downtime that disrupts or stops critical business functions. Unplanned downtime is expensive and could have a lasting impact on your business. To ensure continued operations with minimal downtime, your organization should have an IT recovery plan as part of your overall business continuity approach. The IT recovery plan should identify critical data, applications, and processes, and define how your organization will recover IT services that support business operations, products, and services.

On this page

 

Your IT recovery plan should clearly identify and document what needs to be recovered, when, where, and by whom.

In general, there are 3 types of plans you should consider developing for your business. These plans take into consideration major events that could cause an unplanned outage and require a recovery response.

  • Incident response plan: Event-focused plan, specific to a security incident like a cyber attack affecting an organization
  • Business continuity plan: Specific plan to quickly resume only the most critical operations, as defined by a business impact analysis, in the event of a disaster
  • Disaster recovery plan: Holistic plan to return your organization to full operations after a disaster

Know your business disruption tolerance

To develop an effective recovery plan, you should tailor it to address the impact an incident would have on your organization. Your plan should also specify the level of disruption your organization is willing to accept if an incident occurs. There are 3 key measures to consider in your plan:

  • Maximum tolerable downtime: The total length of time that a process can be unavailable without causing significant harm to your business
  • Recovery point objective: The measurement of data loss that is tolerable to your organization
  • Recovery time objective: The planned time and level of service needed to meet the system owner’s minimum expectations

Identify your critical business functions, applications, and data

Your plan should identify your organization’s critical data, applications, and functions. Critical data may include financial records, proprietary assets, and personal data.

Critical applications are the systems that run your key business functions and are imperative to your business. These are the systems that must be restored immediately for business continuity in the event of an unplanned outage.

To identify critical business functions, applications, and data, you should conduct a risk assessment to identify threats and vulnerabilities. Run through specific scenarios (such as a cyber attack, significant power outage, or natural disaster) to identify key participants and stakeholders. Reviewing these scenarios will also help you address significant risks, develop mitigation strategies, and identify the recovery time and effort.

Conduct a business impact analysis (BIA) to predict how disruptions or incidents will harm your operations, business processes and systems, and finances. During your BIA, you should also assess the data that you collect and the applications that you use to determine their criticality and choose priorities for immediate recovery.

Create your IT recovery plan

Complete to the following steps when creating your organization’s IT recovery plan.

  1. Identify stakeholders, including clients, vendors, business owners, systems owners, and managers
  2. Identify your response team members, as well as their roles and responsibilities
  3. Take inventory of all your hardware and software assets
  4. Identify and prioritize critical business functions, applications, and data
  5. Set clear recovery objectives
  6. Define back-up and recovery strategies
  7. Test your plan regularly
  8. Develop a communications plan to inform key stakeholders
  9. Develop a training program for employees to ensure that everyone is aware of their roles, responsibilities, and the order of operations during an unplanned outage
  10. Engage with managed service providers if required to identify areas in which they can assist you with your recovery efforts

Choose your recovery strategy

There are several options to consider when implementing your recovery strategy, but you should choose a recovery strategy that meets your business needs and security requirements.

Hot, warm, or cold site

  • Hot site
    • back-up site with the same servers and equipment as your primary site
    • functions the same as your primary site and is always kept running in case of downtime
    • data synchronization occurs within minutes to hours, reducing the risk of data loss
  • Warm site
    • back-up site with network connectivity and some equipment installed
    • requires setup to function at the full capacity of your primary site
    • data synchronization occurs less frequently, which can result in some data loss
  • Cold site
    • back-up site with little to no equipment
    • requires more time and resources to set up and restore business operations
    • data synchronization can be a difficult and lengthy process as servers need to be migrated from your primary site, resulting in a higher risk of data loss

Storage replication

Storage replication copies your data in real time from one location to another over a Storage Area Network, Local Area Network or a Wide Area Network. Since it is done in real time, it is referred to as synchronous replication. You can also use asynchronous replication, which creates copies of data according to a defined schedule.

Disk mirroring

Disk mirroring replicates data on 2 or more disk hard drives. Disk mirroring automatically switches your critical data to a standby server or network when your main system experiences unplanned downtime. If you are unable to restore your systems, you can use the mirror copy. It is important that the mirrored copy is backed up to a separate server or location that is unaffected by the outage.

Cloud vs. on-premises recovery

With a cloud-based recovery platform, you can connect easily from anywhere with a variety of devices. You can back up your data frequently, and it can be less expensive than purchasing and maintaining an on-premises platform because you pay for the space you need as you need it. Using the cloud can also reduce or eliminate the need for a separate offsite recovery site.

Test your IT recovery plan

Testing is critical. You can identify inconsistencies and address areas that need revision. Be sure to use a test environment to avoid business interruptions. Some example test strategies include:

  • Checklist: Read through and explain the steps of the recovery plan
  • Walkthrough: Walk through the steps without enacting them
  • Simulation: Use a simulated incident or disaster to familiarize the recovery team with their roles and responsibilities
  • Parallel test: Set up and test recovery systems to see if they can perform operations to support key processes. You keep your main systems in full production mode
  • Cutover test: Your recovery systems are set up to assume all your business operations, and you disconnect primary systems. This type of test causes business interruptions and requires additional planning

Learn more

]]>https://cyber.gc.ca/en/guidance/improving-cyber-security-resilience-through-emergency-preparedness-planning-itsm10014<![CDATA[Improving cyber security resilience through emergency preparedness planning (ITSM.10.014)]]>2026-01-16T19:03:08Z

Alternate format: Improving cyber security resilience through emergency preparedness planning – ITSM.10.014 (PDF, 695 KB)

Foreword

This is an unclassfied publication that has been issued under the authority of the Head of the Canadian Centre for Cyber Security (Cyber Centre). For more information, contact the Cyber Centre:

email contact@cyber.gc.ca |Mobile 613-949-7048 or 1‑833‑CYBER‑88

Effective date

This publication takes effect on January 2026.

Revision history

  1. First release: January 2026

Overview

Cyber emergency preparedness is the practice of ensuring that your organization has a strategy to prevent, respond to, and recover from cyber incidents. Implementing a cyber emergency preparedness strategy requires a collaborative effort from stakeholders across your organization. Your strategy should highlight key aspects of your emergency procedures, such as the steps your organization will take to respond to an incident, who will be contacted in case of an incident, and what resources will be required to carry out your overall plan. A cyber emergency preparedness strategy will help your organization to manage risks and improve resilience in the face of catastrophic events.

This publication describes emergency preparedness, related to cyber security, as a strategy that encompasses an incident response plan (IRP), a business continuity plan (BCP), and a disaster recovery plan (DRP). The difference between these 3 plans is detailed in this publication, along with the justification for why your organization should develop and implement all 3 plans to improve your cyber resilience and ability to maintain business operations amid an incident or a major disruption.

Your emergency preparedness plan should align with a relevant security risk management framework, such as:

Integrating your emergency preparedness plan into your organization's security framework will help improve your cyber security resiliency and provide the security assurances of confidentiality, integrity, and availability for your business assets.

We recommend that you report cyber incidents to the Cyber Centre using our online reporting tool. We can provide your organization with cyber security advice, guidance, and services to help mitigate the impact of cyber incidents and better protect your organization from future incidents. We also encourage you to report cybercrime activities to law enforcement and fraud to the Canadian Anti-Fraud Centre.

Table of contents

1 Introduction to emergency preparedness

You should strive to improve your organization's cyber security posture and resilience by proactively preparing for incidents and disruptions to anticipate and minimize operational downtime, financial losses, and reputational damage.

Your cyber emergency preparedness strategy should include 3 comprehensive plans:

  • incident response plan (IRP)
  • business continuity plan (BCP)
  • disaster recovery plan (DRP)

This publication focuses on emergency preparedness activities related mainly to the recovery and restoration of tangible and intangible technology assets that are used for business operations and can be adversely affected by a cyber event.

Although this publication focuses on cyber security, the recommendations align with Public Safety Canada's (PSC) Emergency Management guidance and Emergency Management Framework for Canada. Through national leadership in the development and implementation of policies, plans, and a range of programs, PSC's emergency management guidance helps Canadians protect themselves from various emergencies and disasters. PSC's approach to emergency management is based on work in 4 related areas:

  • prevention and mitigation
  • emergency preparedness
  • response to emergency events
  • recovery from disasters

The PSC framework aims to guide and strengthen the way governments and partners assess risks and work together to prevent, mitigate, prepare for, respond to, and recover from the threats and hazards that pose the greatest risk to Canadians. Building on the framework, PSC's Emergency Management Strategy for Canada: Toward a Resilient 2030 identifies federal, provincial, and territorial priorities that will strengthen Canada's resilience by 2030. Potential threats include natural disasters, such as forest fires, and human-induced disasters, such as hazardous material spills. We recommend that you develop emergency preparedness strategies for these other types of threats as well.

1.1 Benefits of an emergency preparedness plan

Disruption due to unforeseen events can have devastating impacts on your organization and its cyber security posture. Having a comprehensive cyber security emergency preparedness plan can:

  • lessen the severity of disruption and damage to business operations and services
  • minimize recovery time and allow for rapid restoration of services
  • improve security
  • minimize the financial impact of the disruption
  • prevent reputational damage
  • potentially prevent regulatory or legal penalties, when an emergency preparedness plan is mandatory
  • offer alternative ways to continue operations
  • train and educate employees on emergency procedures
  • help identify incidents and deploy rapid restoration of services

1.2 Comparing incident response, business continuity, and disaster recovery

The 3 comprehensive plans involved in your cyber emergency preparedness strategy are your IRP, BCP, and DRP. This section will compare all 3 plans and highlight the differences between each.

1.2.1 Incident response plan

An IRP includes the processes, procedures, and documentation related to how your organization detects, responds to, and recovers from a specific incident. The plan will help minimize your organization's downtime and overall business disruptions when faced with an incident. A robust IRP covers various types of incidents that could impact your organization and provides step-by-step guidance on how to handle an incident, mitigate the related risks, and recover quickly. Some examples of cyber incidents that can impact your organization's cyber security posture include:

  • ransomware: when a type of malware locks you out of your files or systems and a threat actor demands that you pay a ransom to regain access. Payment does not guarantee you will regain access to your information
  • data theft: when threat actors steal information stored on servers and devices
  • active exploitation: when threat actors take advantage of unpatched software, hardware, or other vulnerabilities to gain control of your systems, networks, and devices

1.2.2 Business continuity plan

A BCP is a specific plan to recover services most critical to an organization's operations as quickly as possible. It is a proactive plan that describes operational procedures to help organizations ensure they can continue business operations despite a disruption. The BCP will identify the main assets, roles, responsibilities, and processes needed to ensure ongoing operations.

Your BCP should be based on your organization's information technology (IT) threat and risk assessment (TRA) and a business impact analysis (BIA). A BIA will identify the potential impact of different scenarios on your business operations. For example, a BIA should address the following questions:

  • What resources and activities are critical to continuing your business operations?
  • How long can you stop operations without causing significant damage to your business?
  • What are the financial implications of these interruptions?

A BIA outlines the projected financial costs associated with different disruptions (where applicable) so that you can make informed investments in the prevention and mitigation strategies described in your BCP.

1.2.3 Disaster recovery plan

A DRP is a formal document that defines a set of procedures and processes and the specific roles and responsibilities of key members to return the organization to its normal state after a large event.

Most DRPs include a shift in the physical location of either server-side infrastructure (for example, changing data centres) or client-side endpoints (for example, changing offices), depending on which side suffered the disaster (for example, data centre flood or office evacuation). A DRP should also specify recovery objectives for all critical assets and steps to reduce the loss or impact to the organization.

A DRP encompasses the main principles of an IRP and a BCP and can provide guidance on what plan to execute based on the type of disruption or incident.

1.2.4 Main difference between each type of plan

IRPs, BCPs, and DRPs have much in common since they are all meant to improve your organization's resilience, minimize impact, and keep operations running. However, they do have some key differences.

An IRP is event focused and specific to a security incident, such as a cyber attack, affecting an organization. It defines the roles and responsibilities and identifies the scope of action required to mitigate an incident (for example, a data breach, a ransomware attack, or a phishing attack). IRPs will assist your incident response team in reducing organizational downtime.

A BCP is a specific plan to quickly resume only the most critical operations, as defined by the BIA, in the event of a disaster. It will typically address which services to prioritize, identify the critical staff required to run those services, and identify an offsite location from which to set up temporary operations.

A DRP is a holistic plan to return your organization to full operations after a disaster. It will address various types of disruptions, such as natural hazards, hardware and power outages, and cyber attacks.

Each of these 3 plans share the following elements that are essential to successful identification, management, response, and recovery during an event or incident:

  • identifying a designated point of contact and designated team members and their alternates (in case of absences), and listing their specific roles and responsibilities
  • scheduling periodic reviews to identify potential gaps in the plan and areas that need improvement
  • scheduling testing for the plans by performing simulated disruptions to ensure that any gaps are fixed

Implementing these 3 plans will enhance your cyber security posture. Ensuring that you implement additional preventative security measures, such as patching and updating your IT assets, will reduce your organization's vulnerabilities and add to your incident preparedness. These additional security measures can help your organization avoid costly downtime and interruptions to your operations. In addition to developing and updating an IRP, BCP, and DRP, we encourage you to enhance your cyber security posture in the following ways:

  • segment your networks to stop traffic from flowing to sensitive or restricted zones
  • deploy firewalls to prevent unauthorized outside sources from accessing your system's resources or moving data from one area of your network to another
  • install anti-virus and anti-malware software to protect your perimeter
  • update and apply patches to operating systems, software, and firmware
Top of page 

2 Incident response planning

Cyber threats can greatly impact your network, systems, and devices. When you have a proper plan, you will be prepared to handle incidents when they happen, mitigate the threats and associated risks, and recover quickly.

This section will describe the preliminary elements that will help you better understand what is required to create an IRP that is tailored to your organization. We will identify the main steps that you should consider when developing your cyber security IRP and reference reputable guidance documentation that can assist you in developing your plan.

2.1 What to consider before creating an incident response plan

Developing a step-by-step IRP can be time consuming and feel overwhelming. Although your plan will be tailored to your organization's size, business operations, and security requirements, here are some preliminary and standard elements that organizations and businesses of all sizes should consider:

2.1.1 Conduct a threat and risk assessment

A TRA is a critical tool for understanding the different threats to your IT systems, determining the level of risk these systems are exposed to, and recommending the appropriate level of protection.

Before you create an IRP, your organization should conduct a TRA. The first step to a TRA is identifying all your critical assets. Once this has been done, rank the assets according to their importance, value, and risk level. This will allow you to create a budget and identify the tools and resources required to protect your valuable assets.

As previously mentioned, there are various types of incidents to consider when developing your IRP. Your plan should map out a variety of incident response scenarios to address the different types of threats. Conducting a TRA will help you identify the risks and potential threats to your organizational assets, as well as the likelihood and impact of a compromise.

2.1.2 Create a response team

Identify who has the qualifications to be on your response team and ensure that they understand their roles. Your response team should include employees with various qualifications and have cross-functional support from other business lines. The main goal of the response team is to coordinate resources to minimize the impact of the incident and resume business operations as soon as possible. The response team is responsible for assessing, documenting, and responding to incidents. They are also responsible for restoring your systems, recovering information, and reducing the risk of the incident reoccurring.

2.1.3 Develop policies and procedures

Your incident response activities need to align with your organization's policy and compliance requirements. Your organization should develop an incident response policy that establishes the authorities, roles, and responsibilities for your incident response processes and procedures. This policy should be approved by your organization's senior management and executives. Over time, your policies will need to be reviewed and adjusted based on your organization's business requirements.

2.1.4 Create your communications plan

Your communications plan should detail how, when, and with whom your team communicates. It should also identify who is responsible for these communications. The communications plan should include a central point of contact for employees to report suspected or known incidents, and alternate methods of communication in case the primary method is impacted by the incident. Many organizations prefer to use a designated individual to communicate with the press and public during incident recovery.

Your notification procedures are critical to the success of your incident response. Identify the key internal and external stakeholders who need to be notified during an incident. You may need to alert third parties, such as clients, suppliers, vendors, and managed service providers. Depending on the incident, you may also need to contact law enforcement or your regulating body if applicable, or consult with a lawyer for advice.

You may also be required to report the incident to the Office of the Privacy Commissioner of Canada (OPC) or the appropriate privacy legislation to which your organization is subject. For example, if your organization is subject to the OPC's Personal Information Protection and Electronic Documents Act (PIPEDA), you are required to:

  • report to the OPC breaches of security safeguards involving personal information that pose a real risk of significant harm to individuals
  • notify affected individuals about those breaches
  • keep records of all breaches

The OPC's What you need to know about mandatory reporting of breaches of security safeguards provides an overview of what you need to know about these obligations.

2.1.5 Educate your employees

Update your employees on current incident response planning and execution. Tailor your training programs to your organization's business needs and requirements, as well as to your employees' roles and responsibilities. Run a tabletop exercise with the key employees identified in the plan. Your employees' cooperation can reduce the length of response time and facilitate the implementation of your IRP. Employees should also be trained on how to identify and report cyber attacks such as phishing emails, spear phishing attacks, and social engineering efforts.

2.2 Additional considerations for operational technology

Organizations that manage operational technology (OT) need to address and mitigate the risks associated with incidents that can lead to unplanned outages and impacts to both their IT systems and their OT systems.

OT and industrial control systems (ICS) can add complexity to the environment and have unique constraints that need to be addressed. For example, many ICS are deployed without robust security controls and must run continuously, even though they use unsecure protocols and architectures. Maintaining older equipment can be challenging and vendors are often unable to provide replacements for vulnerable hardware or software, which can make it difficult to prevent and respond to ICS incidents.

The following 3 Cyber Centre publications provide security advice to organizations that manage OT systems, ICS, and critical infrastructure:

To learn more, read the additional guidance in PSC's Developing an Operational Technology and Information Technology Incident Response Plan. This publication provides organizations that operate a component of OT in their environment with a framework that can be used to develop a joint IT/OT cyber incident response plan (CIRP). The CIRP is intended to be appropriate for organization-specific business needs. The document provides a baseline approach to developing a CIRP, with specific factors to consider based on your organization's size, function, location, and sector.

When conducting a TRA on OT systems, it is important to consider the threats to these systems, the impact of systems vulnerabilities, and the types of risks that can cause disruptions to the operating environment.

Here are some examples of OT vulnerabilities to consider:

  • obsolete systems: systems and components that are no longer supported with updates by the manufacturer
  • unpatched software and firmware: leaves systems and devices vulnerable to known threats
  • peripherals: external connected devices that can be exploited to compromise systems and networks

OT design typically prioritizes availability and process repeatability and reliability over data security. Compromised OT systems and devices can put critical processes at risk of failure. OT compromises can lead to the following impacts on your organization:

  • major accidents and disasters, like injury or loss of life
  • malfunctioning equipment and disrupted processes and deliverables
  • compromised intellectual property and sensitive information
  • lost revenue from disrupted processes, costly repairs, or paid ransom
  • damaged organizational credibility
  • compromised security measures, such as emergency services

The failure of an OT device could impact an entire industrial process and the safety of operators and the wider public. Destruction and loss of services could cause serious damage to high-value systems, processes, and infrastructure.

When developing an IRP, it is important for organizations that are managing OT systems to understand the unique implications affecting them. This will allow for better preparation and defence against future IT and OT incidents and disruptions. Choose a response team that has the capabilities and resources required to address and mitigate the risks associated with OT incidents.

2.3 Guidance for creating an incident response plan

This section references trusted resources to help you develop your IRP. For an introduction on incident response planning, preliminary requirements, and to understand why it is important for your organization, read the Cyber Centre's Developing your incident response plan (ITSAP.40.003).

The Cybersecurity and Infrastructure Security Agency's Cybersecurity Incident & Vulnerability Response Playbooks (PDF) present one playbook for incident response and one for vulnerability response. The playbooks provide a standard set of operating procedures for responding to and recovering from incidents and vulnerabilities affecting systems, data, and networks.

For additional guidelines on incident management, read ISO 22320:2018 Security and resilience — Emergency management — Guidelines for incident management. This document is applicable to any organization and provides guidance on how to handle incidents of any type and scale.

The 2 most-used incident response frameworks were created by the NIST and SysAdmin, Audit, Network, and Security (SANS) Institute:

  • The NIST SP 800-61: Computer Security Incident Handling Guide (PDF) is a 4-step process for incident response and it is defined as a cyclical process where ongoing improvements are made to the plan based on lessons learned throughout the incident lifecycle. The NIST incident response steps are:
    • Preparation
    • Detection and analysis
    • Containment, eradication, and recovery
    • Post-incident activity
  • The SANS Institute's Incident Handler's Handbook provides a structured 6-step process for incident response. It outlines the foundation required for organizations to build upon when developing their own incident response policies, standards, and roles and responsibilities for their response team. The 6 steps for incident response planning described in the handbook are:
    • Preparation
    • Identification
    • Containment
    • Eradication
    • Recovery
    • Lessons learned

The main difference between these 2 frameworks is that NIST combines containment, eradication, and recovery into one step, whereas the SANS Institute framework separates them into individual steps. The reason for this is that NIST believes these 3 components may sometimes overlap and need to be addressed in conjunction with one another.

2.4 Main steps in an incident response plan

Having an IRP helps your organization handle incidents, mitigate threats and associated risks, and recover quickly. In this section, we will outline the main steps of an IRP and specific actions your organization will take to develop your IRP.

2.4.1 Preparation

The preparation phase should begin before the incident occurs. This is when you will need to establish the right tools and resources to implement your IRP. This phase requires periodic reviewing and updating to address new emerging threats. In this phase, you should:

  • Perform a TRA to identify your most valuable assets that are critical to your business operations, including sensitive or proprietary data
    • Define the type of security incidents that your organization is most likely to face and create detailed response steps for these incidents
    • Implement an IT asset management plan and associated policies to inventory and track all your organization's IT assets and services
    • Include hardware, software, and data, indicating the level of importance, model and serial number, location, cost to replace, manufacturer, and whether it is owned or requires a subscription renewal, such as when using cloud-based software or software as a service
  • Develop and document your security policies, standards, and procedures supporting incident response
  • Develop and implement a backup plan
    • Determine where you will do full, differential, or incremental backups
    • Ensure your backups are stored offline
  • Create your response team and assign roles and responsibilities to each member
    • Establish a clear chain of command from the start
    • Ensure that your employees are properly trained on how to execute their roles and responsibilities
  • Define your communications plan to ensure that the proper members respond to an incident
    • Include criteria for escalation
    • Identify how key stakeholders and management will be informed throughout the lifecycle of the incident
  • Create and run mock incident drills to evaluate your IRP
    • Refine and update protocols and procedures
    • Ensure that the response team understands their roles and responsibilities

2.4.2 Detection and analysis

This is the phase where you will determine if your organization has been breached or if any of your systems have been compromised. You will need to analyze the incident and identify its type, its origin, and the extent of damaged caused. This is usually the most challenging phase of the incident response process, but it cannot be overlooked. This step is a prerequisite to containing, analyzing, and eradicating the threat.

Incident detection can be done using automated security tools, or by receiving a notification and information from people within your organization or from external sources, such as vendors and service providers. You should create a classification system that will help you triage your response to the threat based on urgency. This will make it easier to isolate your most vulnerable systems and those that are most affected by the threat, ultimately minimizing the damage to your organization. Your organization should also verify the incident to ensure there is a true positive.

2.4.3 Containment

The containment step is critical. The goal is to minimize the immediate impact of the incident and to prevent it from spreading and causing further damage to other systems. This is done by isolating or removing the threat; for example, shutting down a system or replacing it completely, disconnecting it from the network, or disabling certain functions. Ensure you have a redundant system backup so that your data is safeguarded from permanent deletion. Your backup will also help you restore your business operations in a timely manner.

Containment strategies and procedures will depend on the type of incident, the degree of damage that the incident can cause, and your operational requirements. Incident containment strategies are easier to implement if they are preestablished in the preparation phase, where your acceptable risk level would have already been defined.

If a containment plan is delayed, the threat actor could access and compromise other systems, which could lead to further damage to your organization. The containment step should cover short-term and long-term strategies, and system backups.

Here are some questions that can help you decide which containment strategy to implement:

  • What damage does this incident pose to your organization?
  • How important is it to preserve the evidence?
  • How much time and resources are required to implement the strategy?
  • How long can you afford to shut down your systems and stop business operations?
  • How effective is your strategy? Will it offer full or partial containment?

2.4.4 Eradication

Once the incident has been contained, you need to conduct a root cause analysis to identify and remove all elements of the incident from the affected systems to prevent future compromises. The eradication phase will improve your defence strategies based on the lessons learned. In this phase, the following activities should be completed:

  • identify all affected systems, hosts, and services
  • remove all malicious content from affected systems
  • scan and wipe your systems and infected devices to prevent risk of reinfection
  • identify and address all residual attack vectors to ensure other systems are not compromised
  • communicate with all stakeholders to ensure they manage the incident appropriately
  • harden, patch, and upgrade all affected systems
  • upgrade or replace legacy systems

2.4.5 Recovery

In the recovery phase, you will restore the affected systems and reintegrate them into your operating environment. To avoid reinfection after a cyber incident, take precautionary measures such as ensuring all malware is removed before restoring your backups. You will need to test, verify, monitor, and validate the affected systems to ensure they are running effectively. Your organization should revise and update policies, procedures, and training initiatives based on the lessons learned.

At this phase, you will need to address the following questions:

  • When can systems be reintegrated into the operating environment?
  • How long will the affected systems be monitored for abnormal behaviour?
  • How will you test your compromised systems to ensure that they are clean?
  • What tools will you use to avoid similar attacks from reoccurring?

2.4.6 Post-incident activities and lessons learned

The goal of this phase is to analyze and document everything you know about the incident. It is important to create follow-up reports that will provide a review of what happened throughout the entire incident handling process. The report will serve as a tool to strengthen your organization's resilience by identifying ways to improve response efforts, security measures, and components of the incident handling process.

To help collect all pertinent information needed to generate the report, a meeting with all incident response members should be held shortly incident recovery to discuss important points, such as:

  • When and why did the incident occur? What triggered it?
  • How did the response team perform? Did they know their roles and responsibilities?
  • Does the incident team need to modify its action plan for future incidents?
  • Were the documented procedures followed and were they successful in handling the incident?
  • Did anything happen that may have delayed or inhibited the recovery process?
  • What information or action plan would have been valuable sooner?
  • How can you improve communication and information sharing with third parties?
  • Can employee training be improved?
Top of page 

3 Business continuity planning

A BCP is often considered a subset of the larger DRP. It is a formal document containing detailed guidelines on what your organization will need to do to quickly resume critical business operations following an unplanned disaster. Only critical services are included in the BCP. Non-critical functions can be addressed once the incident is fully resolved.

The document ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements (ISO 22301) provides a framework to help organizations plan, implement, and maintain a business continuity management plan. ISO 22301 will ensure that organizations of all sizes are able to respond, recover, and continue operations after various disruptions.

The publication NIST SP 800-34 Revision 1 – Contingency Planning Guide for Federal Information Systems (PDF) offers guidance to United States federal agencies to evaluate information systems and operations to determine contingency planning requirements and priorities. The publication covers IRPs, BCPs, and DRPs and can be used as a reference to help organizations develop their response and recovery strategies and procedures.

3.1 Main disruptions that can affect your organization

Although your BCP should address all types of incidents, the following threats are the most common business disruptors to consider:

  • natural hazards, such as hurricanes, tornadoes, earthquakes, floods, wildfires, and severe storms
  • building fires
  • cyber threats, such as ransomware attacks, data thefts, and distributed denial of service (DDoS) attacks
  • server or utility outages, such as power outages, communication line outages, or water shutoffs
  • equipment failure that can impact operations such as HVAC systems, office equipment, or manufacturing equipment
  • acts of terrorism
  • global pandemics such as disease outbreaks or public health emergencies such as virus outbreaks
  • decreased supply due to manufacturer and vendor shutdowns or disruptions to distribution across the supply chain

3.2 Steps to developing your business continuity plan

In this section, we will discuss the specific areas your organization will need to address when developing a BCP, as well as how you can ensure your BCP will be effective when enacted. A BCP allows organizations to identify their risk from various threats and the impact they would pose to business operations. A BCP is used to ensure organizational resilience and compliance to regulations, policies, and standards. The goal of a BCP is to identify all the resources and procedures required to help organizations continue critical operations and services in the event of a disaster or other disruption.

Business continuity planning is a lifecycle approach and requires ongoing reviewing, testing, and updating. The image below, Figure 1: Business continuity planning lifecycle, depicts the 5 key steps to developing and maintaining a BCP.

Figure 1: Business continuity planning lifecycle

Figure 1: Business continuity planning lifecycle
Figure 1 - Long description immediately follows
Long description - Figure 1: Business continuity planning lifecycle

Business continuity planning lifecycle describes the 5 steps in the business continuity planning lifecycle

  • Initiate: Identify your organization’s goals and objectives
  • Analyze: Conduct a TRA and a BIA
  • Develop and implement: Define the strategy, develop the plan, and implement it
  • Communicate and integrate: Communicate your BCP to employees, stakeholders, and partners and integrate it into your organization’s policies
  • Test and validate: Test your plan regularly to ensure that it remains effective and current

The following section describes the 5 stages of the business continuity planning lifecycle.

3.2.1 Initiate: Identify the plan's objectives, goals and response

The main objective of a BCP is to ensure that there is minimal disruption to critical business functions in the event of a disaster or incident. However, depending on your organization's unique requirements and resources, you may have different objectives and goals. Once you have identified your objectives and goals, make sure that they are clearly communicated and accepted by your organization's leaders. Your goals will influence your TRA, BIA, BCP, and recovery strategies.

You will need to identify the key people and processes that will be required to ensure your goals are met. You will also need a communications plan to share these items. Create a management team with members who are knowledgeable about the different operational areas of your organization to evaluate what potential threats can lead to various levels of risks to your organization. The makeup of your team depends on your business continuity objectives and the size of your organization. There should be a designated leader to ensure that all the actions required to develop, implement, modify, and update the plan are being executed.

3.2.2 Analyze: Perform the required assessments

After you have identified your goals and objectives, you will need to conduct a detailed TRA. It is important that your organization understands where your risks lie and the different threats that could cause interruptions to your business operations. Having this knowledge can help you determine how to reduce, mitigate, and eliminate these risks.

Once your organization has identified possible threats, you should conduct a BIA to identify critical and non-critical business operations and systems and how different threats can impact various business areas. A BIA will identify specific threats that can impact financial and operational performance, employees, supply chains, reputation, and resources. These threats should be analyzed to determine the probability of their occurrence and their level of impact. Mitigation strategies that can reduce the likelihood of occurrence and the severity of impact should also be identified.

Collaboration is key when conducting a BIA. Managers, key stakeholders, partners, and employees should all be involved in the discussions. This will give you a greater understanding of how a disaster may impact other business functions within the organization. Involving stakeholders and partners will also help them understand the risks to their business operations and identify mitigation strategies.

Document all your findings in the TRA and BIA so that you can anticipate the cost and resources that will be needed to recover from a disaster or incident.

To help you with your TRA and BIA, it is recommended that your organization perform a security categorization of your business activities (for example, business processes and related information assets). This helps establish the relative importance of your business activities. At the information system level, security categories of business activities serve as input for establishing security assurance requirements, selecting and tailoring security controls, and conducting TRA activities. Security categorization is a process to determine the expected injuries from threat compromise and the level of these expected injuries with respect to the security objectives of confidentiality, integrity, and availability. The result of this process is a security category for a business activity that expresses the highest levels of expected injury for all 3 IT security objectives. For information and guidance on security categorization, read the Cyber Centre's IT security risk management: A lifecycle approach (ITSG-33).

3.2.3 Develop and implement: Define the strategy and create the plan

Once you have identified the types of risks, threats, and vulnerabilities applicable to your organization, you can begin to develop an effective BCP. Your plan should focus on mitigation strategies for the identified risks that will allow for the resumption of critical business operations. A comprehensive BCP will take each risk identified in the BIA and develop an appropriate response strategy to either minimize its impact on your organization's stakeholders, operations, and assets or to mitigate it. Here are some key best practices to consider when developing your BCP:

  • identify the members of the response team and provide detailed description of their roles and responsibilities so that they can react swiftly and efficiently
  • develop communication methods and recovery procedures
  • identify an alternative work site and an employee relocation plan
  • consolidate a list of alternate resources and suppliers
  • establish an IT recovery plan with assistance from the Cyber Centre publication Developing your IT recovery plan (ITSAP.40.004)
  • establish policies to be implemented during a disaster, emergency, or incident
  • determine the budget that will need to be allocated to the various activities in your plan
  • identify timeframes in which services and business operations need to be available
  • identify the resources that will be required to ensure prioritization and a quick and relevant response
  • create reports to share with stakeholders
  • provide staff with awareness training and educate them on the various risks and emergency preparedness and response strategies
  • document the plan, validate it, share it with management and organization leaders, and gain their approval
  • store the documented BCP in a secure location that is accessible if the BCP is enacted

3.2.4 Communicate and integrate: Develop policies and communication protocols

Once your BCP has been developed, it should be communicated to your employees and stakeholders and integrated into your organization's policies. It should be easily accessible to allow the response team to best coordinate their efforts. You should also develop a detailed communications and external public relations plan to provide guidance on how to communicate with staff, investors, and the media to avoid the spread of misinformation.

Your BCP should include effective communication strategies for both internal members and external stakeholders. Clear communication within your organization during a crisis will reassure your employees that you are taking the required steps to respond and recover. Communication with external stakeholders, suppliers, and customers is also vital to minimize reputational damage and to maintain your organization's integrity.

The communication process should include protocols and procedures to ensure that the appropriate protective actions are taken and the right people are being alerted. Pre-drafted messages can facilitate and speed up communication in the event of a crisis.

3.2.5 Test and validate: Periodic testing to validate your plan

The risks to your organization are not static and are likely to change over time. Your business operations and priorities may also change. As a result, your BCP must be re-evaluated and tested regularly so that it remains effective and updated. A robust BCP requires continuous improvement with ongoing analysis, testing, validation, and implementation. You should conduct simulations and live exercises to assess your response team's level of preparedness and to identify weak points. You can choose from various types of exercises to test your plan, such as seminars, tabletop exercises, and live exercises. Use the lessons learned from your exercises and tests to update your BCP. A checklist to ensure that each part of your plan is working properly is also beneficial.

Your BCP testing practices should:

  • evaluate awareness and training information and protocols. Ensure that protocols are current and that regular training sessions are offered to employees and response team members
  • test, evaluate, and validate the technical solutions and steps identified in the BCP. Ensure that solutions and steps are still effective and update them if required
  • test, evaluate, and validate the recovery procedures established in the BCP. Ensure that the procedures are aligned with your organization's current operational and business requirement and threat landscape
Top of page 

4 Disaster recovery plan

A DRP looks at every aspect of your organization that might be affected, such as assets, infrastructure, human resources, and business partners. Your DRP should identify your critical and non-critical business operations. It should include recovery requirements, procedures, and detailed instructions for each critical function. This will ensure the protection of assets and business operations to meet regulatory requirements and minimize downtime.

The DRP should define strategies to minimize the impact of a disaster and to recover IT assets and services as quickly as possible to ensure continuation of critical operations.

A disaster, regardless of its nature, can have devastating impacts on your organization. The longer the recovery time, the greater the potential damage. Therefore, it is important to have a good DRP that will ensure a quick recovery, regardless of the type of disaster.

A DRP should be organized by type of disaster and location and should provide step-by-step instructions that can be easily implemented.

The Cyber Centre's publication Developing your IT recovery plan (ITSAP.40.004) identifies important elements and steps that can assist with the development of your DRP. It also describes how a recovery plan can improve your organization's overall resilience and cyber security posture. Consulting other resources to develop your DRP, such as IBM's Disaster recovery plan template or SO/IEC 27031:2025 Information technology — Security techniques — Guidelines for information and communication technology readiness for business continuity can also be beneficial.

In the next section, we will describe the key elements of a DRP. As previously mentioned, there are some similarities between an IRP and a DRP. Although there will be some repetition in the next section, it is important to reiterate these key elements as they shape the DRP.

4.1 Key elements of a disaster recovery plan

In this section, we will discuss specific areas that your organization will need to address when developing a DRP. These steps will return your organization to full operations after a disaster.

4.1.1 Create a disaster recovery team

The goal of the disaster recovery team is to assess, document, and respond to incidents; restore systems; recover information; and reduce the risk of the incident reoccurring. The plan should clearly identify the name and contact information of the individuals who are responsible for the different areas of the disaster recovery process. This will help streamline communications once recovery efforts are underway.

The team members should be well trained on disaster recovery and should understand their respective roles and responsibilities. Members should have various qualifications and cross-functional support from other business lines. Since incidents are unpredictable and require immediate response, designate backup responders to act during any absences when an incident occurs. Critical responsibilities include:

  • identifying a plan owner who will lead the recovery process with the support of organization leaders and managers
  • building a communications plan that addresses key considerations for communicating essential information to key stakeholders and the media
  • implementing systems backup and maintenance to ensure business continuity

4.1.2 Maintain an inventory of all your IT assets and identify the most critical

To have an effective DRP, you will need to maintain an accurate and up-to-date inventory of your IT assets. Your inventory should include a list of hardware, software, and information assets, as well as their location. Your assets should be categorized based on their criticality to your business operations. Your most critical assets include sensitive and proprietary data, and assets that are mandatory for your business operations. The criticality should be compared to the risk probability and resiliency of the asset when faced with disasters. This will allow you to better anticipate and manage risks.

Your organization should rank assets from most critical to least critical to define the scope of your DRP. Ensure that your DRP addresses your critical high-risk assets first, including your sensitive data. Sensitive data may be subject to compliance requirements, such as the Privacy Act, which governs the Government of Canada, or PIPEDA, which covers how private sector organizations handle personal information. Your DRP should identify how your sensitive data will be protected and securely backed up.

4.1.3 Understand the risk tolerance of your organization

To support your disaster management and recovery efforts, you should identify and document the potential risks to your organization and your tolerance to these risks. When you understand your risk tolerance, your organization will be better equipped to develop recovery strategies for various disasters. Your DRP should include various events, such as natural hazards, power outages, cyber attacks, ransomware, insider threats, and failure of critical equipment.

Here are a few key actions to help identify your risks tolerance:

  • list your critical business operations
  • understand your business operations that handle sensitive data
  • identify the assets, including data, that are valuable to your organization
  • know your geographical location and infrastructure; this will help you determine whether you need cloud backup, one or multiple storage sites, and backup servers

4.1.4 Identify critical operations

Your DRP should identify what business operations are considered critical to your organization. To help identify your critical operations, consider the following questions:

  • What components of your business are so important that your organization will not survive if immediate access is removed?
  • What sensitive information or data do you store that, if lost or compromised, you would likely face legal repercussions and reputational damage?
  • What patents, intellectual property, or proprietary business information do you need to safeguard to maintain your reputation in the industry and to protect your business?

By understanding what is most valuable to your organization, you will be better equipped to implement strategies in your DRP that will ensure your organization remains resilient in the event of a disaster.

4.1.5 Develop disaster recovery procedures

A major component of a DRP is documented in step-by-step recovery procedures. These procedures will describe how your organization will respond to various disasters. When faced with unexpected catastrophic events, your organization will have very little time to react. Having documented disaster recovery procedures will ensure that your response team knows exactly how to respond to minimize the damage and avoid prolonged downtime. These procedures should cover, at a minimum, the following elements:

  • emergency response procedures will include the steps required to effectively respond to emergency situations, to help minimize damages to your organization, and to protect your employees
  • business operations backup procedures will ensure minimal disruption to your organization's critical business operations
  • procedures identifying disaster recovery actions will help your organization restore your operating environment, including systems, networks, devices, and important information and data following a disaster

4.1.6 Identifying recovery time objective and recovery point objective

Recovery time objective (RTO) and recovery point objective (RPO) are the metrics used to determine your downtime and data loss tolerance, respectively.

RTO is the pre-established maximum amount of downtime your organization can tolerate without causing damage. This can be measured in minutes, hours, days, or weeks. RTO is the planned time and level of service needed to meet the system owner's minimum expectations.

You will need to create different RTO categories since some business operations will require shorter recovery time and some may be less critical for the survival of your organization. Important factors to consider when establishing RTO include:

  • cost-benefit analysis related to restoring operations
  • cost for mitigation
  • level of complexity of the recovery process
  • time and resources required to return to normal operations
  • critical asset ranking and risk prioritization for strategic recovery

RPO is the maximum amount of data your organization can tolerate losing before causing impactful harm. RPO is measured in units of time. It is basically the amount of time from the start of the outage to your last valid data backup.

For some organizations, data turnover may be low and an RPO of days or even weeks may be tolerable. For organizations with a high data transaction volume, hours or even minutes of missing data may be intolerable. The RPO can be used as a metric to understand how frequently and where you should be backing up your important data and information. Some transactional databases may be configured to synchronously copy data to disaster recovery sites. This ensures no data is lost, but results in significantly slower transaction speeds and considerable expense.

When considering the business impact of a disaster, the sum of the time between the RPO (back in time from the disaster) and the RTO (forward in time from the disaster) gives an idea of how much lost business is designed into the DRP. RTOs and RPOs should be reviewed and updated regularly since they are likely to change depending on the threat landscape and any changes to your business objectives and operations.

4.1.7 Establish a disaster recovery site

A DRP should indicate where your organization's assets will be relocated if a disaster occurs. Recovery sites are usually in remote locations. They are used to help restore IT infrastructure and other business-critical operations during an incident.

It is important that you document the various characteristics of these physical facilities, including location, heating, cooling, power, fire response, and security controls.

Establishing a recovery site can be costly. If your organization lacks the financial resources to have its own recovery site, consider engaging a service provider that can host your remote infrastructure, provide a DRP in cloud, or provide Disaster Recovery as a Service (DRaaS). We will expand on these options in the next section.

There are 3 types of disaster recovery sites to choose from, depending on your business priorities.

4.1.7.1 Hot sites

A hot site is a fully functional backup site with the same IT infrastructure as your primary site. It functions the same as your primary site and is always kept running in case of downtime. Data synchronization is ongoing to reduce the risk of data loss. The benefit of a hot site is that it can nearly eliminate downtime.

4.1.7.2 Warm sites

A warm site is a back-up site with network connectivity and some equipment installed. A warm site requires setup time before it can function at full capacity. Data synchronization occurs less frequently, which can result in some data loss.

4.1.7.3 Cold sites

A cold site is used to store backups of systems or data, but with little equipment installed. More time and resources will be required to set up and restore business operations. Data synchronization can be a difficult and lengthy process, and there is a higher risk of data loss if servers need to be transferred from your primary site to the cold site.

Top of page 

4.1.8 Test and maintain your disaster recovery plan

Your organization should test your DRP regularly to ensure that your documented procedures are effective and up to date. A DRP is an ongoing process that must be reviewed continuously to ensure it aligns with changes to your risk environment, business operations, and technologies.

By testing your DRP regularly, you can ensure that you meet your response goals while identifying any areas that may need improvement. By testing your plan, you can:

  • verify the effectiveness of the recovery documentation and recovery sites
  • provide reassurance that your organization will be able to withstand disasters
  • ensure that your data is being replicated correctly and can be recovered easily from your backups
  • review lessons learned from past incidents and include additional mitigation actions in your DRP
  • flag areas in the DRP that need updating
  • update training requirements for your response team to ensure they are informed of changes and are well prepared to implement the DRP

There are several types of DRP tests you can use:

4.1.8.1 Checklist testing

Checklist testing will ensure that the recovery procedures are comprehensive and account for all the resources and response members that are required to execute each step of the plan.

4.1.8.2 Tabletop testing

The main purpose of a tabletop test is to ensure that your response team understands the processes and procedures in your DRP and that they are aware of their responsibilities and roles. Tabletop testing will allow all response team members to meet and discuss a simulated disruption. They can discuss the actions required to manage the fine details of the disaster, including the aftermath. This will help ensure that all necessary resources are available as indicated in the DRP. A tabletop test will also determine if your DRP is efficient and will reveal strengths and flaws, which will allow you to address any issues with the DRP before an actual event occurs.

4.1.8.3 Walkthrough testing

A walkthrough test is a dry run test to help identify any issues. It is a step-by-step review of the DRP to ensure that the response team members understand their roles, are aware of all the steps of the plan, and have been updated on any changes to the plan since the last review.

4.1.8.4 Parallel testing

A parallel test is when a recovery system is used to restore a system without interrupting any business operations. This is a step-by-step review of each plan component and will help identify gaps, weaknesses, or overlooked details that might present roadblocks during real execution.

4.1.8.5 Full interruption testing

A full interruption test is the most disruptive test. The main system is taken down and the response team attempts to recover it. This is a more thorough and time-consuming test. It is also risky since it can lead to disruptions to business operations and expensive downtime. In some cases, this type of test may not be feasible due to public safety or regulatory concerns.

4.1.8.6 Simulation testing

A simulation test will help the response team know what to do when a disaster occurs. It involves role-playing the DRP based on a specific disaster scenario. It should incorporate all steps in the DRP and ensure that the documented procedures are clear with no ambiguity.

4.2 Types of disaster recovery strategies

In the previous section, we discussed setting up disaster recovery sites to help protect your organization's IT infrastructure and critical operations. We listed the 3 types of disaster recovery sites (hot, warm, and cold) to choose from, based on your business priorities, resources, and risk tolerance. Aside from these options, there are several other disaster recovery strategies to choose from depending on your organization's IT infrastructure, business operations, resources, budget, and critical assets. Here are some examples of backup and recovery methods you can explore.

4.2.1 Network disaster recovery

Network connectivity is critical for your organization's external and internal communication, application access, and data sharing. Network disaster recovery procedures specify how network services will be restored in the event of a network disruption, what resources will be required, and how access to backup data and storage sites will be ensured. Depending on your organization's requirements, your network disaster recovery may include recovery procedures such as:

  • local area networks (LAN)
  • wide area networks (WAN)
  • wireless networks
  • network-based applications and services
  • failed devices that can lead to network interruptions, such as routers, switches, gateways, modems

There are various reasons why network disruptions can occur, including human error, natural or physical disasters, and cyber attacks like DDoS.

4.2.2 Virtualized disaster recovery

Your organization can use virtual machines in an offsite location or the cloud to back up certain operations or data, or even to replicate your entire IT infrastructure (servers, storage, operating systems, software, applications, and data). Using virtualization for disaster recovery can offer the following benefits:

  • automate some disaster recovery processes and allow online operations to be restored faster
  • reduce your IT footprint
  • support frequent replication and enable seamless failover
  • allow your infrastructure to operate from any location

4.2.3 Disaster recovery in the cloud

Disaster recovery in the cloud offers services and strategies to store backup data, applications, and other resources in cloud storage rather than in a physical location. Disaster recovery in the cloud can be more than just a backup solution, it can provide automatic workload failover to the cloud platform so that organizations can restore their backups to either on-premises or cloud environments. This enables business continuity and quick recovery when disruption occurs.

Disaster recovery in the cloud automates many recovery processes and can be scaled to meet business requirements. It is commonly offered as a software as a service solution and can be a more affordable option for organizations with limited financial resources.

Using disaster recovery in the cloud offers the following additional benefits:

  • flexible pricing models, such as on-demand or pay-as-you-go
  • no single point of failure when using the cloud since you can pay to back up data across multiple geographical locations
  • lower disaster recovery capital costs since you will not need to purchase duplicate hardware or software or a physical backup site
  • enhanced compliance with regulatory requirements
  • assurance that your business operations will be restored with minimized data loss, in accordance with your service level agreement (SLA)

4.2.4 Disaster recovery as a service

DRaaS is disaster recovery hosted by a third-party service provider or public cloud infrastructure. It is a solution that enables replication and hosting of physical or virtual servers, allowing failover for on-premises or cloud computing environments.

Depending on the SLA between the DRaaS provider and the customer, the following solutions can be acquired:

  • monitoring, implementing, and managing the entire DRP and helping clients recover their IT infrastructure and return to normal business operations
  • ensuring guaranteed recovery times for critical IT resources
  • offering backup and disaster recovery tools to customers who want to set up and implement disaster recovery solutions on site
  • providing an infrastructure as a service solution, which is a type of cloud service that offers essential computing, storage, and networking resources on demand, on a pay-as-you-go basis

4.2.5 Backup as a service

Backup a service is a service offered by a third-party provider and is also known as online backup or cloud backup. The service provider can store your data remotely in the cloud and manage all the backup and recovery infrastructure.

4.2.6 Storage replication

Storage replication copies your data in real time from one location to another over a storage area network, LAN or WAN. Storage replication is referred to as synchronous replication since the replication is done in real time. Your organization can also use asynchronous replication, which creates copies of data according to a defined schedule.

Top of page 

5 Summary

The advice provided in this publication is meant to help strengthen your organization's resilience through emergency preparedness. Your emergency preparedness strategy should encompass an IRP, a BCP, and a DRP. While the objectives of the 3 plans differ, they all strive to do the following:

  • protect and safeguard your critical assets and business operations
  • respond to incidents
  • recover from disasters as quickly as possible

Remember that an IRP focuses on a specific incident occurrence and the actions required to respond to the incident, whereas a DRP focuses on restoring your organization's IT infrastructure after a disastrous event occurs. The objective of both plans is to help your organization return to normal business operations as quickly as possible.

The main principles of an IRP and a DRP fall under the umbrella of a BCP. A BCP is a holistic approach to handling disruptions with the objective of maintaining your organization's operations throughout the event lifecycle.

Identifying your organization's critical assets and business operations will help you identify the requirements and guide the plan development process. Through effective planning and practice, your organization will be well prepared, ready to recover, and able to maintain operations efficiently. This will minimize the impacts, interruptions, costs, and damages of any future disruption, incident, or disaster.

]]>https://cyber.gc.ca/en/guidance/developing-your-incident-response-plan-itsap40003<![CDATA[Developing your incident response plan (ITSAP.40.003)]]>2026-01-16T19:02:25Z

Your incident response plan (IRP) includes the processes, procedures, and documentation related to how your organization detects, responds to, and recovers from a specific incident. Cyber threats, natural disasters, and unplanned outages are examples of incidents that can impact your network, systems, and devices. With a proper plan, you will be prepared to handle incidents when they happen, mitigate the threats and associated risks, and recover quickly. While this publication is written in the context of cyber incidents, its guidance can assist your organization in developing an incident response plan for various types of incidents.

On this page

Before creating an incident response plan

Before you create an IRP, identify the information and systems of value to your organization. Determine the types of incidents you might face, such as ransomware or distributed denial of service attacks, and the appropriate responses. Consider who is best qualified to be a member of your response team. You should also determine how you will inform your organization of the plan and the associated policies and procedures.

Conduct a threat and risk assessment

A threat and risk assessment (TRA) is a process that helps you identify your critical assets and how these assets can be compromised. Your TRA will assess the level of risk these threats pose to your assets so that you can develop and prioritize your response efforts. Some questions to answer during the TRA include:

  • what data is valuable to your organization?
  • which business areas handle sensitive data?
  • what controls do you currently have in place?
  • can this lead to a privacy breach for your organization?

For more information on TRAs, read Harmonized TRA Methodology (TRA-1).

Create your response team

The purpose of your team is to assess, document, and respond quickly to incidents. The goal is to restore your systems, recover information, and reduce the risk of the incident reoccurring.

Your team should include employees with various qualifications and have cross-functional support from other business lines.

Roles to consider for your incident response team include:

  • critical path personnel
  • security practitioners
  • IT or cyber security specialists
  • project engineers for operational technology (OT) environments
  • legal
  • management

Cyber incidents in particular are unpredictable and require immediate response. Ensure your response team has alternate means of contact, such as mobile phones or out of band email. Each member of your team should also have a backup contact in case they cannot be reached or are unavailable.

Develop your policies and procedures

Your incident response activities need to align with your organization's policy and compliance requirements.

Write an incident response policy that establishes the authorities, roles, and responsibilities for your incident response procedures and processes. This policy should be approved by your organization's senior management.

Educate your employees

Provide training to employees that explains your incident response plan, policies, and procedures. Tailor your training programs to your organization's business needs and requirements, and to your employees' roles and responsibilities.

Update your employees on current incident response planning and execution. A well-trained and informed workforce can defend against incidents.

Create your communications plan

Your communications plan should detail how, when, and with whom your team communicates. This plan should include a central point of contact for employees to report suspected or known incidents.

Your notification procedures are critical to the success of your incident response. Identify the key internal and external stakeholders who will be notified during an incident. You may have to alert third parties, such as clients and managed service providers. Depending on the incident, you may need to contact law enforcement or consider engaging a lawyer for advice. You may also need to contact your media team.

Types of incidents

Your organization can face many different incidents. Some examples include:

Ransomware

Ransomware is a type of malware that locks you out of files or systems until you pay a ransom to a threat actor. Payment does not guarantee that you will regain access to your information.

Data theft

Data theft occurs when threat actors steal information stored on servers and devices. The data is most commonly accessed using stolen user credentials. Advanced persistent threats (APTs) refer to threat actors that are highly sophisticated and skilled. APTs are able to use advanced techniques to conduct complex and protracted campaigns in pursuit of their goals. The APT designator is usually reserved for nation states or very proficient organized crime groups.

Active exploitation

Active exploitation takes advantage of unpatched software, hardware, or other vulnerabilities to gain control of your systems, networks, and devices. These attacks can go unnoticed before you have the opportunity to apply a patch or update. Your plan should provide instructions for mitigating active exploitation, such as temporarily suspending Internet access or ceasing online activity.

Top of page
 

Main steps in your incident response plan

Your IRP should identify the objectives, stakeholders, responsibilities, communication methods, and escalation processes used throughout the incident response lifecycle. Keep the plan simple and flexible. Test, revisit, and revise your incident response plan annually to keep it effective.

Follow the incident response lifecycle steps below to structure your IRP.

Preparation

  1. Start with a statement of your management's commitment to the project. Perform a risk assessment to identify your organization's most valuable assets that are critical to your business operations
  2. Define the security incidents your organization is most likely to face and create detailed response steps for these incidents
  3. Lay out the objectives of your incident response strategy, as well as your related policies, standards, and procedures. Your policy should include performance measures, the incident data that you collect over time (for example, the number of incidents and time spent per incident)
  4. Define your goals to improve security, visibility, and recovery
  5. Develop and implement a reliable backup process to create copies of your data and systems to help you restore them during an outage
  6. Have a detailed strategy for updating and patching your software and hardware. Use this strategy to track and fix vulnerabilities and mitigate the occurrence and severity of incidents
  7. Create your response team and assign roles and responsibilities to each member
  8. Define your communications plan and identify how key stakeholders and management will be informed throughout the incident. You should have multiple communication mechanisms in place, this may be valuable during an incident
  9. Develop exercises to test your plan and response. You can revise and improve your plan using your test results

Detection and analysis

Monitor your networks, systems, and connected devices to identify potential threats. Produce reports regularly and document events and potential incidents. Analyze these occurrences and determine whether you need to activate your IRP. Determine the frequency and intensity of your monitoring.

Although it is impossible to have a step-by-step guide for every incident, you should be prepared to handle incidents that use common attack vectors.

In the event of a breach or compromise, analyze the incident, including its type, its origin, and the extent of the damage caused. All facts about the incident should be documented. When an incident is detected, analyzed, and prioritized, your incident response team should notify the appropriate stakeholders so that everyone that needs to be involved is informed.

Containment

Containment is crucial for your organization's recovery. The primary goal is to minimize business impact.

Gain an understanding of the issue so you can contain the threat and apply effective mitigation measures.

An effective mitigation measure for an IT environment may include deactivating connectivity to your systems and devices to block the threat actor from causing further damage. It might be necessary to isolate all systems and suspend employee access temporarily to detect and stop further intrusions.

Containment strategies and procedures will depend on the type of incident, the degree of damage the incident can cause, and your operational requirements. Refer to your organization's incident containment strategies, established in the preparation phase.

When dealing with an incident, the risk assessment completed in the preparation phase should help you define your acceptable risk so that you can develop your containment strategies accordingly.

Eradication

Conduct a root cause analysis to identify and remove all elements of the incident from the affected systems and complete the following actions:

  • Identify all affected systems, hosts, and services
  • Remove all malicious content from affected systems
  • Scan and wipe your systems and devices
  • Identify and address all residual attack vectors
  • Communicate with stakeholders to ensure appropriate management of the incident
  • Harden, patch, and upgrade all affected systems
  • Upgrade or replace legacy systems

Recovery

Restore and reintegrate the affected systems back into your operating environment.

  • Ensure any malware is removed before restoring your backups
  • Test, verify, monitor, and validate affected systems to ensure they are running effectively
  • Revise and update policies, procedures, and training initiatives

Post-incident activities and lessons learned

Review the root cause of the incident and collaborate with the response team to determine what can be improved. Evaluate your incident response processes and highlight what went well and what areas require improvement. Create a lessons learned document that details how you will adjust and improve your plan for future incidents. The results of the lessons learned should be used to improve detection methods and prevent repeated incidents.

In-house or professional services

When developing your IRP, determine which actions and services you can conduct internally and which actions you will outsource. Professional services can be retained to assist with incident response initiatives, such as developing your plan, determining your backup processes, and monitoring and patching your systems. Outsourcing incident response for OT incidents or other specialized environments can be costly, and it is important to plan for these scenarios.

Learn more

Top of page
 
]]>https://cyber.gc.ca/en/guidance/developing-your-business-continuity-plan-itsap10005<![CDATA[Developing your business continuity plan (ITSAP.10.005)]]>2026-01-16T19:02:04Z

In the event of a cyber incident or natural disaster, your organization will need a business continuity plan (BCP) to resume its most critical business operations quickly. Your BCP will identify the risks from various threats and the impact they would have on your organization. BCPs outline the main assets, roles, responsibilities, and processes required to minimize disruptions and keep critical business functions running until your operations can be fully restored. Organizational resilience and compliance with regulations, policies, and standards are some of the reasons you should have a BCP.

On this page

Business continuity lifecycle

Your BCP needs to be tested, reviewed, and updated regularly. To ensure your BCP is relevant, useful, and reliable, you should follow the 5 steps of the business continuity planning lifecycle.

Initiate

Identify your organization’s unique goals and objectives, as well as the key people and processes required to meet these goals. Create a response team and assign a team leader. Be sure to include members from various operational areas of your organization. Each member should know the threats that could affect your organization and the level of impact of the associated risks. Ensure you communicate the intent of your BCP and the expected outcomes to senior management for approval.

Analyze

Conduct a threat and risk assessment (TRA) to identify the possible threats and risks that could disrupt your organization’s operations. Once the TRA is finalized, complete your business impact analysis (BIA). Your BIA will identify critical and non-critical business operations. Additionally, your BIA will list the consequences of disruption from the risks identified in your TRA. Examine critical operations to determine their recovery time objective (RTO) and recovery point objective. Your RTO is the planned time and level of service needed to meet the system owner’s minimum expectations.

For more information on TRA and BIA, read:

Develop and implement

Create strategies that will allow your most critical business operations to resume for each of your identified risks. These strategies should mitigate or minimize the impact on your organization’s stakeholders, operations, and assets. As you develop your BCP, consider the following best practices:

  • identify the response team, their roles, and their responsibilities
  • develop communication methods and recovery procedures
  • identify an alternate work site and an employee relocation plan
  • consolidate a list of alternate resources and suppliers
  • establish an IT recovery plan
  • establish policies to be implemented during a disaster, emergency, or incident
  • determine the resources required to roll out the activities in your plan
  • identify timeframes in which services and business operations need to be available
  • identify the resources required to ensure prioritization and a quick, relevant response
  • create reports to share with stakeholders
  • provide your employees with awareness and training on the identified risks, emergency preparedness, and response strategies
  • document your plan, validate it, and share it with your organization’s management teams
  • store your BCP in a secure location that is known to your response team and available in a disaster or incident

Communicate and integrate

Communicate your BCP to employees and stakeholders. Ensure you integrate your plan into your organization’s policies. To avoid misinformation during an incident, develop a communication and public relations plan. Include guidance on how to communicate to all internal and external parties, including the media.

Test and validate

Risks, priorities, and business operations will change over time. Your BCP will require improvement through ongoing analysis, testing, validation, and implementation. Learning opportunities like seminars, tabletop exercises, and live simulations will assess your response team’s preparedness and identify any weak points in your plan. Testing your BCP will evaluate and validate your identified procedures, training initiatives, technical solutions, and recovery procedures. Use test results to update the BCP and ensure it remains aligned to your organization’s operational requirements and threat landscape.

 
Top of page
 

Common disruptors to business operations

Natural disasters, global events, equipment failures, and compromises to your supply chain can all impact your business operations. In addition to these events, your organization needs to be prepared to mitigate the effects of various cyber threats, such as:

  • malware and ransomware incidents
  • data theft
  • distributed denial of service attacks
  • account compromises

Additional emergency preparedness strategies

Your BCP will address how to recover and resume only your most critical business operations during an incident. Your organization needs other plans to ensure it can detect, respond to, and fully recover all operations after any incident.

Your incident response plan (IRP) details the steps your organization will take to handle a specific security incident, mitigate the related risks, and recover quickly. Having an IRP will help your response team reduce organizational downtime and business disruption during an incident.

Your disaster recovery plan, which can include your IT recovery plan, will help your organization return to full operations after an incident.

For more information on developing these plans, read the Cyber Centre’s publications:

In addition to these plans, your organization can further reduce vulnerabilities and increase incident preparedness by taking the following preventative measures:

  • back up your systems and data online and leverage mechanisms to verify that these backups are trustworthy
  • provide employees with cyber security training tailored to their roles and your organization
  • monitor your network and review your audit logs to identify anomalies or potential compromises
  • enforce phishing-resistant multi-factor authentication wherever possible
  • limit the number of administrator accounts
  • ensure administrator tasks are completed on a dedicated administrative workstation

Learn more

Top of page
]]>https://cyber.gc.ca/en/news-events/joint-guidance-secure-connectivity-principles-operational-technology<![CDATA[Joint guidance on secure connectivity principles for operational technology]]>2026-01-14T18:00:58Z

The Canadian Centre for Cyber Security (Cyber Centre) has joined the United Kingdom’s National Cyber Security Centre (NCSC-UK) and the following international partners in releasing guidance on secure connectivity principles for operational technology (OT):

  • Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
  • Germany’s Federal Office for Information Security (BSI)
  • Netherlands’ National Cyber Security Centre (NCSC-NL)
  • New Zealand’s National Cyber Security Centre (NCSC-NZ)
  • United States’ Cybersecurity and Infrastructure Security Agency (CISA)
  • United States’ Federal Bureau of Investigation (FBI)

Organizations deploying or operating OT systems often face challenges in prioritizing cyber security due to operational constraints. An example of such a constraint is the dependence on legacy technologies that were never designed for modern connectivity or security requirements. Opportunistic and highly capable threat actors are known to target exposed and insecure OT connectivity.

This joint guidance outlines the desirable end-states that organizations should achieve when designing connectivity into OT environments. The end-states are intended as goals rather than minimum requirements.

System owners should use these principles as a framework to design, implement and manage secure OT connectivity, for both new and existing OT systems. These principles are particularly critical for operators of essential services.

Read the full joint publication: Secure connectivity principles for operational technology (OT).

Related guidance

]]>https://cyber.gc.ca/en/guidance/generative-artificial-intelligence-ai-itsap00041<![CDATA[Generative artificial intelligence - ITSAP.00.041]]>2025-12-10T18:20:09Z

Many organizations use artificial intelligence (AI) for process optimization, data analysis, diagnostics and customization of their user experience. Generative AI is a type of AI that generates new content by modelling features from large datasets that were fed into the model. While traditional AI systems can recognize patterns or classify existing content, generative AI can create unique content in many forms, including text, image, audio or software code.

A subset of generative AI that has seen significant improvement in recent years is large language models (LLMs). To create content, LLMs are provided a set of parameters (for example, a query or prompt). Since late 2022, several LLMs (for example, Microsoft’s Copilot, OpenAI’s ChatGPT and Google’s LaMDA) and services using LLMs (for example, Google’s Bard and Microsoft’s Bing) have gained the world’s attention. This publication provides some information on the potential risks and mitigation measures associated with generative AI.

On this page

How generative is AI being used

Generative AI is both a transformative and disruptive technology that may significantly alter how consumers, industries or businesses operate. It has the potential to enable creativity and innovation that could improve services and business operations. Some common examples of generative AI being used to enhance products and contextualize content include:

Image and video

Generative AI can be used to analyze, alter and create visual content for personal or business use. AI can use visual searches and contextualize content to offer alternate descriptions and examples.

Robotics

AI technology that uses motion planning and detection to perform different tasks, for example, self-driving vehicles and drones. Generative AI can be used to automate processes and enhance features.

Language

AI can understand voice and text to analyze, respond and carry out tasks. Call centres and website chatbots use generative AI to analyze initial requests and offer information to try and solve common questions without needing human interaction.

Entertainment

AI scans engagement to analyze connections between different software and applications and recommend content to users.

Generative AI is used in many industries and businesses to help enhance processes. The following sectors have found useful applications for generative AI:

Healthcare

Assists healthcare providers in making faster diagnoses and offers the ability to create personalized treatment plans. It can also be used in medical-assisting robots to help in surgery, diagnostic testing and analysis areas.

Software development

Enables software developers to generate code, assists in debugging or offers code snippets. This can help speed up the development and release of software products. Generative AI is also implemented in software to enhance different features and offer context or analyses for users, for example, in Microsoft Word.

Online marketplace

Generates human-like responses with chatbots and conversational agents, which can help organizations improve customer service and reduce support costs.

Business

Creates personalized customer communications for existing and prospective clients and generates predictive sales modelling to forecast their behaviour. It can also quickly produce unique and cost-effective outputs to use in marketing campaigns, advertising and video productions.

Agriculture

Automates farming tasks like planting, harvesting and monitoring in self-working machinery. It also offers tailored advisories and predictions to enhance sustainability and efficiency in product results and to reduce costs and labour.

Education

Allows educators to create personalized learning plans for students tailored to their individual performance, needs, and interests, which could help teachers better support their students.

Cyber security

AI facilitates enhancement of cyber defence tools against ransomware and other attacks. It assists cyber security practitioners to more easily scan large datasets to identify potential threats and minimize false positives by filtering out non-malicious activities.

Top of page
 

The risks involved with generative AI

While the capabilities of generative AI technology present great opportunities, they also bring many risks. Generative AI can enable threat actors to develop malicious exploits and potentially conduct more effective cyber attacks, especially as advances in AI allow for higher quality and quantity of content. A significant concern is that it can provide threat actors with a greater capacity to influence. Here are some of the potential risks to be aware of:

Misinformation and disinformation

Content not clearly identified as being AI-generated can result in the spread of misinformation, disinformation and confusion. Threat actors use AI in scams and fraudulent campaigns against individuals and organizations.

Phishing

Threat actors can craft targeted spear-phishing attacks more frequently, automatically, and with a higher level of sophistication. Highly realistic phishing emails or scam messages could lead to identity theft, financial fraud or other forms of cybercrime.

Privacy of data

Users may unknowingly provide sensitive corporate data or personally identifiable information (PII) in their AI queries and prompts. Threat actors could harvest this sensitive information to impersonate individuals or spread false information.

Malicious code

Technically skilled threat actors can overcome restrictions within generative AI tools to create malware for use in a targeted cyber attack. Those with little or no coding experience can use generative AI to easily write functional malware that could disrupt a business or organization.

Buggy code

Software developers may inadvertently introduce insecure and buggy code into the development pipeline. This could happen if they omit or improperly implement error handling and security checks.

Poisoned datasets

Threat actors can inject malicious code into the dataset used to train the generative AI system. This could undermine the accuracy and quality of the generated data. It could also increase the potential for large-scale supply-chain attacks.

Biased content

Most of the training datasets fed into LLMs come from the open Internet. As such, generated content has a fundamental bias in that only limited amounts of the world’s total data are online and available for AI to use. Also, generated content may be prejudiced if the training dataset lacks balanced representation of data points.

Loss of intellectual property

Generative AI tools may enable sophisticated threat actors to steal corporate data more easily, quickly and in larger quantities. Loss of intellectual property (for example, proprietary business information and copyrighted data) can devastate your organization's reputation, revenue, and future growth.

Be aware of information received from AI

It is important to be cautious when using generative AI and understand it is a technology that uses machine learning to construct responses based on a prompt or query. Always keep in mind that its outputs:

  • can be incorrect
  • might not make sense
  • might not take certain factors into account
  • can be biased

It is also important to be careful and analyze AI content before acting or using it. You should always be aware of and validate your sources to verify whether the content being presented is accurate.

Top of page
 

How to mitigate the risks

Generative AI is a powerful tool that threat actors can leverage to launch cyber attacks. As this technology becomes more widespread, cyber attacks will likely grow in frequency and sophistication. Although detecting AI-enabled threats can be challenging, organizations and individuals can prepare for the increased challenges that these attacks may bring.

Organizations and individuals should practice basic cyber security hygiene as a starting point in understanding risks and taking the appropriate measures to mitigate them.

Organizations should consider the following cyber security measures to minimize their risks of being compromised by cyber attacks:

Enforce strong authentication mechanisms

Secure accounts and devices on your networks with multi-factor authentication (MFA) to prevent unauthorized access to your high-value resources and sensitive data.

Apply security patches and updates

Enable automatic updates of IT equipment and patch known exploited vulnerabilities as soon as possible. This will help to prevent AI-generated malware from infecting the network.

Stay informed

Keep up to date on the latest threats and vulnerabilities associated with generative AI and take proactive steps to address them.

Protect your network

Use network detection tools to monitor and scan the network for abnormal activities. This allows you to quickly identify incidents and threats and deploy appropriate mitigation measures. Additionally, explore how AI might be deployed defensively in network protection tools and consider any ramifications.

Train your employees

Educate all users on how to identify the warning signs of social engineering attacks and who to contact to manage these situations securely. This should include an easy way for users to report phishing attacks or suspicious communications.

Individuals should consider the following measures to protect their personal data from AI-related cyber attacks:

Be cautious when sharing data

Do not share private information with AI tools unless you understand what they are doing with your data. Sharing data trains AI models to then be potentially exploited or sold.

Verify content

As more data becomes available, it may be difficult to know who is responsible for the content or how much of it is logical or factual. It's important to read and look for signs that the content was produced by a generative AI tool. Review the generated content and take the time to fact check it against credible sources.

Practice basic cyber security hygiene

Stay informed, use strong passwords and enable MFA to protect online accounts. Make sure to keep software up to date, use antivirus software and avoid public Wi-Fi networks.

Limit exposure to social engineering or business email compromise

Implement basic online safety practices such as:

  • reducing the amount of personal information you post online
  • avoiding opening email attachments and clicking on links from unknown sources
  • communicating via an alternate, verified channel
  • being suspicious of callers or senders that ask for sensitive information
Top of page
 

Security measures to consider using

If you plan to use or are already using generative AI, the following security measures can help you generate quality and trustworthy content while mitigating privacy concerns:

Implement a cyber security risk plan

Your organization should establish a plan that identifies policies on how AI should be used and the content that is allowed to be generated. Enforce security-by-design throughout the AI system lifecycle to monitor components and third-party software. Your policies should include the oversight and review processes required to ensure the technology is used appropriately. Consider if AI is a necessary tool for the task (for example, weigh the risks and costs) and whether developing an in-house AI tool would be of higher value than using third-party products.

Select your vendor carefully

When using pre-trained AI, ask your provider if the datasets were acquired externally or developed internally and how they were validated. Use diverse and representative data to avoid inaccurate and biased content. Establish a process for outputs to be reviewed by a diverse team from across your organization to look for inherent biases within the system. Ensure your vendor has robust security practices implemented in their data collection, storage and transfer processes. Continuously fine-tune or retrain the AI system with appropriate external feedback to improve the quality of outputs.

Be careful what information you provide

Avoid providing PII or sensitive corporate data as part of the queries or prompts. Determine whether the tool allows your users to delete their search prompt history.

Learn more

Top of page
]]>https://cyber.gc.ca/en/guidance/artificial-intelligence-itsap00040<![CDATA[Artificial Intelligence - ITSAP.00.040]]>2025-12-10T18:19:19Z

Artificial intelligence (AI) uses intelligent computer programs to find patterns in data to make predictions or classifications. AI can be used to perform specific tasks by analyzing data online to replicate human thought processes and decision-making abilities. Machine learning, a subset of AI, uses algorithms and data to understand languages, text and multimedia to help the computer system learn and improve based on its own experience. Deep learning is a subset of machine learning that uses vast volumes of data and a layered structure of algorithms to train a model to make intelligent decisions independently.

On this page

What AI can do

AI already plays a big role in our everyday lives by providing recommendations, information, answers to questions and help with organizing our schedules. Applications like search engines, online shopping and voice assistants on mobile devices or smart speakers create data and feedback for machine learning tools to learn and improve from.

While AI is commonly used as a digital assistant, it can also be used to enhance your organization’s operations. AI can create code, develop procedural steps, optimize workflows and provide metadata and advanced analysis as a cyber security tool. Its availability and capabilities continue to grow and are becoming an increasingly vital component of cyber security.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) have evaluated some security related AI use cases and determined they hold no safety-impacting concerns. Some of these use cases include:

  • automated detection of personally identifiable information in cyber security data
  • confidence scoring for cyber security threat indicators
  • malware reverse engineering
  • detection of anomalies in critical infrastructure networks
  • detection of anomalies in security operations centre networks
  • drafting tailored summaries of medical documents for different publication channels
  • chat tools for interacting with, summarizing and searching agency materials and internal content

CISA is continuing to explore new ways to integrate AI tools to improve efficiency and strengthen cyber security. For more details, read CISA Artificial Intelligence Use Cases.

Top of page
 

What AI can’t do

AI still faces certain fundamental limitations. For example, it can be quite difficult for AI to use intuition or common sense, adapt to different situations and understand cause and effect. Humans, with their judgement and insight, can handle situations that require more intuitive problem-solving and decision-making skills.

How organizations use AI

Organizations use AI in a variety of ways to enhance their processes and reduce costs. Some common ways AI is used include:

Facial recognition

A leading application of AI that looks at facial features in an image or video to identify or verify the individual.

Process optimization

A properly trained machine learning tool, for example, learning from accurate data, can use the data to give more accurate solutions and perform mundane tasks faster than a human can.

Digital assistants

Chat or voice bots can improve customer service and reduce support costs. Customers can receive help within seconds at any time. These services are often highly personalized and can be based on a user’s preferences and history with the organization.

Fraud detection

Sophisticated machine learning tools can detect fraudulent emails faster than a human can. These tools sort through your inbox and move spam and phishing emails to your junk folder.

Document generation

Software applications use AI-powered tools to create well-structured documents. The application uses user prompts to generate formatted documentation.

Coding

AI uses natural language prompts to automatically generate code, functions and development tasks to increase productivity and streamline data. AI can analyze and offer improvements on existing code to debug and enhance performance.

Data analysis

Using machine learning algorithms, AI can analyze large amounts of data and discover new patterns. This is known as automation and greatly reduces the processing time spent by a data analyst and improves business performance.

Several industries use AI-powered tools to enhance their processes and offer further insight with continuously advancing areas of technology. Some of these industries include:

Healthcare

In the medical industry, AI can help in patient diagnosis and treatment in many ways, for example, through computer-aided diagnostic systems. Machine learning in precision medicine is another highly useful tool and can help predict which treatments are most likely to be successful.

Advertising

AI helps advertising agencies create, optimize and personalize ad campaigns by analyzing user data and delivering content that would appeal to specific audiences. AI reduces the time and cost associated with production through its ability to generate text, images and video content.

Cyber security

AI is useful in detecting new threats to organizations through automation. By using sophisticated algorithms, AI can:

  • automate detection of threats such as malware
  • run pattern recognition to find relationships between different attack vectors
  • provide superior predictive intelligence
Top of page
 

The threats involved with AI tools

AI tools are often only as good as the data model they rely upon. The main threats to AI come from compromises to its data. Common methods of compromise include:

Data poisoning attack

This type of attack occurs during a machine learning tool’s training phase. AI tools rely heavily on accurate data for training. When poisoned (inaccurate) data is injected into the training dataset, the learning system may be taught to make mistakes.

Adversarial example

This type of attack occurs after the machine learning tool is trained. The tool is fooled into classifying inputs incorrectly. For example, in the case of autonomous vehicles, an adversarial example could be a slight modification of traffic signs in the physical world (like subtle fading or stickers applied to a stop sign). The modification causes the vehicle’s AI system to misclassify a stop sign as a speed-limit sign. This could seriously impact the safe operation of self-driving vehicles.

Model inversion and membership inference attacks

These scenarios occur when a threat actor queries your organization’s data model. A model inversion attack will reveal the underlying dataset, allowing the threat actor to reproduce the training data. A membership inference attack confirms if a specific data file is part of the training data. Both model inversion and membership inference attacks could compromise the confidentiality and privacy of your training data and expose sensitive information.

How threat actors use AI

Alongside organizations using AI-powered technologies to enhance their business processes, threat actors also use AI to enhance their cyber attack methods. Some AI-related attacks can include:

  • using deepfakes to impersonate authority figures
  • impersonating legitimate websites
  • altering source code for malware to lower detection rates
  • processing public imagery and videos to geolocate facilities and identify industrial control systems to analyze and target equipment and connected systems

What else you should know about AI

AI is continuously evolving with new tools and enhanced features. Some other information you should know about AI include:

  • AI can detect patterns in data
  • AI needs enough data to see the patterns at a high enough frequency or resolution
  • AI will have a narrow scope if the data is not diverse
  • AI will provide unreliable results if the training data used is not accurate
  • data used for training should be complete, diverse and accurate
  • missing data may result in some patterns not being discovered, and the patterns that are found might not be accurate
  • data that is recorded and collected for quality-control purposes can contain both sensitive and personal information

Many organizations are now using trustworthy AI policies to ensure that their use of AI tools minimize potential biases and unintended consequences, especially regarding the treatment of individuals. Policies may also assist in the development of appropriate protocols for the handling of sensitive and personal information. An example of an AI policy is the Government of Canada’s recently adopted Directive on Automated Decision-Making. If your organization intends to deploy AI, it should consider seeking legal advice to manage the many ethical, privacy, policy, and legal considerations that come from using AI.

Learn more

Top of page
]]>https://cyber.gc.ca/en/news-events/joint-cyber-security-advisory-pro-russia-hacktivists-conducting-opportunistic-attacks-global-critical-infrastructure<![CDATA[Joint cyber security advisory on pro-Russia hacktivists conducting opportunistic attacks on global critical infrastructure]]>2025-12-09T21:23:40Z

The Canadian Centre for Cyber Security (Cyber Centre) has joined the United States' Federal Bureau of Investigation (FBI) and other domestic and international partners in issuing a joint advisory on pro-Russia hacktivist attacks.

This joint advisory highlights the unsophisticated and opportunistic tactics, techniques and procedures (TTPs) used by pro-Russia hacktivist groups to target critical infrastructure (CI) globally. These attacks target minimally secured, Internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) operational technology (OT) control devices within CI systems.

OT owners and operators and CI entities should implement the following recommendations to reduce the risk of pro-Russia hacktivists targeting control networks through VNC connections:

  • Reduce exposure of OT assets to the public-facing Internet
  • Implement network segmentation between IT and OT networks
  • Adopt mature asset management processes, including mapping data flows and access points
  • Ensure that OT assets are using robust authentication procedures  
  • Enable control system security features that can separate and audit view and control functions
  • Collect and monitor OT asset and networking device traffic
  • Review configurations for setpoint ranges or tag values to stay within safe ranges and set up alerts for deviations
  • Implement and practice business recovery and disaster recovery plans

This joint advisory updates CISA's joint fact sheet Primary mitigations to reduce cyber threats to operational technology.

Read the full joint advisory: Pro-Russia hacktivists conduct opportunistic attacks against US and global critical infrastructure.

]]>https://cyber.gc.ca/en/guidance/ransomware<![CDATA[Ransomware]]>2025-12-09T15:47:29Z

Ransomware is the most common cyber threat Canadians face and it is on the rise.

During a ransomware attack, cybercriminals use malicious software to encrypt, steal, or delete data, then demand a ransom payment to restore it.

Ransomware can have severe impacts including core business downtime, permanent data loss, intellectual property theft, privacy breaches, reputational damage and expensive recovery costs.

Basic cyber security practices would prevent the vast majority of ransomware incidents in Canada.

This page offers resources from the Cyber Centre to help Canadians and Canadian organizations understand the ransomware threat and take action to protect themselves.

Reports

Ransomware case study: the Conti group

This case study describes the typical methods of the Conti ransomware group, one the most prolific cybercriminal groups in operation.

Even by ransomware standards, Conti is regarded as one of the most ruthless and damaging gangs, frequently targeting hospitals, medical networks and other critical services.

In a typical attack Conti actors steal, encrypt and/or delete files. They also threaten to leak sensitive data if the ransom is not paid, a tactic known as “double extortion.”

A typical Conti ransomware attack takes place in four stages: reconnaissance, intrusion, infection and impact.

Long description follows
Long description - Stage 1: Reconnaissance

Conti actors gather information to identify high-value targets such as hospitals and other organizations that provide essential services or hold sensitive data. They use Internet searches, system scans and information shared on the Dark Web, such as stolen passwords or login credentials. Conti actors continue to gather information throughout the attack cycle to leverage greater ransoms and to ensure payment is not withheld. Footnote 1

 
Long description follows
Long description - Stage 2: Intrusion

Conti actors typically gain illicit access to the victim’s system either through stolen credentials or through spear phishing emails containing malicious attachments or links. Unlike generic phishing attempts, spear phishing emails are personalized to the recipient, making them more convincing.

Often the malicious attachment appears to be a regular file type, such as Word, Excel or PDF, but when the victim opens it, malware, such as TrickBot, IcedID, or BazarLoader, downloads and executes on their device.

 
Long description follows
Long description - Stage 3: Infection

Once the first device is infected with malware, Conti actors will often install Cobalt Strike software as a command and control (C2) mechanism to coordinate the next phase of the attack.

They exploit unpatched vulnerabilities and often use tools already available on the victim network to gain persistent access.

They use remote execution software (such as PSExec and Remote Desktop Protocol) to move laterally across the victim network, obtaining credentials and escalating privileges without triggering anti-virus software.

This process allows them to spread the infection to all connected devices on the network.

 
Long description follows
Long description - Stage 4: Impact

At this point, the Conti actors deploy the ransomware, exfiltrating (stealing), deleting or encrypting the victim's sensitive data.

They employ a double extortion technique in which they demand a ransom to restore the encrypted data, while threatening to leak it publicly if the ransom is not paid. They may in fact have already deleted the data, but the victim does not know that.

 

Facts and figures

Since January 2020 Conti has leaked several hundred gigabytes of data stolen in over 450 cyber attacks against Canadian and international organisations.Footnote 2 This is based on information from Conti’s own “Ransomware Leak Site”. We assume that many more victims have paid ransom without having their data published online.

Conti has publicly claimed to have compromised and stolen data from at least 24 Canadian victims so far in 2021. More than half of those belonged to the machinery, professional services, real estate, and specialty retail sectors.

As of September 2021, the Conti group’s average ransom payment is $373,902 USD. Footnote 3

Conclusion

The Conti group is one of the most sophisticated ransomware groups in operation. However, at every step of this process, there are cyber security tools and practices that can prevent or mitigate the impact of ransomware attacks.

You can find further resources on ransomware, including how to defend against it, on the Cyber Centre’s dedicated ransomware page.

Guidance for organizations

Guidance for all Canadians

Additional resources

Report a cyber incident

Reporting a cyber incident helps the Cyber Centre keep Canada and Canadians safe online. Your information will enable us to provide cyber security advice, guidance and services.

Get Cyber Safe

Get Cyber Safe is a national public awareness campaign created to inform Canadians about cyber security and the simple steps they can take to protect themselves online.

 
]]>https://cyber.gc.ca/en/news-events/joint-malware-analysis-report-brickstorm-backdoor<![CDATA[Joint malware analysis report on Brickstorm backdoor]]>2025-12-04T20:19:45Z

The Canadian Centre for Cyber Security (Cyber Centre) has joined the United States’ Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA) in releasing a Brickstorm malware analysis report.

This joint report warns that People’s Republic of China (PRC) state-sponsored threat actors are using Brickstorm malware for long-term persistence on victims’ systems. This activity has been primarily observed on government services and facilities and information technology sector organizations. The report also provides indicators of compromise (IoCs) and detection signatures based off analysis of Brickstorm samples.

Brickstorm malware is a sophisticated backdoor for Linux, specifically VMware vCenter servers, VMKernel (VMware ESXI), and Windows environments. PRC state-sponsored threat actors have been observed targeting VMware vSphere platforms. Once compromised, the actors can use their access to vCenter to steal cloned virtual machine (VM) snapshots for credential extraction and create rogue VMs hidden from the vCenter management console.

We urge organizations to use the IoCs and detection signatures in this malware analysis report to identify Brickstorm malware samples.

Read the full joint publication: Malware analysis report – Brickstorm Backdoor

]]>https://cyber.gc.ca/en/guidance/public-content-provenance-organizations-using-content-provenance-improve-audience-trust-organizations-information-online-itsp10005<![CDATA[Public content provenance for organizations (ITSP.10.005)]]>2025-12-04T15:09:56Z

Alternate format: Public content provenance for organizations - ITSP.10.005 (PDF, 1.0 Mb)

Overview

This publication is intended for security and public communications practitioners. It lays the foundation in explaining what public content provenance is and why it's an important tool for organizations to establish a verifiable historical record of the content they make available online. It provides information about the range of technologies which help to establish trust in digital records along with examples of how they might be used to meet different requirements.

This publication has been jointly researched and co-authored by the Canadian Centre for Cyber Security (Cyber Centre) and the United Kingdom’s National Cyber Security Centre (NCSC). The Cyber Centre and the NCSC do not directly endorse the products, services or methodologies in this publication. The tools and standards described are a means to demonstrate how to improve cyber resilience in different contexts using combinations of technologies.

Table of contents

1. Securing trust in digital content: Why public content provenance matters

In today's digital age, information on the Internet cannot be relied on consistently as a source of truth. The rapid rise in the volume of available information and the accelerated pace of content generation, particularly through Artificial Intelligence (AI), mean the Internet has become a battleground for interference and malicious cyber activities.

In this environment, organizations are finding it increasingly challenging to ensure the authenticity and integrity of their information. As such, they must rethink how they establish and maintain trust with their audiences. As highlighted in the NCSC’s Impact of AI on cyber threat from now to 2027 and the Cyber Centre’s Cyber threats to Canada’s democratic process: 2025 update, AI-enabled capabilities continue to proliferate to cyber criminals. States are beginning to integrate AI-enabled technologies into their cyber capabilities. Organizations will therefore need tools to improve their resilience and security to protect the integrity of data and information. A cornerstone of these efforts is the establishment of provenance for digital content.

Provenance refers to the place of origin. It is used in the physical world to verify the authenticity of artefacts, but it is also relevant in the online world. Many organizations already employ versioning and logging systems to establish provenance for internal documents. However, these systems are often useful only within the organization. To build stronger trust with external audiences, organizations need to improve how they address the public provenance of their information

2. The challenge of securing digital trust in today’s complex information environment

Today’s information environment comprises a wide variety of forms of communication, ranging from traditional media and social media to telephone conversations and even signs on lampposts. This makes it easy to access large amounts of information quickly. Different processes within this environment collect and reorganize data and metadata to meet the needs of various groups such as information seekers, publishers and advertisers. Additionally, social media platforms enable widespread republishing and the option to add commentary.

Although the information environment benefits both content creators and consumers, it also presents challenges. An original piece of content may be collected, reorganized, summarized, aggregated, reformatted, republished and modified throughout its lifecycle. Modifications may be made deliberately or otherwise, and with or without intent to deceive. These modifications can be difficult to detect as the information rarely persists in its original form. This means we cannot be certain that the intended meaning of the content is retained. Or worse, that it has been distorted.

For security practitioners, protecting information in this environment poses significant challenges. They have traditionally focused on protecting the confidentiality, integrity and availability of digital data directly controlled by the organization but now must also focus on protecting publicly available information about their content, which is outside of their control. To address this, organizations can use public trust mechanisms to verify the source and history of content.

Figure 1: Communicating an organization’s information in the information environment

Figure 1 - Long description immediately follows
Long description - Figure 1: Communicating an organization’s information in the information environment

To communicate with the public, organizations share their information in the information environment. This environment comprises all forms of communication between the organization and the public audience and can include social media, content aggregation sites, web search services, traditional media such as radio and television, as well as others. Other parties can add to the communications with their own content in the form of comments, selective filtering and so on. The overall message that a member of the public audience receives or accesses may not be what is intended by the originating party. It may not even be accurate.

2.1 Digital content provenance explained

The term provenance is defined as the “place of origin” and is used as a guide to the authenticity and quality of a given artefact. It is traditionally used in the context of art and history. In digital environments the concept can be applied in many ways to deal with specific challenges in domains such as Internet content history, supply chain integrity, data management, software certification, scientific process management, financial transactions tracking as well as legal chain of custody management. Each has its own unique requirements.

The focus of this publication is public content provenance. Content provenance provides factual information about the history of digital content without making assertions about the value or truth of the content itself. Decisions on the veracity of the content are left to the consumer, but additional verifiable information is provided to aid them in making a final determination. Content provenance can provide different types of verifiable information including, but not limited to the following:

  • individual or entity making a claim about the content
  • date and time of a claim
  • image against its verified thumbnail
  • claims such as location, device or edits made with software
  • statements about whether the work is creative or AI-generated
  • assignment of rights to others (for example, via Creative Commons or other public copyright licenses)

By clearly establishing the facts about the history of its public digital content, such as its origin, authenticity and quality, organizations can build better trust with their audiences, customers and stakeholders.

Top of page

2.2 Digital content provenance analogy

A good analogy for provenance is that of a notary. Many legal systems employ the concept of a notary to witness signatures as part of legal proceedings. The notary is a trusted third-party who performs the witness activity in a way that is acceptable for legal requirements.

Members of the public who need documentation for legal requirements visit the notary, who confirms their identity and ensures they are signing willingly. The notary then attests to the content of their documentation, as well as the date and time the attestation was done. This attestation involves a formal declaration that the document is genuine and the signatures are valid. Notarized documents are legally recognized and can be used as evidence in court.

In a similar way, digital content owners use an attestation service to verify the details of the content, such as hash or thumbnail image, and establish verifiable evidence such as the location, time, and the notary details. This is done using cryptographic methods rather than paper documents.

Additionally, just as notaries maintain a ledger of all notarised documents, attestation services can record their attestation transactions as part of their service. The basic public notary function is illustrated in figure 2 below.

Figure 2: Notary function as analogy for public provenance

Figure 2 - Long description immediately follows
Long description -Figure 2: Notary function as analogy for public provenance

The notary function serves as an analogy for public provenance. Many jurisdictions employ notaries to act as third-party validators of documents to be used for legal purposes. The requester submits their documents to the notary and indicates their claims. The notary validates the documents as well as the claims and provides a formal record of attestation such as a stamp or document to the requester. The notary records their actions with the requester in a record register. The requester can provide the notary’s record of attestation to any verifier. The verifier, commonly the court, can also check with the notary to validate that the attestation was done. They can also check with the legal professional association as to whether the notary is licenced to perform the notary function.

2.3 How to earn trust in digital content

To establish why organizations need to consider public provenance, it is useful to understand the broader digital trust context. The issue of trust on the Internet is not new, and it was an integral part of the development of e-commerce.

A major objective for organizations is to establish trust with their audience, customers or stakeholders.

The World Economic Forum’s 2022 report describes the following 8 dimensions of trust for digital technology. These factors are important for information assurance more broadly.

  • Cyber security: mitigating the risks of both malicious and accidental uses of technology
  • Safety: preventing harm (for example, emotional, physical or psychological) to people or society from technology uses and data processing
  • Transparency: establishing visibility and clarity around digital operations and uses
  • Interoperability: ensuring information systems can connect and exchange information for mutual use without undue burden or restriction
  • Auditability: ensuring that organizations and third parties are able to review and confirm the activities and results of technology, data processing and governance processes
  • Redressability: providing the possibility of obtaining recourse where individuals, groups or entities have been negatively affected by technological processes, systems or data uses
  • Fairness: ensuring that an organization’s technology and data processing considers the potential for disparate impact and aims to achieve just and equitable outcomes for all stakeholders, given the relevant circumstances and expectations
  • Privacy: ensuring that individuals have control over the confidentiality of their personal or personally identifiable information

Most organizations today address these 8 dimensions to some degree, but digital trust requirements are evolving as the Internet matures. These requirements are also driven by changes in how people behave on the Internet and advances in AI.

2.4 How digital content provenance helps enhance public trust in an organization

Content provenance can help to address and enhance the digital trust in an organization in a number of the above 8 dimensions, including the following:

  • Cyber security: It helps verify that content is sourced from legitimate and secure origins, which reduces the risk of malicious content. It also helps with maintaining immutable records of content creation and modification to prevent unauthorized alterations.
  • Safety: It can reduce the impact of inaccurate information about individuals and organizations. The verifiable provenance record can aid in refuting inaccurate online information.
  • Transparency: It establishes verifiable metadata about the content itself. This metadata helps establish a content item's history, including creation and handling. The public availability of this information makes the content and related processes more transparent.
  • Auditability: It establishes a digital content record as well as the means to verify it. This can be used in auditing programs.
  • Fairness: It establishes a formal verifiable record of information about content. This can include information about the creator, ownership, and rights for digital content. This verifiable information can be used to adjudicate any issues around content rights and validity.

Content provenance provides the public with a means of assessing the accuracy of content created by or related to an organization. This can enhance the trust the public has in an organization.

Top of page

3. Provenance: Selecting suitable systems and technologies

The subject of content provenance isn't entirely new but advances in technologies, such as generative AI, are driving requirements for it to evolve even faster.

Frameworks which offer ways of structuring provenance systems are still being established.

There are multiple facets to the provenance challenge which will require different approaches. One approach may not necessarily solve all of an organization’s content provenance requirements. Some examples of the current provenance challenge include synthetic media labelling, provenance of digital source media, deepfake detection, and provenance of aggregated content.

Organizations will have to identify a framework relevant to their needs. The key aspects to consider when selecting a framework include:

  • how trust in the provenance record is established – does it use cryptographic methods such as trusted timestamps (see 3.2.1) and cryptographic identities (see 3.2.2) to secure integrity?
  • how members of the public can verify provenance – are the mechanisms simple and understandable by the public in general?

Organizations will have their own content provenance requirements but should be mindful of the rapidly evolving requirements and standards in public provenance infrastructure. They should consider standards used in their specific solution to ensure provenance functionality, such as verification work at scale.

In addition to choosing a provenance solution which meets its specific objectives, an organization will need to decide which technologies to use. This decision will be driven by organizational objectives as well as the availability of technology solutions.

3.1 What to consider when selecting provenance systems

Provenance systems vary in complexity, cost and effectiveness and organizations will choose their solution to meet their specific objectives. It is also important to consider that digital provenance technologies are in their infancy and that organizational requirements will inevitably evolve. For this reason, an organization may choose to implement partial or iterative solutions.

This section provides information on the aspects to consider when choosing provenance methods.

3.1.1 Source of trust

What is the source of trust for the content provenance record? Organizations may use internal services but will need to consider ways to mitigate the perception of "self-signing" the provenance record. This challenge can potentially be addressed by using third-party operators or auditors. Organizations will need to consider the reputation and stability of third-party organizations used for establishing the provenance record.

3.1.2 Extent of provenance record

How far back does the provenance record go? At a minimum, it should trace the content back to its publication date, and identify whether the information came from a real-world device or was generated by an AI system. Ideally, the provenance should be traceable all the way back to the creation of the original source material and include provenance information about other components it contains, such as images.

3.1.3 Ease of verification

How simple is it to verify the provenance of a content item? In most cases, the verifier will be a member of the general public. The verification mechanism must be simple to use and yield an easily understandable and accurate provenance record.

3.1.4 Cost of providing provenance

How much does it cost to provide the provenance record? The organization must be able to sustain the costs.

3.1.5 Strength of provenance claim

How strong are the provenance claims? Can facts about the identity and time claims stand up to scrutiny? Cryptographic validation by other parties can strengthen the claims and improve public trust in the content’s provenance record.

3.1.6 Duration of the provenance claim

How long will the provenance record need to exist? If it's in the range of years or decades, then consider the sustainability of both the content store and the verify mechanisms.

3.1.7 Utility of the provenance

How does the provenance mechanism aid in reducing errors or distortion of an organization's information? Does the mechanism aid the public in making decisions about the organization’s content? Other information correction measures may be more effective for an organization’s specific challenges.

3.1.8 Redress requirements

How is inaccurate information corrected? All countries have established legal mechanisms for responding to at least some inaccurate information claims against organizations in the form of libel laws. Most countries have laws in place to address copyright and trademark infringement issues. These and other laws can be used by organizations to seek redress for inaccurate information about them.

In some cases, such as copyright, there are very structured requirements for identifying infringing material and notifying hosting services to remove it, such as labelling and deploying automated processes for submission and response. Existing and potential future legal remedies and processes should be considered, as well as the cost and time required to use the redress mechanisms.

3.1.9 Privacy considerations

Can privacy of individuals be addressed? Identity of actors is an important provenance detail, but it is not always possible to use it such as where there may be risk to life, reputation or other concerns of individuals providing content. In some cases, it may be required by law to shield an individual’s identity.

Top of page

3.2 What to consider when selecting content provenance technologies

In addition to choosing a provenance solution which meets its specific objectives, an organization will need to decide which technologies to use. This decision will be driven by organizational objectives as well as the availability of technology solutions.

Technologies that may be relevant for an organization include:

  • cryptographic integrity mechanisms, such as public key infrastructure (PKI) identities, hashing and trusted timestamps, which can be used to bind together parts of the provenance solution to ensure the veracity and integrity of provenance records
  • authentication for devices and software, individuals and trust anchors, which is an essential part of establishing accountability in the provenance record
  • decentralised storage, which can help
    • address the continuity challenges with content and records when organizations are eventually disbanded
    • ensure that one party does not have full control over the digital content or ledger records
  • tamper-proof ledgers, which address the challenge of permanence in the provenance record by creating records that are impossible to alter without a record of the alteration and are independent of the content

Consideration should also be given to which parties implement the various technologies, to maximise the trust created. Organizations that create or “self-sign” their own provenance record are unlikely to see improvements in the trust of their content.

3.2.1 Trusted timestamps

Trusted timestamps are a useful provenance mechanism in that they establish a trusted timestamp for content state. When implemented properly, no one should be able to change a timestamp once it has been recorded. This concept is standardised in the RFC 3161: Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) and American National Standards Institute Accredited Standards Committee X9.95 standard (ANSI ASC X9.95).

The mechanisms use cryptographic methods to calculate a hash of the document and the timestamp. A third-party organization generally performs the timestamping to improve trust in the mechanism. Commercial services are available to perform this function.

3.2.2 Cryptographic identity

Cryptographic identities are part of PKI. They are bound to a private cryptographic key known only to that entity. The identity can be an individual, an organization, a machine entity such as a device or service, or can be anonymous.

Cryptographic identities are commonly anchored in public certificate authorities. They can play an important part in content provenance since they can bind individuals and devices to content and assertions on content. This can strengthen the provenance of the content.

3.2.3 Digital ledgers (Blockchain)

Blockchain is a decentralised digital ledger technology that records transactions in a secure, tamper-proof manner. Each transaction, or block, is cryptographically linked to the previous one, forming a continuous chain. This chain of blocks provides a complete and transparent history of all transactions, making it virtually impossible to alter or manipulate without detection.

Blockchains are often implemented in a decentralised file system, meaning that they are not owned by any one individual or organization and they have no single point of failure. Organizations can use public blockchains or they may choose to use a more private implementation, depending on specific provenance needs.

The NCSC has published guidance on the use of distributed ledger technology to aid in determining whether distributed ledger is an appropriate technology for a given scenario.

3.2.4 Web archiving

Web archiving refers to the process of collecting and preserving digital content from the World Wide Web so that it will be accessible in the future, even if the content is removed from a website. The primary goal of web archiving is to create a permanent record of web content, capturing website evolutions and online information changes. This process is invaluable for the preservation of digital media provenance because it captures digital assets' original form, context, and ownership, as well as subsequent versions. The Internet Archive Wayback Machine is an example of a general web archiving service.

The web archiving approach can be expanded into a more robust provenance mechanism using cryptographic signatures and timestamps. The archived data can be used to verify the authenticity and integrity of digital content and establish its historical context.

3.2.5 Digital watermarking

Digital watermarking is not a provenance mechanism but is included here because it is often considered for addressing digital trust challenges. Digital watermarking can be overt or covert.

Overt watermarking entails adding a visible or easily detectable watermark to content such as images or video. It is often a pattern which the viewer can see. Editing the watermark will result in distortions to the image or video that may be detectable by the end viewer if unsophisticated editing changes are made.

Covert watermarking entails adding a watermark the viewer cannot detect to the content. It will become distorted if the image or video is edited. Distortions will not be readily detectable by viewers but will be detectable by those implementing the watermarks.

Overt and covert watermarks may provide a means of detecting some attempts at altering digital content. Many forms of overt watermarks can be removed using modern editing software. Covert watermarks are limited in effectiveness by the small number of parties that can detect changes. These considerations may therefore limit the usefulness of watermarks in addressing digital trust requirements. However, watermarking can still add value as part of a layered defence implementation.

3.2.6 The Coalition for Content Provenance and Authenticity

The Coalition for Content Provenance and Authenticity (C2PA) is an industry organization that aims to address the prevalence of misleading online information through technical standards. It has established an open specification for documenting and certifying the source and history of media content.

The Content Authenticity Initiative (CAI), which includes major technology and media companies, is responsible for promoting the C2PA standard. C2PA is a relatively new but major standard in the provenance space, and it is still under development.

C2PA leverages cryptographic methods to establish provenance on media content. This is organized around a manifest that is stored as part of the content. The manifest can capture information about changes to an item, including the author/editor, timestamp and location, and cryptographically bind it to the content. There can be multiple manifests stored in a manifest store reflecting the history of changes to the content. This manifest store is also known as a Content Credential (represented by the “CR” icon). The standard leverages trusted timestamps and watermarking.

Top of page

3.3 Why private provenance systems aren’t suitable for public content

Most organizations have some sort of internal versioning and logging systems to track details of changes to content. These systems are private in the sense that the systems and supporting integrity mechanisms such as PKI certificate authorities are often internal to the organization.

A private provenance infrastructure works well for corporate and some legal requirements but is largely unusable for public provenance requirements. This is mainly because the mechanism is wholly managed by the organization and designed for restricted internal use only. Additionally, private provenance systems rely heavily on separation of duties as the main mechanism for integrity of records.

Private provenance systems lack the visibility, transparency and accountability features necessary to make their provenance capability useful for establishing public trust in an organization’s information. To address public requirements, organizations need to reconsider provenance mechanisms for at least some of their content.

4. Deploying public content provenance systems: Considerations and example use cases

Not all organizations will have the same requirements for public provenance of their content. Requirements depend on factors such as the organization’s:

  • particular public information trust challenges
  • overall strategy for addressing public information trust
  • audience
  • volume of content
  • financial resources

Specific requirements may evolve quickly given the rapid changes in the information environment driven by cyber criminal and state use of AI.

4.1 Points for organizations to consider

When considering deployment of a public content provenance system, there are a number of questions organizations should ask themselves.

4.1.1 Strategy to establish public information trust

Public information trust strategies will vary depending on factors such as the subject domain, the audience, and the objectives of actors seeking to use the organization’s public information against them.

Many organizations already have some capability for establishing trust in their public information and countering claims made against them. Using public provenance will help establish trust for an organization’s content, but it may not be as effective or have the same return on investment as other strategies.

Organizations should decide whether to use provenance as an approach to countering the challenges they face. Those choosing to use provenance technologies will also have to consider how to implement them.

4.1.2 Introduction of provenance in content lifecycle

Organizations can have a lot of content. Some of this content is publicly available. Other content, such as drafts, may not be publicly available now but will become public in the future.

The content may be at various stages of update and editing in preparation for publication. It may be distributed across a variety of systems and may be subject to changes by many individuals.

Organizations may also have some content that they never intend to make public. Some content may pose challenges or risks to the organization itself. As a result, organizations may choose strong provenance measures only for some types of content. They may also choose to protect content at the point of publication rather than at point of creation.

4.1.3 Timeframe for content verification

The public’s requirements for information verification can vary in timeframe depending on the information context. Some information verification requirements will be aimed at short-term concerns such as elections, while others will be aimed at generational issues such as evidence concerning distant historical events.

For short-term events, the organizational risk is that it will take longer to verify the provenance information than the event timeframe requires. Timeframe issues can impact how long provenance records must be maintained, as well as how readily-accessible the records need to be.

4.1.4 Cost

Digital provenance mechanisms are relatively new and have associated implementation, operation and maintenance costs. In most cases, organizations will have to change business processes to make effective use of provenance mechanisms. In addition, provenance technologies are evolving rapidly, and near-term implementations may quickly become obsolete.

Organizations may choose to prioritise non-provenance public information trust responses or they may choose to implement interim or partial solutions, for example using public provenance measures only for critical content.

4.1.5 Audience and format

The audience for provenance information may not necessarily be the same as an organization's core audience. This will depend on an organization's strategic and tactical response to the use of their information.

Formats for provenance information will be different depending on the system used by the specific audience.

Media companies have copyright on their information and may be able to use copyright tools to remove infringing material from the Internet. In this case, the audience for provenance evidence are legal professionals, Internet service providers and social media companies. Provenance information would need to be formatted to meet their different evidence requirements. A media company's implementation of provenance mechanisms will likely differ from that used by organizations whose provenance information audience is the general public.

4.1.6 Maturity of public provenance technologies

Organizations should also consider the maturity of public provenance technologies. Technologies for versioning and logging to meet an organization’s internal provenance requirements are mature. Public provenance technologies are less developed, although some of the related technologies used in private provenance, such as cryptographic hashing, can be used in public systems.

Publicly accessible provenance systems have additional requirements, for example, end-point devices such as cameras that can cryptographically sign content, and tamper-proof ledgers. These technologies are developing, but immature.

Organizations may choose to do partial and trial implementations. They may also choose to establish architectures that allow newer technologies to be integrated as they become available.

Top of page

4.2 Example use cases

As we have seen, requirements for public provenance will vary between organizations depending on the challenges they face in communicating facts to their audiences and their public information trust strategy and tactics. These different requirements will shape the provenance infrastructure.

Here we provide analysis of 5 different use cases, using the provenance characteristics identified in Section 3.1 What to consider when selecting provenance systems.

4.2.1 Use case 1: Organization wants provenance of all its public content

An organization that wishes to establish provenance of its own public content can either:

  • establish an irrefutable provenance record, including date and time at time of publishing
  • create content provenance records for all the intermediate steps of creating the content

The provenance record then becomes a tool for the organization’s communications staff, as well as for others who review and provide fact-checking on the content, to validate or refute content veracity claims.

The public needs to be able to find and verify content easily. To be useful, the verification mechanisms must be simple, intuitive and reliable.

4.2.2 Use case 2: Organization’s content provenance is only needed for a short time

The required duration of a provenance record can vary depending on its expected use. Like many forms of digital record, some provenance records may only be required for a relatively short period, for example content that is transitory and only has short-term significance, such as event announcements. Provenance on the announcement may have value prior to the event, but the value of any provenance record will rapidly diminish afterwards.

Provenance infrastructure that supports short-duration requirements would not need to factor in long-duration requirements, which simplifies implementation and lifecycle considerations.

4.2.3 Use case 3: Organization’s content provenance is needed for a long time

Some organizations will need their provenance records to endure well into the future. First-hand accounts of noteworthy events are one example. Future generations may need to verify the authenticity of today’s digital content. This is especially true in a world where generative AI is increasingly capable.

Proving the veracity of recorded testimony in timeframes of over 25 years could be challenging as certification components for identities and timestamps may not endure. The provenance mechanism must therefore address changes in technology, as well as turnover of business entities such as certificate providers and hosting services. The verification mechanism itself must also endure.

Maintaining the provenance and verification mechanisms over the long term will likely rely on distributed content stores and ledgers given that, in time, most organizations shut down, as part of normal organizational lifecycle. Such mechanisms are still in the early stages of development and can be expensive to implement and use.

4.2.4 Use case 4: Organization needs content to retain its anonymity and privacy

Some provenance requirements have privacy and anonymity considerations, for example in the field of journalism, where sources working in dangerous environments may need to remain anonymous for their protection. This can be done using trusted anonymous identities for individuals, or trusted capture devices that preserve user anonymity. Although this diminishes the strength of the provenance claim, it can still add value.

Other provenance methods such as trusted timestamps and provenance certification by higher level entities (in this case, the journalist organization) can strengthen the provenance record, helping to retain its usefulness.

4.2.5 Use case 5: Copyright and other legal redress

Public content provenance records can potentially be used by organizations in their efforts to redress copyright infringement of their content.

The provenance mechanism can be used to identify copyright permissions available to others using the content (for example, Creative Commons licence) in a way which the public can verify.

Many jurisdictions are currently developing mechanisms to address other forms of information misuse.

Organizations implementing provenance mechanisms for this purpose may need to consider both specialised audiences and legal redress requirements in their systems design.

5. Next steps

The content provenance space is rapidly evolving to meet emerging challenges but is still mainly in the development stage. If you are considering content provenance as part of your organization's trust strategy you should:

  • understand how your information and information about your organization is received by your audience and other parties, and how this impacts your audience's trust in your organization
  • consider how content provenance technologies might address your organization's public trust challenges
  • stay abreast of changes in technology and emerging trust threats in the information environment
Top of page
]]>https://cyber.gc.ca/en/news-events/joint-guidance-principles-secure-integration-artificial-intelligence-operational-technology<![CDATA[Joint guidance on principles for the secure integration of artificial intelligence in operational technology]]>2025-12-03T19:28:10Z

The Canadian Centre for Cyber Security (Cyber Centre) has joined the United States’ Cybersecurity and Infrastructure Security Agency (CISA) and the following international partners in releasing guidance on principles for the secure integration of artificial intelligence (AI) in operational technology (OT):

  • Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
  • Germany’s Federal Office for Information Security (BSI)
  • Netherlands’ National Cyber Security Centre (NCSC-NL)
  • New Zealand’s National Cyber Security Centre (NCSC-NZ)
  • United Kingdom’s National Cyber Security Centre (NCSC-UK)
  • United States’ Federal Bureau of Investigation (FBI)
  • United States’ National Security Agency’s Artificial Intelligence Security Center (NSA AISC)

For critical infrastructure (CI) owners and operators, AI offers the potential to:

  • increase efficiency and productivity
  • enhance decision-making
  • save costs
  • improve customer experience

Despite the many benefits, integrating AI into OT environments that manage essential public services also introduces significant risks. These risks must be carefully managed to ensure the availability and reliability of CI.

This joint guidance outlines 4 key principles CI owners and operators can follow to leverage the benefits of AI in OT systems while minimizing risk:

  • Understand AI
  • Consider AI use in the OT domain
  • Establish AI governance and assurance frameworks
  • Embed safety and security practices into AI-enabled OT systems

We urge CI owners and operators to review this joint guidance and implement the principles to more securely integrate AI into OT systems.

Read the full joint publication: Principles for the secure integration of artificial intelligence in operational technology

]]>https://www.canada.ca/en/communications-security/news/2025/11/joint-statement-on-malicious-cyber-activity-targeting-canadian-critical-infrastructure.html<![CDATA[Joint statement on malicious cyber activity targeting Canadian critical infrastructure]]>2025-11-27T13:23:39Z
]]>https://www.canada.ca/en/communications-security/news/2025/11/backgrounder-malicious-cyber-activity-targeting-canadian-critical-infrastructure.html<![CDATA[Backgrounder: Malicious cyber activity targeting Canadian critical infrastructure]]>2025-11-26T21:11:30Z
]]>https://cyber.gc.ca/en/guidance/cyber-threat-canadas-water-systems-assessment-mitigation<![CDATA[The cyber threat to Canada’s water systems: Assessment and mitigation]]>2025-11-25T15:00:14Z

Table of contents

About this document

Audience

This report is part of a series of cyber threat assessments focused on Canada’s critical infrastructure. It is intended for leaders of organizations in the water sector, cyber security professionals with a water or wastewater asset to protect, and the general reader with an interest in the cyber security of critical infrastructure. For guidance on technical mitigation of these threats, see the Mitigation section or contact the Canadian Centre for Cyber Security (the Cyber Centre).

This assessment is Unclassified/TLP:CLEAR. TLP:CLEAR is used when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:CLEAR information may be shared without restriction. For more information, see Traffic Light Protocol.

Contact

For follow-up questions or issues, contact the Cyber Centre at contact@cyber.gc.ca.

Assessment base and methodology

The key judgements in this assessment rely on reporting from multiple sources, both classified and unclassified. The judgements are based on the knowledge and expertise in cyber security of the Cyber Centre. Defending the Government of Canada’s information systems provides the Cyber Centre with a unique perspective to observe trends in the cyber threat environment, which also informs our assessments. The Communications Security Establishment Canada’s foreign intelligence mandate provides us with valuable insight into adversary behaviour in cyberspace. While we must always protect classified sources and methods, we provide the reader with as much justification as possible for our judgements.

Our judgements are based on an analytical process that includes evaluating the quality of available information, exploring alternative explanations, mitigating biases and using probabilistic language. We use terms such as “we assess” or “we judge” to convey an analytic assessment. We use qualifiers such as “possibly”, “likely” and “very likely” to convey probability.

The assessments and analysis are based on information available as of May 31, 2025.

Estimative language

Estimated language chart long description immediately follows
Long description - Estimative language chart
  • 1 to 9% Almost no chance
  • 10 to 24% Very unlikely/Very Improbable
  • 25 to 39% Unlikely/Improbable
  • 40 to 59% Roughly even chance
  • 60 to 74% Likely/probably
  • 75 to 89% Very likely/very probable
  • 90 to 100% Almost certainly
 

Message from the Head of the Cyber Centre

I spend a lot of time looking at threats most people never see. They are quiet, often hidden, yet capable of real-world consequences. Among the most critical are the cyber threats facing Canada’s water and wastewater systems. These systems are the backbone of modern life, yet they’re often out of sight and out of mind. When they function, no one notices. When they fail, everyone does.

This assessment is meant to bring clarity to a topic that can feel abstract or overly technical. Cyber threats to water infrastructure are growing, evolving quickly, and can affect every community in Canada. You don’t need to be an engineer or a cyber security expert to understand why this matters. Clean water is essential, and the systems that deliver it are now largely digital – meaning they are vulnerable to the same kinds of cyber threats that target businesses and governments around the world.

We’ve seen an unmistakable shift in recent years. Cybercriminals are more sophisticated, state-sponsored actors are more willing to target essential services, and disruptive tools are easier to access. Water systems now face a threat landscape they were never designed to withstand.

Whether you’re a critical infrastructure executive, an elected official, or a policymaker, I want to emphasize that cyber security for water systems is not just a technical issue, it is a public safety issue, an economic stability issue, and ultimately a public trust issue. Leadership matters. The choices you make about investment, governance, and preparedness will determine our collective resilience in the years ahead.

But this is not a message of alarm; it is a message of readiness. Across Canada, utilities, municipalities, and provincial and territorial partners have shown a strong commitment to improving their cyber resilience. What’s needed now is a clear-eyed analysis of the cyber threats facing our water systems in Canada. That’s what this assessment provides.

My hope is that it empowers decision-makers to act confidently, ask the right questions, and support the people who keep these systems running. Cyber threats aren’t going away, but with awareness and a steady commitment to resilience, we can stay ahead of them.

Sincerely,
Rajiv Gupta, Head of the Canadian Centre for Cyber Security

Key judgements

  • We assess that operational technology (OT) networks that monitor and control physical processes are very likely the primary target for actors seeking to disrupt water systems.
  • We assess that financially motivated cybercriminals are the most likely cyber threat to affect water systems. We assess that cybercriminals will almost certainly continue to exploit water sector organizations and systems through extortion tied to ransomware, exploiting stolen information, and business email compromise (BEC). We assess that ransomware is almost certainly the most significant cyber threat to the reliable supply of water in Canada due to the potential impacts against OT systems.
  • We assess that water systems are almost certainly a strategic target for state-sponsored actors to project power through disruptive or destructive cyber threat activity. We assess that state-sponsored actors have almost certainly developed pre-positioned access to Canadian water systems. However, we judge that these actors would likely only disrupt those water systems in times of crisis or conflict between states.
  • Non-state cyber actors are a growing threat to Canada’s critical infrastructure (CI). We assess that non-state actors will very likely continue to opportunistically compromise and disrupt Internet-exposed water system OT within Canada, especially in connection to major geopolitical events.
 
Top of page 

Canada’s water sector

Good public and environmental health depend on access to clean water.Footnote 1  Drinking water, stormwater and wastewater treatment systems (collectively: water systems) have many important economic, environmental, and safety uses. A loss of water does not just affect residents but also can have effects on other critical infrastructure. For example, in 2024, water main breaks in Calgary and Montreal resulted in cascading impacts on other systems, including hospitals, fire prevention and universities.Footnote 2  For these reasons and others, our water systems are considered part of Canada’s critical infrastructure (Figure 1).Footnote 3  Any disruption in the water system is not only a threat to public health and safety, but also a threat to public confidence, the environment and the economy.Footnote 4  As a result, the cyber security of our water systems is vital to Canada’s national security.

Figure 1: Critical infrastructure

Critical infrastructure refers to the processes, systems, facilities, technologies, networks, assets and services essential to the health, safety, security or economic well-being of Canadians and the effective functioning of government.

Figure 1 - Long description immediately follows
Long description - Figure 1: Critical infrastructure Icons representing the 10 critical infrastructure sectors in Canada
  • Energy and utilities
  • Finance
  • Food
  • Health
  • Government
  • Safety
  • Water
  • Transportation
  • Information and communication technology
  • Manufacturing

The threat surface of Canada’s water systems

A water system generally includes the services and infrastructure to safely and reliably obtain, store, filter and distribute potable water, divert runoff and floodwater as well as remove, collect and treat wastewater. Canada has thousands of water systems that vary greatly in size. A small number of large water utilities serve major urban areas while international organizations manage shared systems. Meanwhile, many small systems are owned and operated by municipalities, other levels of government, Indigenous communities, private sector companies and individual citizens.Footnote 5

Water systems operate in a variety of ways. Many are completely manual or even passive systems that require little to no active management, including most small water supplies and stormwater systems. Large urban water systems, in contrast, are usually geographically dispersed, industrial systems operated from a digital control environment. These include many remotely managed OT devices integrated into dams, pumping stations, and treatment facilities. These systems also extend into a web of connected suppliers of digital products and services.

Many of these water systems are managed out of municipal or community offices and are exposed to all the cyber threats encountered by public-facing organizations. The more internet-connected assets an organization has, the larger the threat surface. A larger threat surface implies an increase in the cyber threat the organization faces.Footnote 6  In addition to increasing internet connectivity, most water systems are operated by small public sector organizations and frequently face challenges that can negatively influence cyber security, including low financial resources, aging physical and digital infrastructure and a shortage of cyber security expertise.Footnote 7

The role of operational technology in our water systems

Operators use industrial OT including supervisory control and data acquisition (SCADA) and industrial Internet of things (IIoT) devices to manage large water systems and address issues like population growth, outdated infrastructure and declining revenue.Footnote 8  These systems are used to control water system equipment like dam gates, valves and pumps and to monitor sensors such as chemical detectors and flowrate monitors. The OT in water systems is continually evolving and is increasingly managed through digital devices with embedded computing and communications abilities.Footnote 9  This process, called digital transformation or digitalization, has allowed OT asset operators like those in the water sector to connect their OT devices to operating centres, corporate networks and, increasingly, directly to the internet. A 2021 survey counted over 60,000 OT-related network interfaces in Canada.Footnote 10  In 2023, a similar survey conducted on internet-connected devices associated mainly with water systems in the U.S. and UK found a relatively low level of basic cyber hygiene. Almost half of the devices could be manipulated without any authentication required.Footnote 11

Unfortunately, the management efficiency and savings gained from connecting digitally transformed OT also exposes the water system to cyber threats.Footnote 10  For example, in early 2000, an employee was fired from a company providing services to Maroochy Water Services in Queensland, Australia. The individual retained remote access to the network of OT devices in the pumping stations of the wastewater treatment system.Footnote 12  He used this access to issue malicious commands to the OT devices that ultimately caused nearly a million litres of raw sewage to be discharged into local parks and rivers, causing severe environmental harm, according to officials.Footnote 13  This was the first example of a remote access in a public water system being used to disrupt or sabotage OT systems, and illustrates the potential for cyber threats to jeopardize public and environmental safety and the local economy.Footnote 10  We assess that operational technology (OT) networks that monitor and control physical processes are very likely the primary target for actors seeking to disrupt water systems.

On the rise: Cyber threats to supply chains

Water system utilities often depend on a diverse supply chain of digital products and services to operate, maintain and modernize their OT assets. The supply chain for these products and services includes manufacturers, vendors, integrators, contractors and service providers. Water system OT’s dependency on the supply chain is a critical vulnerability that gives cyber actors inside information on and opportunities for access to otherwise protected OT systems.

Cyber threat actors target organizations’ digital supply chains to collect business and contextual information for use in social engineering attacks or to collect organizational network and system information to support future cyber attacks. Activity against the digital supply chain can also be an indirect route to gain access to the target organization’s networks in situations where there is continuous information transfer, for example software updates, or remote network access connections between the organization and its suppliers. In late 2019, a sophisticated cyber threat actor compromised the software-as-a-service provider, SolarWinds. The actors, attributed to Russia’s intelligence services, used their access to SolarWinds’ development environment to embed malicious code into a software update. The compromised update provided the actors access to thousands of client networks worldwide, including over 100 in Canada.Footnote 14

Publicly available cyber tools are increasing the volume and effectiveness of cyber threat activity

We assess it almost certain that cyber threat actors are increasingly using publicly available cyber tools to gain and maintain access to CI networks, making it easier for threat actors of all levels of sophistication to target water sector OT. The wide availability of these tools, including legitimate penetration testing tools like Cobalt Strike, has lowered the barrier to entry to cyber threat activity and increased the capacity for cyber threat actors to gain, maintain, and expand access to target systems.Footnote 15

The proliferation of publicly available cyber tools has advantages for sophisticated cyber threat actors as well. Advanced cyber threat actors often use a combination of publicly available tools and living-off-the-land (LOTL) techniques when possible and bespoke malware when necessary. For example, People’s Republic of China (PRC) threat actors Volt Typhoon, Flax Typhoon and APT40 commonly use a mixed toolset and likely maintain an extensive catalog of open source and custom malware.Footnote 16  LOTL techniques exclusively rely on legitimate tools and processes already present in the victim’s environment, for example Windows PowerShell or Windows Management Instrumentation, to carry out malicious activity.Footnote 17  These techniques allow threat actors to blend their malicious activity in with normal network activity. By using generic publicly available tools and LOTL techniques, sophisticated actors limit the distinct signature they leave on a target’s network, making detecting cyber threat activity and attributing the source of that activity even more challenging.Footnote 18

 
Top of page 

The threat from cybercriminals

We assess that financially motivated cybercriminals are the most likely cyber threat to affect water systems. We assess that cybercriminals will almost certainly continue to exploit water sector organizations and systems through extortion tied to ransomware, exploiting stolen information and business email compromise (BEC). BEC is a type of fraud that uses compromised email accounts to trick people into transferring money or sensitive information to attacker-controlled accounts, while ransomware is malware that encrypts data or locks devices to extort a target organization for ransom payment.Footnote 19  Although BEC is likely more common and more costly than ransomware to victims, ransomware can disrupt operations such as the delivery of safe drinking water through loss of visibility or control over important industrial processes.Footnote 20  We assess that ransomware is almost certainly the most significant cyber threat to the reliable supply of water in Canada due to the potential impacts against OT systems. Cybercriminals are aware that the disruption of critical products and services increases the pressure on an organization to pay ransom.Footnote 21  For example, ransomware attacks disrupted water treatment systems in California, Maine and Nevada in 2021, and in Kansas in 2024, forcing system operators to manually operate their OT systems to maintain service.Footnote 22

Ransomware incidents are becoming more complex and costly to remediate

We assess that ransomware attacks against CI organizations, including those in the water sector, are almost certainly becoming more frequent as well as more costly and complex to remediate. The number of observed ransomware incidents has increased across sectors from 2021 to 2024. The size of ransom demands, cost of recovery, and the sophistication and complexity of tactics being used by cybercriminals have also increased.Footnote 23  These trends are driven by the proliferation of ransomware-as-a-service (RaaS) variants, the cybercrime-as-a-service (CaaS) ecosystem, and the increased use of multiple extortion methods.Footnote 24

Cybercriminals have widely adopted the practice of stealing and threatening to leak their victims’ sensitive data as either a supplement to traditional encryption-based extortion or as the primary lever for extortion. In early 2023, the cybercriminal group CL0P exploited a vulnerability in MOVEit Transfer, a file transfer tool made by Progress Software. CL0P’s attacks were far-reaching, allowing them to steal information from government, public and business groups all over the world, including the water utility files of Queens Municipality in Nova Scotia.Footnote 25  In early 2024, 2 different cybercriminal groups conducted ransomware attacks against water sector organizations in North America and the United Kingdom. The groups disrupted IT systems and leaked stolen data including business data and personal information.Footnote 26

Cybercrime marketplaces provide specialized services and increase impacts against victims

Cybercrime is continuously evolving to maximize profits and increase the payouts extracted from targets.Footnote 27  The CaaS ecosystem allows for specialization and division of labour among cybercriminal groups. This allows cybercriminals to access a range of services including network access brokering, access to RaaS variants and money laundering. Access brokers opportunistically collect network accesses into victim organizations and sell them to other cybercriminals. Those cybercriminals then conduct reconnaissance and use social engineering to determine which targets to deploy ransomware against. These decisions are often based on which organizations are most likely and/or able to pay a ransom.Footnote 19Footnote 27  We assess that the CaaS ecosystem is almost certainly increasing the number of actors participating in cybercrime by enabling less technically sophisticated actors to carry out cyber threat activity.

 
Top of page 

The state-sponsored cyber threat to water systems

We assess that water systems are almost certainly a strategic target for state-sponsored actors to project power through disruptive or destructive cyber threat activity. State-sponsored actors pre-position for this activity by identifying and gaining access to Internet-connected OT systems or IT networks from which they can laterally move to OT systems. Once in the target network, they collect information on assets within the network to identify opportunities for disruptive or destructive action. For example, this could mean causing water tanks to overflow or changing the chemical balance of water treatment processes. We assess that state-sponsored cyber threat actors have almost certainly developed pre-positioned access to Canadian water systems. However, we judge that these actors would likely only disrupt those water systems in times of crisis or conflict between states.

State-sponsored cyber threat actors have targeted water sector organizations and systems globally for both espionage and disruption or destruction. In an early example of state-sponsored cyber activity in water system OT, in 2013, Iranian actors gained access to the SCADA system of a small dam in New York State. This access allowed them to obtain information regarding the dam’s status and the ability to operate the sluice gates of the dam, which could affect water levels and flow rates in the watershed. The system was under maintenance at the time of the compromise, so the actors did not obtain actual access to the dam’s physical controls.Footnote 28

In 2023, an Iranian Islamic Revolutionary Guard Corps (IRGC) cyber unit acting under the non-state actor persona “CyberAv3ngers” compromised the Municipal Water Authority of Aliquippa, Pennsylvania. The CyberAv3ngers exploited a publicly exposed Unitronics Vision Series OT device with default passwords and defaced the system’s interface with an anti-Israel message. This activity was part of a broader campaign targeting commonly used Israeli-made OT devices, likely to undermine Western support for Israel. Tampering with the controller's user interface implies a level of access that would allow full access to the device settings, as well as potential access to other devices on the network. It is not known if cyber activity beyond defacement was planned or carried out.Footnote 29

In 2023 and 2024, the Cyber Centre and its partners published the following joint advisories to warn critical infrastructure organizations of a PRC state-sponsored cyber group known as Volt Typhoon:

Volt Typhoon activity has been observed since mid-2021 targeting the water sector and communication, transportation and energy organizations.Footnote 30  Volt Typhoon strategically selects targets, pre-positioning itself in organizations that, if disrupted, would restrict military mobilization efforts and cause societal chaos. While the Cyber Center assesses that the direct threat to Canada’s CI by Volt Typhoon is less than that to the U.S., it is not insignificant, especially for Canadian organizations that rely on cross-border trade, infrastructure or operations. In addition, the likelihood of a cyber attack impacting Canada’s CI is higher than it otherwise might be because of the connections between US and Canadian infrastructure.

 
Top of page 

Non-state cyber actors: A growing threat

The Cyber Centre warned in our National Cyber Threat Assessment 2025-2026 that non-state cyber actors are a growing threat to Canada’s critical infrastructure. The wide proliferation of easy-to-use disruptive cyber capabilities has contributed to the emergence of a large eco-system of hacktivists and other non-state actors who opportunistically target Canada and its allies for a variety of reasons. Often, this activity is intended to intimidate or coerce its targets or to influence Canadian public opinion or policy decisions related to geopolitical events outside Canada.

Non-state threat activity frequently targets public-facing websites through techniques including distributed denial-of-service (DDoS) and defacement attacks. However, some non-state actors have adopted the practice of targeting and attempting to disrupt vulnerable Internet-connected OT systems. Although non-state actors have targeted OT across CI sectors, a notable proportion of this activity has implicated water system OT.

In May 2024, the Cyber Centre and partners issued a joint advisory warning of pro-Russia non-state actors targeting Internet-exposed industrial systems. These actors opportunistically identify targets using publicly available scanning tools to search for internet-exposed systems with vulnerable configurations, such as using default or weak passwords or not using multi-factor authentication.Footnote 31  After gaining access to these systems, they attempt to disrupt the system by defacing system interfaces, making configuration changes, and manipulating system controls. This activity can result in OT systems operating in unintended ways, operational disruptions, and, potentially, physical damage to the systems. For example, in early 2024, a non-state actor compromised the OT systems controlling water storage tanks in the towns of Abernathy and Muleshoe, Texas and caused a tank overflow resulting in the loss of roughly 100,000 litres of water.Footnote 32

The Cyber Centre is aware of several instances of non-state actors similarly attempting to disrupt internet-exposed OT systems in Canada, including within water systems. We assess that non-state actors will very likely continue to opportunistically compromise and disrupt internet-exposed water system OT within Canada, especially in connection to major geopolitical events.

Outlook: What this means for the Canadian water sector

In the Cyber Centre’s National Cyber Threat Assessment 2025-2026, we assess that the cyber threat to Canada’s critical infrastructure is almost certainly increasing. We judge that the primary threats to CI come from cybercrime, state-sponsored adversaries and, increasingly, from non-state actors. Changes in the geopolitical environment have elevated the profile and importance of critical infrastructure as a target for cyber activity. This has combined with the increasing interconnectivity of IT and OT in the water sector to increase the cyber threat to the water supply.

If Canada’s water infrastructure was to become a priority for state-sponsored actors, for example in the case of imminent or active armed conflict, we assess that any water system organizations with OT devices exposed to the Internet are almost certainly a target for disruptive cyber threat activity. Water systems may also be affected by cyber activity against other sectors due to the interconnected nature of infrastructure and supply chain complexity. For example, systems including water treatment plants, pumping stations, and distribution networks without backup power capacity may be vulnerable to disruptions in the energy sector, which may lead to interruptions in the treatment, storage and distribution of safe water to clients.

Defending Canada’s water sector against cyber threats and related influence operations requires addressing both the technical and social elements of cyber threat activity. These include threats that originate in the digital supply chain, and the technology and skills shortage in the sector. There are almost certainly water system operators in Canada with exposed devices. The Cyber Centre encourages all critical infrastructure asset owners, including those in the water sector, to take appropriate mitigation measures to protect their systems against cyber threats.

 
Top of page 

Mitigation

The Cyber Centre is dedicated to advancing cyber security and increasing the confidence of Canadians in the systems they rely on daily. This includes offering support to CI and other systems of importance to Canada. We approach security through collaboration, combining expertise from government, industry and academia. Working together, we can increase Canada’s resilience against cyber threats. Cyber security investments will allow OT asset operators to benefit from new technologies, while avoiding undue risks to the safe and reliable provision of critical services to Canadians.

The following mitigation measures can help water systems operators prevent cyber threat actors from exploiting vulnerable systems, attacking devices and networks and stealing sensitive data. Each of the mitigations below are linked to the Cyber Centre’s Cyber Security Readiness Goals (CRGs). The CRGs are a set of baseline cyber security practices an organization can take to bolster their cyber security posture. Further details of each goal can be found in the Cross-Sector Cyber Security Readiness Goals Toolkit. The mitigations below are highlighted to help prevent and reduce cyber attacks against the water sector.

Protect all management interfaces

Phishing-resistant MFA (CRG 2.7)

Implement phishing-resistant multi-factor authentication (MFA) for access to assets, including all remote access to the OT network.Footnote 33

IT accounts:

All IT accounts should leverage MFA to access organizational resources. Prioritize accounts with the highest risk, such as privileged administrative accounts for key IT systems.

OT environments:

Enable MFA on all accounts and systems that can be accessed remotely, including:

  • vendor or maintenance accounts
  • remotely accessible user and engineering workstations
  • remotely accessible human-machine interfaces (HMIs)

Secure administrator workstation (CRG 2.21)

Set up and enforce the use of a secure administrator workstation (SAW) for administrators to perform administrative tasks.

A hardened SAW:

  • is not connected to the corporate IT network
  • is unable to install other software
  • does not have access to the public Internet or email services

In cases where there is an operational requirement to use a SAW remotely, secure the SAW network traffic by using a layer 3 virtual private network (VPN). The protocols most widely used for VPNs are:

  • Internet Protocol Security (IPSec)
  • Transport Layer Security (TLS)

An IPSec VPN is an open standard, meaning that anyone can build a client or server that works with other IPSec implementations. IPSec VPN encrypts and authenticates all data in both directions and can enforce no split tunneling from the SAW.

TLS VPNs often use custom, non-standard features to tunnel traffic via TLS. Using custom or non-standard features creates additional risk exposure, even when the TLS parameters used by products are secure.

Keep in mind that the public Internet may not be reliable in a global crisis or major disaster. As such, local administration must always be maintained as a capability in CI.

Secure the supply chain

Vendor/supplier cyber security requirements (CRG 0.2)

Include cyber security vendor/supplier requirements and questions in organizations’ procurement documents. Ensure those responses are evaluated such that, given two offerings of roughly similar cost and function, the more secure offering and/or supplier is preferred.

Prevent credential theft

Changing default passwords (CRG 2.0)

Change default passwords and ensure your organization enforces a policy and/or process that requires changing default manufacturer passwords for all hardware, software and firmware.

If feasible, change default passwords on Programmable Logic Controllers (PLCs) and Human Machine Interfaces (HMIs). Ensure the Unitronics PLC default password “1111” is not in use.Footnote 33

Email security (CRG 2.11)

Secure all corporate email infrastructure to reduce the risk of common email-based threats such as spoofing, phishing and interception. On all corporate email infrastructure:

  • enable STARTTLS
  • enable Sender Policy Framework and DomainKeys Identified Mail
  • enable Domain-based Message Authentication, Reporting and Conformance (DMARC) and set to “reject”
  • encrypt emails to an appropriate and approved level in accordance with the sensitivity of the email contents

Basic and OT cyber security training (CRG 2.8)

Provide training that covers basic security and privacy concepts and foster an internal culture of security and cyber awareness. Ensure that personnel who maintain or secure OT as part of their regular duties receive OT-specific cyber security training at least annually. Training topics should include, at a minimum:

  • phishing
  • business email compromise
  • basic operational security
  • password security
  • privacy breaches

Disable macros by default (CRG 2.12)

Establish a system-enforced policy that disables Microsoft Office macros or similar embedded code by default on all devices. If macros must be enabled in specific circumstances, set a policy that requires users to obtain authorization before macros are enabled for specific assets.

Protect internet-accessible vulnerable assets and services

No exploitable services on the internet (CRG 2.20)

Do not expose exploitable services, like remote desktop protocol, to the Internet. Where services must be exposed, implement appropriate compensating controls to prevent common forms of exploitation.

Limit OT connections to public Internet (CRG 2.18)

Ensure no OT assets, including PLCs, are connected to the public Internet.

In exceptional operational circumstances where remote access to the PLC is required, ensure that:

  • exceptions are justified and documented; and
  • additional protections are in place to prevent and detect exploitation attempts such as:
    • logging
    • MFA
    • SAW
    • mandatory access via proxy or another intermediary

Network segmentation (CRG 2.5)

Establish segmentation across network architecture to create boundaries and limit communication between IT and OT networks.

Ensure that all connections to the OT network are denied by default unless explicitly allowed (for example, by IP address and port) for specific system functionality.

Necessary communications paths between the IT and OT networks must pass through an intermediary (such as a properly configured firewall, bastion host, jump box or a demilitarized zone) which is closely monitored, captures network logs and only allows connections from approved assets.

Mitigating known vulnerabilities (CRG 1.1)

Apply patches for internet-facing systems within a risk-informed timespan, prioritizing the most critical assets first.

Identify security vulnerabilities in your systems by conducting penetration tests and using automated vulnerability scanning tools, activities which are part of a comprehensive vulnerability management strategy.

For OT assets where patching is not possible or may substantially compromise availability or safety, apply and record compensating controls (such as segmentation or monitoring). Sufficient controls either make the asset inaccessible from the public Internet or reduce the ability of threat actors to exploit the vulnerabilities in these assets.

Improve cyber security incident response capability

Incident response plans (CRG 1.3)

Develop, maintain, update and regularly drill IT and OT cyber security incident response plans for both common and organization-specific threat scenarios and TTPs. Regularly test manual controls so that critical functions can keep running if OT networks need to be taken offline.

Asset inventory and network topology (CRG 1.0)

Maintain a regularly updated inventory of all assets within the organization’s IT and OT networks. Include accurate documentation of network topology and identified data assets. Immediately log any new asset that is integrated into the organization’s infrastructure.

System backups and redundancy (CRG 2.14)

Implement regular system backup procedures on both IT and OT systems. Ensure backups are stored separately from the source systems and test on a recurring basis.

Ensure stored information for OT assets includes:

  • configurations
  • roles
  • PLC logic
  • engineering drawings
  • tools

Implement adequate redundancies such as network components and data storage.

Ensure that the redundant secondary system is not collocated with the primary system and can be activated without loss of information or disruption to operations.

 
Top of page 

Additional resources

Assess:

Prepare:

Protect:

]]>https://cyber.gc.ca/en/guidance/dont-take-bait-recognize-and-avoid-phishing-attacks<![CDATA[Don't take the bait: Recognize and avoid phishing attacks - ITSAP.00.101]]>2025-11-24T13:08:28Z

Phishing is a form of social engineering where threat actors send communications that appear legitimate to trick or motivate individuals into:

  • revealing sensitive or personal information
  • clicking on links that direct them to malicious websites
  • downloading malicious attachments
  • transferring money

On this page

Types of phishing

Phishing attempts are often generic mass messages that appear to be legitimate messages from a trusted source (for example, a bank, online retailer, courier service, or utility company). Threat actors often take advantage of crises, conflicts or world events to launch phishing attacks against individuals, financial institutions, governments and critical infrastructure sectors.

The are several types of phishing.

Deceptive phishing

Deceptive phishing is one of the most common types of attack and occurs when a cybercriminal pretends to be a legitimate company to steal your personal information or login credentials. The threat actor may send you a link to a fraudulent website that closely mimics an official site, using deliberate misspellings that look almost identical to a legitimate URL. Threat actors may also send a quick response (QR) code, which makes it more difficult for potential victims to spot the attack.

Common deceptive phishing techniques include:

  • homograph exploits: threat actors use characters from different alphabets (for example, Cyrillic or Greek) that look almost identical to standard Latin letters but are coded differently, for example in “www.аррle.com” the “a” and “p” are from the Cyrillic alphabet, but look like their Latin counterparts
  • typo squatting: threat actors register domain names that are common misspellings of well-known websites, exploiting typing errors so that potential victims are not always aware that they are on the wrong website
  • legitimate-looking subdomains: threat actors take control of a subdomain that is no longer actively used by its legitimate owner or create subdomains that mimic legitimate ones (for example, “login.google.com.example.com” instead of “login.google.com”), often using names, logos or branding elements that are similar to legitimate ones

Spear phishing

Spear phishing is a personalized attack that targets a specific individual, company or organization. The message includes personal details about the potential victim, such as interests, recent online activities or purchases.

Whaling

Whaling is a personalized attack that targets a big “phish” like a CEO or executive. A threat actor chooses these targets because of their level of authority and possible access to more sensitive information or large amounts of money.

Quishing

Quishing is a phishing attack that uses QR codes. The threat actor may send a QR code via email, cover a legitimate QR code with a malicious QR code or place a malicious QR code in a public, high-traffic area. The victim scans the QR code, which redirects them to a malicious website. Quishing can bypass email security protection that scans for malicious links and attachments.

Smishing

A smishing attack uses deceptive short message service (SMS), also known as text messages, to manipulate victims into divulging sensitive personal information such as bank account details, credit card numbers or login credentials.

Vishing

Vishing is short for “voice phishing” and involves defrauding people over the phone and getting them to divulge sensitive information. A threat actor can fake or spoof their caller ID information or use a voice changer to make victims believe they are legitimate. Voices generated by artificial intelligence (AI) can sound like family members or friends.

A vishing scheme may also target the victim’s voice. In this instance, the threat actor collects a sample of the victim’s voice to conduct fraud (for example, to use the sample for voice authentication to access an account).

Angler phishing

Angler phishing is an emerging cyber threat that leverages social media platforms to post attractive but false information to “lure” targets into initiating contact. Threat actors may impersonate legitimate companies or brands through fake accounts, posts, direct messages or ads. They often create fake customer support profiles or use social media interactions (for example, responding to complaints or questions) to convince users to click on malicious links, visit counterfeit websites or share personal details.

This is a powerful attack because the target initiates contact with the threat actor—bypassing trust concerns—and provides an immediate and active interaction, rather than a passive and delayed interaction.

Catfishing

Catfishing is typically conducted through online platforms like dating websites. The threat actor fakes an identity or creates a persona to gain the target’s trust and defraud or extort them. The threat actor, or catfish, generally makes excuses to avoid in-person interactions. One of the more common forms of catfishing involves tricking the victim into an online romantic relationship.

Pharming

Pharming is a more advanced technique in which cybercriminals try to redirect users to fake websites that look identical to legitimate ones, like online banking sites, e-commerce platforms or social media networks. The goal of these attacks is to trick users into providing sensitive or personal information, such as usernames, passwords or credit card numbers.

While phishing relies on emails or messages to trick users into providing personal information, pharming uses malware or manipulates domain name systems (DNS) to redirect users to fraudulent websites designed to capture their personal information.

Artificial intelligence and phishing

AI is rapidly reshaping the cyber security landscape, introducing enhanced capabilities for defence and new avenues for exploitation. One concerning emerging threat is the use of AI to automate and refine phishing attacks. AI enhances the effectiveness of phishing attacks and reduces the time and effort needed for threat actors to conduct these attacks.

Recent advances in generative AI make it more difficult for users to identify phishing attempts. Generative AI can be used to produce highly realistic content, including text, images, video and audio. The content is enhanced and is more realistic, making it harder to distinguish between fraudulent and legitimate communications.

AI also enables threat actors to gather and analyze publicly available data on potential targets, allowing them to craft highly personalized spear phishing and whaling messages.

These messages can be tailored to reflect individual interests, online activity, familial connections or professional relationships—substantially increasing the likelihood of victims engaging with the threat actor.

AI is also playing a critical role in strengthening our cyber defences. Sophisticated AI-based intrusion detection systems can analyze large volumes of data, assess user behaviour, examine metadata and message content, and identify anomalies that may indicate a threat. These systems enable faster, more accurate identification and mitigation of phishing attempts and other cyber risks. As the threat landscape evolves, organizations must continue to invest in both AI technology and AI awareness to stay ahead of increasingly sophisticated attacks.

How to identify a phishing attack

Phishing attacks can be delivered in many ways, but they all play on trust, urgency and other aspects of human psychology. Fear, excitement, authority, curiosity and trust could all be reactions to a phishing message. Phishing attacks typically follow a similar sequence. Knowing how to identify these steps can help protect your organization against phishing.

Step 1: The bait

As described above, there are many ways that the threat actor can set the bait. They may craft a message that appears to come from a well-known bank or service provider. They use spoofing techniques and send the message to numerous recipients in the hope that some will take the bait.

In spear phishing and whaling attacks, the threat actor first gathers details about the target. For example, they harvest information from social media profiles, company websites and Internet activity to create a customized message.

In vishing attacks, the threat actor might use a computerized auto-dialler (known as a robocall) or an AI-generated voice of a known person to deliver the fraudulent message to many victims.

Step 2: The hook

The hook occurs when the victim believes the message is from a trusted source and the message contains information that entices the victim to take immediate action. For example, the message may ask the user to resolve an urgent issue with their account.

If the victim clicks the link in the message, they will unknowingly be redirected to the threat actor’s fake version of the real website. The victim provides sensitive information, such as login credentials, which is sent to the threat actor. If the victim opens an infected attachment, their device may become infected if the malicious code executes.

Step 3: The attack

Threat actors can use stolen user credentials to access the victim’s accounts. They may use an infiltrated email account to send more phishing emails to the victim’s contacts. If the victim has privileged access (for example, to an organization or company account, system or network), the threat actor could gain access to sensitive corporate data and critical systems.

If a threat actor successfully deploys malware to your organization’s network or systems, they can use it to gain control of devices, steal data or deny access to files—for example, by encrypting them—until a ransom is paid.

Phishing characteristics

Although AI is making it hard to detect certain phishing characteristics, such as poor spelling or a robotic tone, there are other signs to be aware of.

Something may be phishy if:

  • the sender makes an urgent request with a deadline
  • the sender requests your personal or confidential information
  • the sender asks you to log in via a provided link
  • the offer sounds too good to be true
  • the communication is unsolicited and includes:
    • attachments
    • links to websites or web forms (these may be spoofed)
    • QR codes
    • login pages
    • a claim to be government or bank officials
  • you don’t recognize the sender
    • remember, addresses can be spoofed
    • a known sender isn’t necessarily a trusted sender

How to protect your organization from phishing

You can protect your organization’s information and infrastructure from phishing attacks by:

  • using trusted anti-phishing technology, such as the Canadian Internet Registration Authority (CIRA) Canadian Shield DNS resolver
  • using anti-phishing software that aligns with the Domain-based Message Authentication, Reporting, and Conformance (DMARC) policy
  • backing up information so that you have another copy
  • applying software updates and patches
  • blocking IP addresses, domain names and file types that are known to be malicious
  • favouring in-person interactions, using cash and meeting in the office whenever possible; threat actors will try to find ways to avoid in-person interactions
  • establishing protocols and procedures for your employees to verify and report suspicious communications internally
  • using multi-factor authentication (MFA) on all systems, especially on shared corporate media accounts
  • updating your organization’s incident response plan to include steps to take in response to a successful phishing attack

Your employees can reduce their risk of falling victim to a phishing attack by:

  • remaining calm; phishing depends on creating a sense of urgency
  • avoiding sending sensitive information by email or text
  • reducing the amount of personal information they post online
  • enabling a spam blocker in their mobile device application settings
  • avoiding using any form of simplified contact response, such as clicking on hyperlinks, loading QR codes or replying to suspicious texts
  • filtering spam emails (unsolicited junk emails sent in bulk)
  • verifying the sender’s legitimacy by contacting the sender through a separate channel, for example:
    • if they receive a call from their bank, hanging up and visiting or calling their local branch
    • if they receive an email from their Internet service provider, contacting the service provider through their web form
    • if they receive a text from a company or provider on their phone, responding by email from their computer
  • avoiding SMS over the air, flash call (a near-instant dropped call that is automatically placed to a mobile number) and SMS as an MFA method

Training and awareness

Employees should understand the importance of protecting their personal information and the organization’s information. Employees who are unaware of the signs of a social engineering attack might reveal information, whether sensitive or not. They may also unknowingly infect organizational devices, systems and networks.

Phishing attacks are less likely to be successful when your workforce is informed and has received training on how to handle personal information, such as privacy awareness training, and on cyber security best practices. Organizations should also conduct internal phishing simulations to enhance employees’ understanding of the risks. This will help employees detect and avoid phishing attacks in a safe environment.

Organizations can discuss smishing and vishing protection mechanisms with their telecommunications providers. Often, mobile network operators are better positioned to block attempts before these attempts reach users.

Learn more

]]>https://cyber.gc.ca/en/news-events/joint-guidance-mitigating-risks-bulletproof-hosting-providers<![CDATA[Joint guidance on mitigating risks from bulletproof hosting providers]]>2025-11-19T14:05:31Z

The Canadian Centre for Cyber Security (Cyber Centre) has joined the United States’ Cybersecurity and Infrastructure Security Agency (CISA), and the following international partners in releasing cyber security guidance on mitigating risks from bulletproof hosting (BPH) providers:

  • Australian Signals Directorate’s (ASD) Australian Cyber Security Centre (ACSC)
  • Netherlands’ National Cyber Security Centre (NCSC-NL)
  • New Zealand’s National Cyber Security Centre (NCSC-NZ)
  • United Kingdom’s National Cyber Security Centre (NCSC-UK)
  • United States’ Department of Defense Cyber Crime Center (DC3)
  • United States’ Federal Bureau of Investigation (FBI)
  • United States’ National Security Agency (NSA)

A BPH provider is an Internet infrastructure supplier that intentionally markets and leases its infrastructure to threat actors. BPH providers pose a significant risk to the resilience and safety of critical systems and services.

This joint guidance provides recommendations to Internet service providers (ISPs) and network defenders to mitigate potential cybercriminal activity enabled by BPH providers. By applying these mitigations, ISPs and network defenders can help reduce the effectiveness of BPH infrastructures and potentially force threat actors to use legitimate infrastructure providers instead.

Read the full joint publication: Bulletproof defense: Mitigating risks from bulletproof hosting providers

]]>https://cyber.gc.ca/en/news-events/joint-guidance-microsoft-exchange-server-security-best-practices<![CDATA[Joint guidance on Microsoft Exchange Server security best practices]]>2025-10-30T16:14:44Z

The Canadian Centre for Cyber Security (Cyber Centre) has joined the United States’ National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) as well as the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) in releasing guidance on Microsoft Exchange Server security best practices.

Many organizations rely on Microsoft Exchange for critical communications, which require protection from threat actors. Reported abuse and exploitation of vulnerabilities within Exchange further demonstrates the importance of implementing security best practices.

Prevention and hardening defences are critical for Exchange servers to mitigate various types of compromises and protect the sensitive information and communications they manage.

This joint guidance provides security best practices to help administrators harden on-premises Exchange servers by enforcing a prevention posture and hardening authentication and encryption.

Read the full joint publication: Microsoft Exchange Server security best practices (PDF)

]]>https://cyber.gc.ca/en/guidance/defending-against-adversary-middle-threats-phishing-resistant-multi-factor-authentication-itsm30031<![CDATA[Defending against adversary-in-the-middle threats with phishing-resistant multi-factor authentication (ITSM.30.031)]]>2025-10-30T16:10:45Z

Alternate format: Defending against adversary-in-the-middle threats with phishing-resistant multi-factor authentication – ITSM.30.031 (PDF, 1.5 MB)

Overview

In the ever-evolving landscape of cyber security, the rise of adversary-in-the-middle (AitM) phishing poses a significant threat to organizations. AitM phishing has become increasingly popular among threat actors as organizations move to the cloud, shifting the frontline from defending traditional network perimeters to prioritizing identity protection.

Security requirements have grown increasingly complex, particularly in cloud environments, and threat actors have refined their tactics. As a result, implementing phishing-resistant multi-factor authentication (MFA) is critical for organizations to maintain strong cyber security.

This publication provides details on observed AitM phishing campaigns to highlight their prevalence and demonstrate the risk of leaving cloud accounts vulnerable. All findings in this publication are based on over 100 campaigns that the Canadian Centre for Cyber Security (Cyber Centre) detected targeting Microsoft Entra ID accounts between 2023 and early 2025. Although this is not a comprehensive overview of all AitM phishing campaigns happening globally, it offers a snapshot of how widespread these campaigns have become.

This publication aims to:

  • provide a comprehensive understanding of where these threats originate
  • highlight the need for all organizations to strengthen defences by employing phishing-resistant MFA by default
  • provide recommendations to enhance organizations’ security postures against these sophisticated campaigns

Table of contents

Understanding adversary-in-the-middle phishing and its impact

AitM phishing is a technique where a threat actor intercepts the connection between a user and a login server. The threat actor captures all usernames, passwords, MFA secrets and tokens transferred over that connection. Users typically receive a phishing email with a link to a malicious phishing site impersonating a legitimate website. The user is then tricked into providing their login details and completing the MFA process. The threat actor logs that information to impersonate the user later.

Figure 1: Phishing campaign by threat actor
Figure 1 - Long description immediately follows
Long description - Figure 1: Phishing campaign by threat actor

This figure illustrates how a threat actor might route and deliver a phishing email with a link to an AitM phishing site.

  1. The user receives a phishing email with a link.
  2. The user goes to the site, where they see what appears to be a legitimate login portal.
  3. The AitM site then proxies all connections to the login portal.
  4. The login portal prompts the user for multi-factor authentication (MFA).
  5. The user completes non-phishing-resistant MFA.
  6. This action returns a validated token and session cookie to the AitM site.
  7. The phishing site redirects the user to a different site that appears to be legitimate.

AitM phishing is not a new concept. It has become increasingly popular among threat actors since organizations moved to the cloud. Before that, organizations worked hard to defend their frontline—the network perimeter—with firewalls and virtual private networks (VPNs). Now, organizations must strengthen cyber security to defend their new frontline, the cloud. To do this, they must protect cloud identity with a modernized set of tools, such as conditional access policies (CAPs) and MFA.

It is difficult to secure a cloud environment against AitM phishing campaigns. The cloud comes with complex security requirements that are constantly changing as threat actors increase campaigns against cloud identities. This highlights the importance of the shared responsibility model, where both clients and cloud service providers (CSPs) work together to build a robust security posture. Phishing-resistant MFA is the new industry standard. It ensures stronger identity security and is more resilient than relying solely on passwords or traditional MFA methods.

Threat actors can execute AitM phishing easily by leveraging no-code solutions, such as dark web AitM providers or open-source AitM toolkits for self-run setups. These campaigns can be thwarted by:

  • phishing-resistant MFA factors
  • specific CAPs that require registered device sign-ins
  • specific CAPs that only allow sign-ins from specific Internet Protocol (IP) ranges or addresses that an organization owns
 
Top of page 

Transition to proxy-based adversary-in-the-middle phishing

Threat actors conducting AitM phishing campaigns evade detection by using relay proxy-based AitM phishing kits. A phishing kit is a pre-assembled set of digital tools that allows threat actors to easily create fake websites and harvest sensitive user information. These fake websites often mimic trusted brands to deceive users.

Before proxy-based AitM phishing kits, organizations could detect AitM phishing by looking for suspicious logins to their cloud environment and comparing those IP addresses with network connections from their network. A login from a suspicious IP and network connections to a suspicious website hosted on that same IP was a good indication of an AitM campaign.

However, proxy-based AitM phishing kits work by adding a series of proxies in between the user and the identity provider. This means the IP from the user login will not be the same IP that appears to be hosting the phishing website. There are many ways that threat actors can achieve this, so organizations can no longer rely on IP-based correlation to detect all AitM phishing campaigns.

In mid-2024, the Cyber Centre added new internal detection capabilities for proxy-based AitM phishing and began detecting many more campaigns. This correlated with a decline in detected traditional AitM phishing. Threat actors have almost entirely shifted from traditional AitM phishing campaigns to proxy-based AitM phishing campaigns.

Figure 2: Comparison of detected traditional and proxy-based AitM phishing campaigns
Figure 2 - Long description immediately follows
Long description - Figure 2: Comparison of detected traditional and proxy-based AitM phishing campaigns

This bar graph illustrates a comparison of detected traditional and proxy-based AitM phishing campaigns, based on campaigns that the Cyber Centre was able to confidently categorize between 2023 and mid-2025.

  • January 2023: Traditional AitM: 100%; proxy-based AitM: 0%
  • February 2023: Traditional AitM: 100%; proxy-based AitM: 0%
  • March 2023: Traditional AitM 100%; proxy-based AitM 0%
  • April 2023: Traditional AitM: 100%; proxy-based AitM: 0%
  • May 2023: Traditional AitM: NIL; proxy-based AitM: NIL
  • June 2023: Traditional AitM: 100%; proxy-based AitM: 0%
  • July 2023: Traditional AitM: 100%; proxy-based AitM: 0%
  • August 2023: Traditional AitM: NIL; proxy-based AitM: NIL
  • September 2023: Traditional AitM: 100%; proxy-based AitM: 0%
  • November 2023: Traditional AitM: 100%; proxy-based AitM: 0%
  • December 2023: Traditional AitM: 100%; proxy-based AitM: 0%
  • January 2024: Traditional AitM: 100%; proxy-based AitM: 0%
  • February 2024: Traditional AitM: 100%; proxy-based AitM: 0%
  • March 2024: Traditional AitM: 100%; proxy-based AitM: 0%
  • April 2024: Traditional AitM: 100%; proxy-based AitM: 0%
  • May 2024: Traditional AitM: 100%; proxy-based AitM: 0%
  • June 2024: Traditional AitM: 86%; proxy-based AitM: 14%
  • July 2024: Traditional AitM: 42%; proxy-based AitM: 58%
  • August 2024: Traditional AitM: 0%; proxy-based AitM: 100%
  • September 2024: Traditional AitM: 0%; proxy-based AitM: 100%
  • October 2024: Traditional AitM: 33%; proxy-based AitM: 67%
  • November 2024: Traditional AitM: 10%; proxy-based AitM: 90%
  • December 2024: Traditional AitM: 0%; proxy-based AitM: 100%
  • January 2025: Traditional AitM: 0%; proxy-based AitM: 100%
  • February 2025: Traditional AitM: 33%; proxy-based AitM: 67%
  • March 2025: Traditional AitM: 10%; proxy-based AitM: 90%
  • April 2025: Traditional AitM: 0%; proxy-based AitM: 100%
  • May 2025: Traditional AitM: 16%; proxy-based AitM: 84%
  • June 2025: Traditional AitM: 12%; proxy-based AitM: 88%

One major contributor to this shift was threat actors’ use of a particular proxy-based AitM phishing kit. For more information on this kit, refer to the Field Effect article Field Effect discovers M365 adversary-in-the-middle campaign.

Phishing-resistant MFA continues to prevent AitM campaigns, whether from traditional kits or proxy-based AitM phishing kits. Both phishing-resistant MFA and registered device CAPs break the authentication flow when there is an AitM phishing kit in the middle of the connection.

 
Top of page 

Adversary-in-the-middle phishing trends and techniques

AitM phishing kits are increasingly sophisticated and challenging to detect. It might seem logical to focus on stopping these campaigns at their source by enhancing phishing email filtering. However, threat actors know that organizations are constantly improving their phishing protection programs and are therefore adjusting their techniques.

The Cyber Centre analyzed over 100 campaigns between 2023 and early 2025 and found that threat actors used a combination of vendor email compromise (VEC), which is a type of business email compromise (BEC), and a phishing technique that uses living off trusted sites (LOTS).

Business email compromise phishing campaigns

In BEC phishing campaigns, threat actors compromise legitimate organizations, steal their trusted contacts, and send AitM phishing emails with links to legitimate services like SharePoint, Dropbox, or other trusted hosting providers. The files hosted on these trusted providers contain a link to the AitM phishing site, but the link is within a file hosted on the trusted provider, not in the phishing email itself. This makes detecting and tracking the source of an AitM compromise more difficult.

From the user’s perspective, they have received an email from a trusted contact with a shared file, which they may regularly receive from this contact. Threat actors can tailor the file-sharing service based on previous communications between 2 users to make their AitM phishing campaigns more difficult to identify.

Figure 3: Distribution of BEC phishing
Figure 3 - Long description immediately follows
Long description - Figure 3: Distribution of BEC phishing

This pie chart shows the distribution of BEC phishing campaigns compared to non-BEC phishing campaigns that the Cyber Centre analyzed and categorized between 2023 and mid-2025. BEC phishing campaigns made up 91% of the analyzed campaigns.

Living off trusted sites techniques

LOTS-based AitM phishing made up over half of the campaigns that the Cyber Centre was able to categorize, with the remaining campaigns using conventional phishing methods (such as malicious links or attachments directly in an email). Organizations should educate users on the risks of LOTS-based AitM phishing campaigns and provide training on how to identify these campaigns.

Figure 4: Distribution of phishing techniques
Figure 4 - Long description immediately follows
Long description - Figure 4: Distribution of phishing techniques

This pie chart shows the distribution of phishing techniques that the Cyber Centre analyzed and categorized between 2023 and mid-2025. LOTS made up 59% of the analyzed campaigns while conventional phishing (such as embedded links or files) made up 41%.

 
Top of page 

Targeted sectors

The Cyber Centre examined the sectors and organizations that are being targeted by AitM phishing campaigns. In Figure 5 below, the breakdown of BEC victims by country shows that most of the organizations that were compromised and that sent AitM phishing emails to the Government of Canada and to critical infrastructure partners were based in Canada. This finding underscores that threat actors are leveraging VEC since many Canadian organizations predominantly interact with other Canadian organizations in their daily operations.

Figure 5: Breakdown of BEC victims by country
Figure 5 - Long description immediately follows
Long description - Figure 5: Breakdown of BEC victims by country

This pie chart shows the breakdown of BEC victims by country that the Cyber Centre analyzed and categorized between 2023 and mid-2025. Canada represents 77%, the United States represents 18%, and the remaining 5% is divided among other unspecified countries.

The Cyber Centre found that a third of the BEC victims were in the natural resources, energy, and environment sector. This was closely followed by the industry and business development sector and the Indigenous services sector.

When examining the victims who received AitM phishing emails, the Cyber Centre observed a similar breakdown. A quarter of the victims were in the natural resources, energy, and environment sector, followed by the security, intelligence and defence sector; the health sector; and the government administration sector.

The Cyber Centre can correlate the sectors affected by BEC and those impacted by AitM phishing to spot patterns between the sectors sending and receiving emails. We observed that 41% of sectors impacted by BEC also sent phishing emails to organizations within the same sector, consistent with previously cited VEC findings. The graph below illustrates an example of this. Notable exceptions to this trend were the hospitality and legal sectors, likely because hotels and law firms serve clients across diverse sectors.

Figure 6: BEC victims in the natural resources, energy and environment sector sending emails to AitM phishing victims
Figure 6 - Long description immediately follows
Long description - Figure 6: BEC victims in the natural resources, energy and environment sector sending emails to AitM phishing victims

The figure depicts BEC victims in the natural resources, energy and environment sector sending emails to AitM phishing victims. This is based on results that the Cyber Centre analyzed and categorized between 2023 and mid-2025. The natural resources, energy and environment sector sent 55% of phishing emails within its sector, 13% to the health sector, 9% to the transportation sector, 5% to the banking and finance sector, 5% to the security, intelligence and defence sector, 5% to the government administration sector, 4% to the border services and immigration sector, and 4% to the international affairs, trade and development sector.

 
Top of page 

The importance of phishing-resistant multi-factor authentication

Although AitM phishing campaigns are widespread, a solution already exists to mitigate all known campaigns: phishing-resistant MFA. This is the only way to completely stop these campaigns before a threat actor can get hold of an MFA-verified session.

According to the Cyber Centre’s findings, full-session compromises within the Government of Canada and critical infrastructure partners have decreased over the last few years. This is primarily because these organizations have adopted registered device CAPs and other CAPs requiring phishing-resistant MFA and have implemented strictly controlled IP restrictions on logins. Full-session compromises decreased from a high of almost 20% at the end of the third quarter of 2023 to less than 10% of all compromises as of early 2025.

Figure 7: Cumulative percentage of AitM phishing results over time
Figure 7 - Long description immediately follows
Long description - Figure 7: Cumulative percentage of AitM phishing results over time

This bar graph illustrates the cumulative percentage of AitM phishing results that the Cyber Centre analyzed and categorized between 2023 and mid-2025.

  • 2023 Q1: Blocked: MFA/other CAP: 55.6%; blocked: registered device CAP: 33.3%; full session compromise: 11.1%
  • 2023 Q2: Blocked: MFA/other CAP: 55%; blocked: registered device CAP: 35%; full session compromise: 10%
  • 2023 Q3: Blocked: MFA/other CAP: 47.8%; blocked: registered device CAP: 34.8%; full session compromise: 17.4%
  • 2023 Q4: Blocked: MFA/other CAP: 50%; blocked: registered device CAP: 33.3%; full session compromise: 16.7%
  • 2024 Q1: Blocked: MFA/other CAP: 50%; blocked: registered device CAP: 35.3%; full session compromise: 14.7%
  • 2024 Q2: Blocked: MFA/other CAP: 51.2%; blocked: registered device CAP: 34.9%; full session compromise: 14%
  • 2024 Q3: Blocked: MFA/other CAP: 38.9%; blocked: registered device CAP: 48.6%; full session compromise: 12.5%
  • 2024 Q4: Blocked: MFA/other CAP: 38.4%; blocked: registered device CAP: 51.5%; full session compromise: 10.1%
  • 2025 Q1: Blocked: MFA/other CAP: 35.9%; blocked: registered device CAP: 57%; full session compromise: 7%
  • 2025 Q2: Blocked: MFA/other CAP: 35.9%; blocked: registered device CAP: 58%; full session compromise: 6.1%

The Cyber Centre continues to observe a steady stream of AitM phishing campaigns stemming from BEC. This indicates that threat actors remain confident that enough accounts lack phishing-resistant MFA protection, making AitM phishing campaigns a worthwhile technique for compromising accounts.

Top of page

Enhancing defences against evolving adversary-in-the-middle threats

Phishing-resistant MFA can prevent AitM campaigns, but it can be difficult for organizations to implement. Cloud configuration can also be challenging, and most phishing-resistant MFA methods are fee-based.

Organizations should weigh the risk and impact of cyber incidents against the cost of implementing phishing-resistant MFA. Organizations that choose to implement phishing-resistant MFA should consider the following:

  • Compared with the cost of remediating and recovering from a data breach, providing phishing-resistant MFA methods (FIDO2 security keys, passkeys, Windows Hello for Business) to users is a cost-effective investment
  • Data and information may be critical to business operations or contain highly sensitive private information, and any compromise can have a significant impact and cost for the organization
  • An identity compromise can have a significant impact on an organization’s reputation

Some organizations are moving to devices that are registered with their IT departments and phishing-resistant MFA. However, threat actors are often a step ahead and launch AitM phishing campaigns before organizations can move to phishing-resistant options.

Addressing high-risk gaps and vulnerabilities

Organizations should deploy phishing-resistant MFA to every user, without exception. They should also review their identity protection posture and flag any high-risk gaps or vulnerabilities. The following are examples of high-risk gaps or vulnerabilities that organizations should address immediately to prevent AitM compromises.

Administrators using weak MFA methods

Organizations should apply phishing-resistant MFA to all administrator accounts, without exception, in any CAP. Additionally, organizations should remove any non-phishing-resistant backup methods on these accounts since these could be bypassed by AitM phishing campaigns.

Bring-your-own-device without phishing-resistant MFA or location restrictions

Threat actors’ primary targets are users who are allowed to sign in from their own devices, outside of an organization’s controlled IP space and without phishing-resistant MFA. This is a very high-risk gap that organizations should address immediately.

If organizations require users to use personal devices (known as bring your own device [BYOD]), they should deploy phishing-resistant MFA and ensure that users cannot use any weak fallback methods. Alternatively, organizations could require all BYOD logins to go through the organization’s corporate VPN, with an accompanying CAP that restricts logins to only that specific IP space.

The greatest challenge is avoiding the temptation to make exceptions for specific users, groups or applications. As a baseline, all users should have phishing-resistant MFA by default and without exception.

Educating employees

Organizations should also train their employees on how to spot and report AitM campaigns. Many users will open emails and click on the included links if the email is from a trusted source. Organizations should consider including the following topics in their training on phishing campaigns.

BEC scenarios

The more users are aware of how common BEC campaigns are, the more they will be on the lookout for them. Before clicking on a link in an email, they should know to ask themselves a couple of questions, such as:

  • Do I usually receive unsolicited Dropbox files from this contact?
  • Does this contact usually send me SharePoint documents?

If a user receives unsolicited files, they should reach out to the sender through another method (for example, a phone call) to confirm that the document was shared intentionally.

Double-checking the URL when signing into login services

Verifying the legitimacy of URLs can be difficult since logins to some sites like Microsoft Entra ID contain long URLs, so users might not notice a suspicious domain in the path. Educating users on where to find the top-level domain within a URL and what domains to expect in that location can go a long way in stopping these campaigns.

Avoiding multiple logins

Users often sign into their accounts using a cloud-based identity and access management service like Microsoft Entra ID. This allows them to access applications like Microsoft SharePoint or Teams with a single sign-on. If users know that they shouldn’t need to log in again to access applications or a shared file, they will think twice before re-entering their credentials.

Another helpful technique is to teach users to open a new tab and sign into the file-sharing service directly before clicking on a link. After logging into the service directly, users should not be prompted to sign in again when they click the file link in their email. If they do receive a prompt, it could be an AitM phishing campaign.

Good password hygiene

Even if users know how to spot AitM phishing campaigns, there will always be some successful campaigns that trick users into supplying their username and password before the campaigns are blocked by CAPs. This means that the threat actor can gain control of the user’s username and password, even if they did not get an MFA-verified session. Therefore, organizations must remind users to not reuse passwords. Once a threat actor obtains these credentials, they can use them against other login portals within the organization that might not have MFA protections (for example, legacy web portals or less secure VPN appliances).

Top of page

Summary

AitM phishing campaigns are becoming more sophisticated and are occurring across all sectors. As this publication highlights, there are a number of measures organizations can take to mitigate this threat. However, the best defence against AitM phishing campaigns is to implement phishing-resistant MFA by default and without exception.

For additional cyber security guidance, please refer to the following:

]]>https://cyber.gc.ca/en/guidance/protecting-specified-information-non-government-canada-systems-and-organizations-itsp10171<![CDATA[Protecting specified information in non-Government of Canada systems and organizations (ITSP.10.171)]]>2025-10-28T18:41:39Z

Alternate format: Protecting specified information in non-Government of Canada systems and organizations - ITSP.10.171 (PDF, 1.6 MB)

Foreword

This is an unclassified publication issued under the authority of the Head, Canadian Centre for Cyber Security (Cyber Centre). For more information or to suggest amendments, contact the Contact Centre:

Effective date

This publication takes effect on April 2, 2025.

Revision history

  1. First release: April 2, 2025
  2. Second release: October 28, 2025

Table of contents

Overview

Protecting Specified Information is of paramount importance to Government of Canada (GC) departments and agencies and can directly impact the GC’s ability to successfully conduct its essential missions and functions. This publication provides GC departments and agencies with recommended security requirements for protecting the confidentiality of specified information when it resides in non-GC systems and organizations. These requirements apply to the components of non-GC systems that handle, process, store or transmit CI, or that provide protection for such components. The security requirements are intended for use by GC departments and agencies in contractual vehicles or other agreements established between those departments and agencies and non-GC organizations.

This publication is a Canadian version of the National Institute of Standards and Technology NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. The Cyber Centre will produce a companion publication to use in conjunction with this publication, based on NIST SP 800-171A Assessing Security Requirements for Controlled Unclassified Information. That publication will provide a comprehensive set of procedures to assess the security requirements. In the interim, NIST SP 800-171A can be used as a reference.

Acknowledgments

The Cyber Centre wishes to acknowledge and thank Dr. Ron Ross and Victoria Pillitteri from the Computer Security Division at NIST for allowing the Cyber Security Guidance (CSG) team to use their guidance and modify it to the Canadian context.

 
Top of page 

1 Introduction

This publication is a Canadian version of NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. There are no substantial technical changes between this publication and NIST SP 800-171. The primary modifications arise from differences in laws, policies, directives, standards and guidelines. In other words, the changes reflect the distinct Canadian regulatory and compliance landscape; there are no changes to the underlying technical context.

The controls are aligned with Security and privacy controls and assurance activities catalogue (ITSP.10.033), which is a version of NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations adapted to the Canadian context.

Specified information includes any information, other than classified, that a GC authority identifies and qualifies in a contract as requiring safeguarding. Protected information, as well as the safeguarding and dissemination requirements for such information, is defined by the Treasury Board of Canada Secretariat TBS Directive on Security Management, Appendix J: Standard on Security Categorization and is codified in the TBS Policy on Privacy Protection. We use the term “specified information” in place of “controlled unclassified information” (CUI) which is used in the US document.

GC departments and agencies are required to follow the policies and directives published by TBS when using federal systems to handle, process, store, or transmit informationFootnote 1.

The responsibility of GC departments and agencies to protect specified information remains the same when sharing it with non-GC organizations. Therefore, a similar level of protection is needed when non-GC organizations using non-GC systems handle, process, store or transmit specified information. To maintain a consistent level of protection, the security requirements for safeguarding specified information in non-GC systems and organizations must comply with the TBS Policy on Government Security, TBS Policy on Service and Digital, and TBS Policy on Privacy Protection.

The security controls and activities presented in this publication outline requirements for federal contracting.

This publication does not contain the complete set of privacy-related controls and activities described in ITSP.10.033. Rather, it contains a subset of privacy-related controls that are shared with confidentiality-related controls.

1.1 Purpose

This publication provides GC departments and agencies with recommended security requirements for protecting the confidentiality of specified information when in resides in non-GC systems and organizations and where there are no specific safeguarding requirements prescribed by the authorizing law, regulation, or government-wide policy for the specified information category.

The security requirements in this publication are only applicable to componentsFootnote 2 of non-GC systems that handle, process, store, or transmit specified information or that provide protection for such components. The requirements are intended to be used by GC departments and agencies in contractual vehicles or other agreements established with non-GC organizations.

It is important that non-GC organizations scope requirements appropriately when making protection-related investment decisions and managing security risks. By designating system components for handling, processing, storing or transmitting specified information, non-GC organizations can limit the scope of the security requirements by isolating the system components in a separate security domain. Isolation can be achieved by applying architectural and design concepts (e.g., implementing subnetworks with firewalls or other boundary protection devices and using information flow control mechanisms). Security domains can use physical separation, logical separation, or a combination of both. This approach can provide adequate security for specified information and avoid increasing the non-GC organization’s security posture beyond what it requires for protecting its missions, operations and assets.

1.2 Audience

This publication is intended for various individuals and organizations in the public and private sectors, including:

  • GC departments and agencies responsible for managing and protecting specified information
  • non-GC organizations responsible for protecting specified information
  • individuals with system development lifecycle (SDLC) responsibilities
  • individuals with acquisition or procurement responsibilities
  • individuals with system, security, privacy or risk management and oversight responsibilities
  • individuals with security or privacy assessment and monitoring responsibilities

1.3 Publication organization

The remainder of this publication is organized as follows:

  • Section 2 Fundamentals describes the assumptions and methodology used to develop the security requirements for protecting the confidentiality of specified information, the format of the requirements, and the tailoring criteria applied to the Cyber Centre guidelines to obtain the requirements
  • Section 3 Requirements lists the security requirements for protecting the confidentiality of specified information in non-GC systems and organizations

The following sections provide additional information to support the protection of specified information:

 
Top of page 

2 Fundamentals

This section describes the assumptions and methodology used to develop the requirements to protect the confidentiality of specified information in non-GC systems and organizations. It also includes the tailoring criteria applied to the controls in ITSP.10.033.

2.1 Security requirements assumptions

The security requirements in this publication are based on the following assumptions:

  • GC information designated as specified information has the same value regardless of whether such information resides in a GC or a non-GC system or organization
  • statutory and regulatory requirements for the protection of specified information are consistent in GC and non-GC systems and organizations
  • safeguards implemented to protect specified information are consistent in GC and non-GC systems and organizations
  • the confidentiality impact value for specified information is no less than low (Protected A), but will be medium for most large GC datasets
  • non-GC organizations can directly implement a variety of potential security solutions or use external service providers to satisfy security requirements

2.2 Security requirement development methodology

Starting with the ITSP.10.033 controls in the ITSP.10.033-01 Medium impact profile, the controls are tailored to eliminate selected controls or parts of controls that are:

  • primarily the responsibility of the GC
  • not directly related to protecting the confidentiality of specified information
  • adequately addressed by other related controls
  • not applicable

ITSP.10.171 security requirements represent a subset of the controls that are necessary to protect the confidentiality of specified information. The security requirements are organized into 17 families, as illustrated in Table 1. Each family contains the requirements related to its general security topic. Certain families from ITSP.10.033 are not included because they do not directly contribute to confidentiality. For example, the Personal information handling and transparency (PT) family is not included because it is about handling personal information (PI), not about the confidentiality of the PI. The Program management (PM) family is not included because it is not related to confidentiality. Finally, the Contingency planning (CP) family is not included because it addresses availability.

The following are the security requirements families:

  • Access control
  • Awareness and training
  • Audit and accountability
  • Configuration management
  • Identification and authentication
  • Incident response
  • Maintenance
  • Media protection
  • Personnel security
  • Physical protection
  • Risk assessment
  • Security assessment and monitoring
  • System and communications protection
  • System and information integrity
  • Planning
  • System and services acquisition
  • Supply chain risk management

Organization-defined parameters (ODPs) are included in certain security requirements. ODPs provide flexibility through the use of assignment and selection operations to allow GC departments and agencies and non-GC organizations to specify values for the designated parameters in the requirements. Assignment and selection operations allow security requirements to be customized based on specific protection needs. The determination of ODP values can be guided and informed by laws, Orders in Council, directives, regulations, policies, standards, guidance, or mission and business needs. Once specified, ODP values become part of the requirement. When present in a control or activity statement, the square brackets indicate that there is an ODP that needs to be inserted by the reader in order for an organization to tailor the control to their context.

ODPs are an important part of specifying a security requirement. ODPs provide both the flexibility and the specificity needed by organizations to clearly define their specified information security requirements according to their particular missions, business functions, operational environments and risk tolerance. In addition, ODPs support consistent security assessments to determine if specified security requirements have been satisfied. If a GC department or agency, or a group of departments or agencies, does not specify a particular value or range of values for an ODP, non-GC organizations must assign the value or values to complete the security requirement.

Each requirement includes a discussion section, derived from the control discussion sections in NIST SP 800-53. These sections provide additional information to facilitate the implementation and assessment of the requirements. They are informative, not normative. The discussion sections are not intended to extend the scope of a requirement or to influence the solutions that organizations may use to satisfy a requirement. Examples provided are notional, not exhaustive, and do not reflect all the potential options available to organizations. The “References” section provides the source controls or assurance activities from ITSP.10.033, and a list of relevant publications with additional information on the topic described in the requirement.

Because this is the first iteration of the Canadian publication, controls that were withdrawn in NIST SP 800-171 Revision 3 have been labelled as “not allocated” to keep the same numbering for interoperability purposes.

The structure and content of a typical security requirement is provided in the example below.

The term “organization” is used in many security requirements, and its meaning depends on context. For example, in a security requirement with an ODP, an organization can refer to either the GC department or agency or to the non-GC organization establishing the parameter values for the requirement.

Annex A describes the security control tailoring criteria used to develop the security requirements and the results of the tailoring process. It provides a list of controls and activities from ITSP.10.033 that support the requirements and the controls and activities that have been eliminated from the Medium impact profile in accordance with the tailoring criteria.

 
Top of page 

3 Requirements

This section describes 17 families of security requirements for protecting the confidentiality of specified information in non-GC systems and organizations. In this section, the term “system” refers to non-GC systems or system components that handle, process, store or transmit specified information, or that provide protection for such systems or components. Not all security requirements mention specified information explicitly. Requirements that do not mention specified information explicitly are included because they directly affect the protection of specified information during its processing, storage or transmission.

There may be limitations to how some systems, including specialized systems (e.g., industrial/process control systems, medical devices, or computer numerical control machines) can apply certain security requirements. To accommodate such issues, the system security plan — as reflected in requirement System security plan 03.15.02 — is used to describe any enduring exceptions to the security requirements. Plans of action and milestones are used to manage individual, isolated or temporary deficiencies, as reflected in requirement Plan of action and milestones 03.12.02.

The security requirements in this section are only applicable to components of non-GC systems that process, store or transmit specified information or that provide protection for such components.

3.1 Access control

The controls in the Access control family support the ability to permit or deny user access to resources within the system.

03.01.01 Account management

  1. Define the types of system accounts allowed and prohibited.
  2. Create, enable, modify, disable, and remove system accounts in accordance with organizational policy, procedures, prerequisites, and criteria.
  3. Specify:
    1. authorized users of the system
    2. group and role membership
    3. access authorizations (i.e., privileges) for each account
  4. Authorize access to the system based on:
    1. a valid access authorization
    2. intended system usage
  5. Monitor the use of system accounts
  6. Disable system accounts when:
    1. the accounts have expired
    2. the accounts have been inactive for [Assignment: organization-defined time period]
    3. the accounts are no longer associated with a user or individual
    4. the accounts are in violation of organizational policy
    5. significant risks associated with individuals are discovered
  7. Notify account managers and designated personnel or roles within:
    1. [Assignment: organization-defined time period] when accounts are no longer required
    2. [Assignment: organization-defined time period] when users are terminated or transferred
    3. [Assignment: organization-defined time period] when system usage or the need-to-know changes for an individual
  8. Require that users log out of the system after [Assignment: organization-defined time period] of expected inactivity or when [Assignment: organization-defined circumstances].
Discussion

This requirement focuses on account management for systems and applications. The definition and enforcement of access authorizations other than those determined by account type (e.g., privileged access or non-privileged access) are addressed in Access enforcement 03.01.02. System account types include individual, group, temporary, system, guest, anonymous, emergency, developer, and service accounts. Users who require administrative privileges on system accounts receive additional scrutiny by organizational personnel responsible for approving such accounts and privileged access. Types of accounts that organizations may prohibit due to increased risk include group, emergency, guest, anonymous, and temporary accounts.

Organizations may choose to define access privileges or other attributes by account, type of account, or a combination of both. Other attributes required for authorizing access include restrictions on time-of-day, day-of-week, and point of origin. In defining other account attributes, organizations consider system requirements (e.g., system upgrades, scheduled maintenance) and mission and business requirements (e.g., time zone differences, remote access to facilitate travel requirements).

Users who pose a significant security and/or privacy risk include individuals for whom reliable evidence indicates either the intention to use authorized access to the system to cause harm or that adversaries will cause harm through them. Close coordination among human resource managers, mission/business owners, system administrators, and legal staff is essential when disabling system accounts for high-risk individuals. Time periods for the notification of organizational personnel or roles may vary.

Inactivity logout is behaviour- or policy-based and requires users to take physical action to log out when they are expecting inactivity longer than the defined period. Automatic enforcement of inactivity logout is addressed by Device lock 03.01.10.

References

Source controls: AC-02, AC-02(03), AC-02(05), AC-02(13)
Supporting publications:

03.01.02 Access enforcement

Enforce approved authorizations for logical access to specified information and system resources in accordance with applicable access control policies.

Discussion

Access control policies control access between active entities or subjects (i.e., users or system processes acting on behalf of users) and passive entities or objects (i.e., devices, files, records, and domains) in organizational systems. Types of system access include remote access and access to systems that communicate through external networks, such as the Internet. Access enforcement mechanisms can also be employed at the application and service levels to provide increased protection for specified information. This recognizes that the system can host many applications and services in support of mission and business functions. Access control policies are defined in Policy and procedures 03.15.01.

References

Source control: AC-03
Supporting publications: Cyber Centre Managing and controlling administrative privileges (ITSAP.10.094)

03.01.03 Information flow enforcement

Enforce approved authorizations for controlling the flow of specified information within the system and between connected systems.

Discussion

Information flow control regulates where specified information can transit within a system and between systems (versus who can access the information) and without explicit regard to subsequent accesses to that information. Flow control restrictions include keeping specified information from being transmitted in the clear to the Internet, blocking outside traffic that claims to be from within the organization, restricting requests to the Internet that are not from the internal web proxy server, and limiting specified information transfers between organizations based on data structures and content.

Organizations commonly use information flow control policies and enforcement mechanisms to control the flow of specified information between designated sources and destinations (e.g., networks, individuals, and devices) within systems and between interconnected systems. Flow control is based on characteristics of the information or the information path. Enforcement occurs in boundary protection devices (e.g., encrypted tunnels, routers, gateways, and firewalls) that use rule sets or establish configuration settings that restrict system services, provide a packet-filtering capability based on header information, or provide a message-filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Organizations also consider the trustworthiness of filtering and inspection mechanisms (i.e., hardware, firmware, and software components) that are critical to information flow enforcement.

Transferring specified information between organizations may require an agreement that specifies how the information flow is enforced (see Information exchange 03.12.05). Transferring specified information between systems that represent different security domains with different security policies introduces the risk that such transfers may violate one or more domain security policies. In such situations, information custodians provide guidance at designated policy enforcement points between interconnected systems. Organizations consider mandating specific architectural solutions when required to enforce specific security policies. Enforcement includes prohibiting specified information transfers between interconnected systems (i.e., allowing information access only), employing hardware mechanisms to enforce one-way information flows, and implementing trustworthy regrading mechanisms to reassign security attributes and security labels.

References

Source control: AC-04
Supporting publications:

03.01.04 Separation of duties

  1. Identify the duties of individuals requiring separation.
  2. Define system access authorizations to support separation of duties.
Discussion

Separation of duties addresses the potential for abuse of authorized privileges and reduces the risk of malicious activity without collusion. Separation of duties includes dividing mission functions and support functions among different individuals or roles, conducting system support functions with different individuals or roles (e.g., quality assurance, configuration management, system management, assessments, programming, and network security), and ensuring that personnel who administer access control functions do not also administer audit functions. Because separation of duty violations can span systems and application domains, organizations consider the entirety of their systems and system components when developing policies on separation of duties. This requirement is enforced by Access enforcement 03.01.02.

References

Source control: AC-05
Supporting publications:

03.01.05 Least privilege

  1. Allow only the authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks.
  2. Authorize access to [Assignment: organization-defined security functions] and [Assignment: organization-defined security-relevant information].
  3. Review the privileges assigned to roles or classes of users [Assignment: organization-defined frequency] to validate the need for such privileges.
  4. Reassign or remove privileges, as necessary.
Discussion

Organizations employ the principle of least privilege for specific duties and authorized access for users and system processes. Least privilege is applied to the development, implementation, and operation of the system. Organizations consider creating additional processes, roles, and system accounts to achieve least privilege. Security functions include establishing system accounts and assigning privileges, installing software, configuring access authorizations, configuring settings for events to be audited, establishing vulnerability scanning parameters, establishing intrusion detection parameters, and managing audit information. Security-relevant information includes threat and vulnerability information, filtering rules for routers or firewalls, configuration parameters for security services, security architecture, cryptographic key management information, access control lists, and audit information.

References

Source controls: AC-06, AC-06(01), AC-06(07), AU-09(04)
Supporting publications: None

03.01.06 Least privilege – privileged accounts

  1. Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles].
  2. Require that users (or roles) with privileged accounts use non-privileged accounts when accessing non-security functions or non-security information.
  3. Require any administrative or superuser actions to be performed from a physical workstation which is dedicated to those specific tasks and isolated from all other functions and networks, especially any form of Internet access.
Discussion

Privileged accounts refer to accounts that are granted elevated privileges to access resources (including security functions or security-relevant information) that are otherwise restricted for non-privileged accounts. These accounts are typically described as system administrator or super-user accounts. For example, a privileged account is often required in order to perform privileged functions such as executing commands that could modify system behaviour. Restricting privileged accounts to specific personnel or roles prevents non-privileged users from accessing security functions or security-relevant information. Requiring the use of non-privileged accounts when accessing non-security functions or non-security information limits exposure when operating from within privileged accounts.

A dedicated administration workstation (DAW) is typically comprised of a user terminal with a very small selection of software designed for interfacing with the target system. For the purpose of this control, workstation is meant as the system from which you are performing the administration, as opposed to the target system of administration.

References

Source controls: AC-06(02), AC-06(05), SI-400
Supporting publications: None

03.01.07 Least privilege – privileged functions

  1. Prevent non-privileged users from executing privileged functions.
  2. Log the execution of privileged functions.
Discussion

Privileged functions include establishing system accounts, performing system integrity checks, conducting patching operations, or administering cryptographic key management activities. Non-privileged users do not possess the authorizations to execute privileged functions. Bypassing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users. This requirement represents a condition to be achieved by the definition of authorized privileges in Account management 03.01.01 and privilege enforcement in Access enforcement 03.01.02.

The misuse of privileged functions – whether intentionally or unintentionally by authorized users or by unauthorized external entities that have compromised system accounts – is a serious and ongoing concern that can have significant adverse impacts on organizations. Logging the use of privileged functions is one way to detect such misuse and mitigate the risks from advanced persistent threats and insider threats.

References

Source controls: AC-06(09), AC-06(10)
Supporting publications: None

03.01.08 Unsuccessful logon attempts

  1. Limit the number of consecutive invalid logon attempts to [Assignment: organization-defined number] in [Assignment: organization-defined time period].
  2. Automatically [Selection (one or more): lock the account or node for an [Assignment: organization-defined time period]; lock the account or node until released by an administrator; delay next logon prompt; notify system administrator; take other action] when the maximum number of unsuccessful attempts is exceeded.
Discussion

Due to the potential for denial of service, automatic system lockouts are, in most cases, temporary and automatically release after a predetermined period established by the organization (i.e., using a delay algorithm). Organizations may employ different delay algorithms for different system components based on the capabilities of the respective components. Responses to unsuccessful system logon attempts may be implemented at the system and application levels.

Organization-defined actions that may be taken include prompting the user to answer a secret question in addition to the username and password, invoking a lockdown mode with limited user capabilities (instead of a full lockout), allowing users to only logon from specified Internet Protocol (IP) addresses, requiring a CAPTCHA to prevent automated attacks, or applying user profiles, such as location, time of day, IP address, device, or Media Access Control (MAC) address.

References

Source control: AC-07
Supporting publications:

03.01.09 System use notification

Display a system use notification message with privacy and security notices consistent with applicable specified information rules before granting access to the system.

Discussion

System use notifications can be implemented using warning or banner messages. The messages are displayed before individuals log in to the system. System use notifications are used for access via logon interfaces with human users and are not required when human interfaces do not exist. Organizations consider whether a secondary use notification is needed to access applications or other system resources after the initial network logon. Posters or other printed materials may be used in lieu of an automated system message. This requirement is related to Rules of behaviour 03.15.03.

References

Source control: AC-08
Supporting publications: None

03.01.10 Device lock

  1. Prevent access to the system by [Selection (one or more): initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended].
  2. Retain the device lock until the user re-establishes access using established identification and authentication procedures.
  3. Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
Discussion

Device locks are temporary actions taken to prevent access to the system when users depart from the immediate vicinity of the system but do not want to log out because of the temporary nature of their absences. Device locks can be implemented at the operating system level or application level. User-initiated device locking is behaviour- or policy-based and requires users to take physical action to initiate the device lock. Device locks are not an acceptable substitute for logging out of the system (e.g., when organizations require users to log out at the end of workdays). Publicly viewable images can include static or dynamic images, such as patterns used with screen savers, photographic images, solid colors, a clock, a battery life indicator, or a blank screen with the caveat that specified information information is not displayed.

References

Source controls: AC-11, AC-11(01)
Supporting publications: None

03.01.11 Session termination

Terminate a user session automatically after [Assignment: organization-defined conditions or trigger events requiring session disconnect].

Discussion

This requirement addresses the termination of user-initiated logical sessions in contrast to the termination of network connections that are associated with communications sessions (i.e., disconnecting from the network) in Network disconnect 03.13.09. A logical session is initiated whenever a user (or processes acting on behalf of a user) accesses a system. Logical sessions can be terminated (and thus terminate user access) without terminating network sessions. Session termination ends all system processes associated with a user’s logical session except those processes that are created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events that require automatic session termination can include organization-defined periods of user inactivity, time-of-day restrictions on system use, and targeted responses to certain types of incidents.

References

Source control: AC-12
Supporting publications: None

03.01.12 Remote access

  1. Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access.
  2. Authorize each type of remote system access prior to establishing such connections.
  3. Route remote access to the system through authorized and managed access control points.
  4. Authorize remote execution of privileged commands and remote access to security-relevant information.
Discussion

Remote access is access to systems (or processes acting on behalf of users) that communicate through external networks, such as the Internet. Monitoring and controlling remote access methods allows organizations to detect attacks and ensure compliance with remote access policies. Routing remote access through managed access control points enhances explicit control over such connections and reduces susceptibility to unauthorized access to the system, which could result in the unauthorized disclosure of specified information.

Remote access to the system represents a significant potential vulnerability that can be exploited by adversaries. Restricting the execution of privileged commands and access to security-relevant information via remote access reduces the exposure of the organization and its susceptibility to threats by adversaries. A privileged command is a human-initiated command executed on a system that involves the control, monitoring, or administration of the system, including security functions and security-relevant information. Security-relevant information is information that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce the system security policy or maintain isolation of code and data. Privileged commands give individuals the ability to execute sensitive, security-critical, or security-relevant system functions.

References

Source controls: AC-17, AC-17(03), AC-17(04)
Supporting publications:

03.01.13 Not allocated

Withdrawn by NIST.

03.01.14 Not allocated

Withdrawn by NIST.

03.01.15 Not allocated

Withdrawn by NIST.

03.01.16 Wireless access

  1. Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system
  2. Authorize each type of wireless access to the system prior to establishing such connections
  3. Disable, when not intended for use, wireless networking capabilities prior to issuance and deployment
  4. Protect wireless access to the system using authentication and encryption
Discussion

Wireless networking capabilities represent a significant potential vulnerability that can be exploited by adversaries. Establishing usage restrictions, configuration requirements, and connection requirements for wireless access to the system provides criteria to support access authorization decisions. These restrictions and requirements reduce susceptibility to unauthorized system access through wireless technologies. Wireless networks use authentication protocols that provide credential protection and mutual authentication. Organizations authenticate individuals and devices to protect wireless access to the system. Special attention is given to the variety of devices with potential wireless access to the system, including small form factor mobile devices (e.g., smart phones, tablets, smart watches). Wireless networking capabilities that are embedded within system components represent a significant potential vulnerability that can be exploited by adversaries. Strong authentication of users and devices, strong encryption, and disabling wireless capabilities that are not needed for essential missions or business functions can reduce susceptibility to threats by adversaries involving wireless technologies.

References

Source controls: AC-18, AC-18(01), AC-18(03)
Supporting publications:

03.01.17 Not allocated

Withdrawn by NIST.

03.01.18 Access control for mobile devices

  1. Establish usage restrictions, configuration requirements, and connection requirements for mobile devices
  2. Authorize the connection of mobile devices to the system
  3. Implement full-device or container-based encryption to protect the confidentiality of specified information on mobile devices
Discussion

A mobile device is a computing device that has a small form factor such that it can easily be carried by a single individual; is designed to operate without a physical connection; possesses local, non-removable, or removable data storage; and includes a self-contained power source. Mobile device functionality may also include voice communication capabilities, on-board sensors that allow the device to capture information, and/or built-in features for synchronizing local data with remote locations. Examples include smart phones, smart watches, and tablets. Mobile devices are typically associated with a single individual. The processing, storage, and transmission capabilities of mobile devices may be comparable to or a subset of notebook or desktop systems, depending on the nature and intended purpose of the device. The protection and control of mobile devices are behaviour- or policy-based and requires users to take physical action to protect and control such devices when outside of controlled areas. Controlled areas are spaces for which the organization provides physical or procedural controls to meet the requirements established for protecting specified information.

Due to the large variety of mobile devices with different characteristics and capabilities, organizational restrictions may vary for the different classes or types of such devices. Usage restrictions, configuration requirements, and connection requirements for mobile devices include configuration management, device identification and authentication, implementing mandatory protective software, scanning devices for malicious code, updating virus protection software, scanning for critical software updates and patches, conducting primary operating system and possibly other software integrity checks, and disabling unnecessary hardware. On mobile devices, secure containers provide software-based data isolation designed to segment enterprise applications and information from personal apps and data. Containers may present multiple user interfaces, one of the most common being a mobile application that acts as a portal to a suite of business productivity apps, such as email, contacts, and calendar. Organizations can employ full-device encryption or container-based encryption to protect the confidentiality of specified information on mobile devices.

References

Source controls: AC-19, AC-19(05)
Supporting publications:

03.01.19 Not allocated

Withdrawn by NIST.

03.01.20 Use of external systems

  1. Prohibit the use of external systems unless they are specifically authorized
  2. Establish the following terms, conditions, and security requirements to be satisfied on external systems prior to allowing use of or access to those systems by authorized individuals: [Assignment: organization-defined security requirements]
  3. Permit authorized individuals to use an external system to access the organization’s system or to process, store, or transmit specified information only after:
    1. verifying that the security requirements on the external system as specified in the organization’s system security and privacy plans have been satisfied
    2. retaining approved system connection or processing agreements with the organizational entities hosting the external systems
  4. Restrict the use of organization-controlled portable storage devices by authorized individuals on external systems
Discussion

External systems are systems that are used by but are not part of the organization. These systems include personally owned systems, system components, or devices; privately owned computing and communication devices in commercial or public facilities; systems owned or controlled by non-federal organizations; and systems managed by contractors. Organizations have the option to prohibit the use of any type of external system or specified types of external systems, (e.g., prohibit the use of external systems that are not organization-owned). Terms and conditions are consistent with the trust relationships established with the entities that own, operate, or maintain external systems and include descriptions of shared responsibilities.

Authorized individuals include organizational personnel, contractors, or other individuals with authorized access to the organizational system and over whom the organization has the authority to impose specific rules of behaviour regarding system access. Restrictions that organizations impose on authorized individuals may vary depending on the trust relationships between the organization and external entities. Organizations need assurance that the external systems satisfy the necessary security requirements so as not to compromise, damage, or harm the system. This requirement is related to External system services 03.16.03.

References

Source controls: AC-20, AC-20(01), AC-20(02)
Supporting publications: None

03.01.21 Not allocated

Withdrawn by NIST.

03.01.22 Publicly accessible content

  1. Train authorized individuals to ensure that publicly accessible information does not contain specified information
  2. Review the content on publicly accessible systems for specified information periodically and remove such information, if discovered
Discussion

In accordance with applicable laws, Orders in Council, directives, policies, regulations, standards, and guidelines, the public is not authorized to have access to non-public information, including specified information.

References

Source control: AC-22
Supporting publications: None

 
Top of page 

3.2 Awareness and training

The Awareness and training controls deal with the education of users with respect to the security of the system.

03.02.01 Literacy training and awareness

  1. Provide security and privacy literacy training to system users:
    1. as part of initial training for new users and [Assignment: organization-defined frequency] thereafter
    2. when required by system changes or following [Assignment: organization-defined events]
    3. on recognizing and reporting indicators of insider threat, social engineering, and social mining
  2. Update security and privacy literacy training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
Discussion

Organizations provide basic and advanced levels of security and privacy literacy training to system users (including managers, senior executives, system administrators, and contractors) and measures to test the knowledge level of users. Organizations determine the content of literacy training based on specific organizational requirements, the systems to which personnel have authorized access, and work environments (e.g., telework). The content includes an understanding of the need for security and the actions required of users to maintain security and to respond to incidents. The content also addresses the need for operations security and the handling of specified information.

Security and privacy awareness techniques include displaying posters, offering supplies inscribed with security reminders, displaying logon screen messages, generating email advisories or notices from organizational officials, and conducting awareness events using podcasts, videos, and webinars. Security and privacy literacy training is conducted at a frequency consistent with applicable laws, directives, regulations, and policies. Updating literacy training content on a regular basis ensures that the content remains relevant. Events that may precipitate an update to literacy training content include assessment or audit findings, security incidents or breaches, or changes in applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines.

Potential indicators and possible precursors of insider threats include behaviours such as inordinate, long-term job dissatisfaction; attempts to gain access to information that is not required for job performance; unexplained access to financial resources; sexual harassment or bullying of fellow employees; workplace violence; and other serious violations of the policies, procedures, rules, directives, or practices of organizations. Organizations may consider tailoring insider threat awareness topics to the role (e.g., training for managers may be focused on specific changes in the behaviour of team members, while training for employees may be focused on more general observations).

Social engineering is an attempt to deceive an individual into revealing information or taking an action that can be used to breach, compromise, or otherwise adversely impact a system. Social engineering includes phishing, pretexting, impersonation, baiting, quid pro quo, threadjacking, social media exploitation, and tailgating. Social mining is an attempt to gather information about the organization that may be used to support future attacks. Security and privacy literacy training includes how to communicate employee and management concerns regarding potential indicators of insider threat and potential and actual instances of social engineering and data mining through appropriate organizational channels in accordance with established policies and procedures.

References

Source controls: AT-02, AT-02(02), AT-02(03)
Supporting publications:

03.02.02 Role-based training

  1. Provide role-based security and privacy training to organizational personnel:
    1. before authorizing access to the system or specified information, before performing assigned duties, and [Assignment: organization-defined frequency] thereafter
    2. when required by system changes or following [Assignment: organization-defined events]
  2. Update role-based training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
Discussion

Organizations determine the content and frequency of security and privacy training based on the assigned duties, roles, and responsibilities of individuals and the security and privacy requirements of the systems to which personnel have authorized access. In addition, organizations provide system developers, enterprise architects, security architects, privacy officers, software developers, systems integrators, acquisition/procurement officials, system and network administrators, personnel conducting configuration management and auditing activities, personnel performing independent verification and validation, security assessors, and personnel with access to system-level software with security-related technical training specifically tailored for their assigned duties.

Comprehensive role-based training addresses management, operational, and technical roles and responsibilities that cover physical, personnel, and technical controls. Such training can include policies, procedures, tools, and artifacts for the security and privacy roles defined. Organizations also provide the training necessary for individuals to carry out their responsibilities related to operations and supply chain security within the context of organizational information security programs.

References

Source control: AT-03
Supporting publications:

03.02.03 Not allocated

Withdrawn by NIST.

 
Top of page 

3.3 Audit and accountability

The Audit and accountability controls support the ability to collect, analyze, and store audit records associated with user operations performed within the system.

03.03.01 Event logging

  1. Specify the following event types selected for logging within the system: [Assignment: organization-defined event types]
  2. Review and update the event types selected for logging [Assignment: organization-defined frequency]
Discussion

An event is any observable occurrence in a system, including unlawful or unauthorized system activity. Organizations identify event types for which a logging functionality is needed. This includes events that are relevant to the security of systems, the privacy of individuals, and the environments in which those systems operate to meet specific and ongoing auditing needs. Event types can include password changes, the execution of privileged functions, failed logons or accesses related to systems, administrative privilege usage, or third-party credential usage. In determining event types that require logging, organizations consider the system monitoring and auditing that are appropriate for each of the security requirements. When defining event types, organizations consider the logging necessary to cover related events, such as the steps in distributed, transaction-based processes (e.g., processes that are distributed across multiple organizations) and actions that occur in service-oriented or cloud-based architectures.

Monitoring and auditing requirements can be balanced with other system needs. For example, organizations may determine that systems must have the capability to log every file access, both successful and unsuccessful, but only activate that capability under specific circumstances due to the potential burden on system performance. The event types that are logged by organizations may change over time. Reviewing and updating the set of logged event types is necessary to ensure that the current set remains relevant.

References

Source control: AU-02
Supporting publications:

03.03.02 Audit record content

  1. Include the following content in audit records:
    1. what type of event occurred
    2. when the event occurred
    3. where the event occurred
    4. source of the event
    5. outcome of the event
    6. identity of individuals, subjects, objects, or entities associated with the event
  2. Provide additional information for audit records, as needed
Discussion

Audit record content that may be necessary to support the auditing function includes time stamps, source and destination addresses, user or process identifiers, event descriptions, file names, and the access control or flow control rules that are invoked. Event outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the system after the event occurred). Detailed information that organizations may consider in audit records may include a full text recording of privileged commands or the individual identities of group account users.

References

Source controls: AU-03, AU-03(01)
Supporting publications: None

03.03.03 Audit record generation

  1. Generate audit records for the selected event types and audit record content specified in Event logging 03.03.01 and Audit record content 03.03.02
  2. Retain audit records for a time period consistent with records retention policy
Discussion

Audit records can be generated at various levels of abstraction, including at the packet level as information traverses the network. Selecting the appropriate level of abstraction is a critical aspect of an audit logging capability and can facilitate the identification of root causes to problems. The ability to add information generated in audit records is dependent on system functionality to configure the audit record content. Organizations may consider additional information in audit records, including the access control or flow control rules invoked and the individual identities of group account users. Organizations may also consider limiting additional audit record information to only information that is explicitly needed for audit requirements. If records generated for the audit process contain personal information that is not required for the audit process, that personal information should be removed or redacted prior to retention.

If audit records rely on personal information and that information is used to make an administrative decision, the minimum retention standard is at least two years following the last time the personal information was used for an administrative purpose unless the individual consents to its disposal.

References

Source controls: AU-11, AU-12
Supporting publications: NIST SP 800-92 Guide to Computer Security Log Management

03.03.04 Response to audit logging process failures

  1. Alert organizational personnel or roles within [Assignment: organization-defined time period] in the event of an audit logging process failure
  2. Take the following additional actions: [Assignment: organization-defined additional actions]
Discussion

Audit logging process failures include software and hardware errors, failures in audit log capturing mechanisms, and reaching or exceeding audit log storage capacity. Response actions include overwriting the oldest audit records, shutting down the system, and stopping the generation of audit records. Organizations may choose to define additional actions for audit logging process failures based on the type, location, and severity of the failure, or a combination of such factors. When the audit logging process failure is related to storage, the response is carried out for the audit log storage repository (i.e., the distinct system component where the audit logs are stored), the system on which the audit logs reside, the total audit log storage capacity of the organization (i.e., all audit log storage repositories combined), or all three. Organizations may decide to take no additional actions after alerting designated roles or personnel.

References

Source control: AU-05
Supporting publications: None

03.03.05 Audit record review, analysis, and reporting

  1. Review and analyze system audit records [Assignment: organization-defined frequency] for indications and potential impact of inappropriate or unusual activity
  2. Report findings to organizational personnel or roles
  3. Analyze and correlate audit records across different repositories to gain organization-wide situational awareness
Discussion

Audit record review, analysis, and reporting cover information security- and privacy-related logging performed by organizations and can include logging that results from the monitoring of account usage, remote access, wireless connectivity, configuration settings, the use of maintenance tools and non-local maintenance, system component inventory, mobile device connection, equipment delivery and removal, physical access, temperature and humidity, communications at system interfaces, and the use of mobile code. Findings can be reported to organizational entities, such as the incident response team, help desk, and security or privacy offices. If organizations are prohibited from reviewing and analyzing audit records or unable to conduct such activities, the review or analysis may be carried out by other organizations granted such authority. The scope, frequency, and/or depth of the audit record review, analysis, and reporting may be adjusted to meet organizational needs based on new information received. Correlating audit record review, analysis, and reporting processes helps to ensure that they collectively create a more complete view of events.

References

Source controls: AU-06, AU-06(03)
Supporting publications:

03.03.06 Audit record reduction and report generation

  1. Implement an audit record reduction and report generation capability that supports audit record review, analysis, reporting requirements, and after-the-fact investigations of incidents
  2. Preserve the original content and time ordering of audit records
Discussion

Audit records are generated in Audit record generation 03.03.03. Audit record reduction and report generation occur after audit record generation. Audit record reduction is a process that manipulates collected audit information and organizes it in a summary format that is more meaningful to analysts. Audit record reduction and report generation capabilities do not always come from the same system or organizational entities that conduct auditing activities. An audit record reduction capability can include, for example, modern data mining techniques with advanced data filters to identify anomalous behaviour in audit records. The report generation capability provided by the system can help generate customizable reports. The time ordering of audit records can be a significant issue if the granularity of the time stamp in the record is insufficient.

References

Source control: AU-07
Supporting publications: None

03.03.07 Time stamps

  1. Use internal system clocks to generate time stamps for audit records
  2. Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and that use Coordinated Universal Time (UTC), have a fixed local time offset from UTC, or include the local time offset as part of the time stamp
Discussion

Time stamps generated by the system include the date and time. Time is commonly expressed in UTC or local time with an offset from UTC. The granularity of time measurements refers to the degree of synchronization between system clocks and reference clocks (e.g., clocks synchronizing within hundreds or tens of milliseconds). Organizations may define different time granularities for system components. Time service can be critical to other security capabilities (e.g., access control, and identification and authentication), depending on the nature of the mechanisms used to support those capabilities.

References

Source control: AU-08
Supporting publications: None

03.03.08 Protection of audit information

  1. Protect audit information and audit logging tools from unauthorized access, modification, and deletion
  2. Authorize access to management of audit logging functionality to only a subset of privileged users or roles
Discussion

Audit information includes the information needed to successfully audit system activity, such as audit records, audit log settings, audit reports, and personal information. Audit logging tools are programs and devices used to conduct audit and logging activities. The protection of audit information focuses on technical protection and limits the ability to access and execute audit logging tools to authorized individuals. The physical protection of audit information is addressed by media and physical protection requirements.

Individuals or roles with privileged access to a system and who are also the subject of an audit by that system may affect the reliability of the audit information by inhibiting audit activities or modifying audit records. Requiring privileged access to be further defined between audit-related privileges and other privileges limits the number of users or roles with audit-related privileges.

References

Source controls: AU-09, AU-09(04)
Supporting publications: None

03.03.09 Not allocated

Withdrawn by NIST.

 
Top of page 

3.4 Configuration management

The Configuration management controls support the management and control of all components of the system such as hardware, software, and configuration items.

03.04.01 Baseline configuration

  1. Develop and maintain under configuration control, a current baseline configuration of the system
  2. Review and update the baseline configuration of the system [Assignment: organization-defined frequency] and when system components are installed or modified
Discussion

Baseline configurations for the system and system components include aspects of connectivity, operation, and communications. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for the system or configuration items within it. Baseline configurations serve as a basis for future builds, releases, or changes to the system and include information about system components, operational procedures, network topology, and the placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as the system changes over time. Baseline configurations of the system reflect the current enterprise architecture. If the system facilitates the collection or use of personal information, baseline configurations should include providing privacy notice to users.

References

Source control: CM-02
Supporting publications:

03.04.02 Configuration settings

  1. Establish, document, and implement the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements: [Assignment: organization-defined configuration settings]
  2. Identify, document, and approve any deviations from established configuration settings.
Discussion

Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system which affect the security and privacy posture or functionality of the system. Security-related configuration settings can be defined for systems (e.g., servers, workstations), input and output devices (e.g., scanners, copiers, printers), network components (e.g., firewalls, routers, gateways, voice and data switches, wireless access points, network appliances, sensors), operating systems, middleware, and applications.

Security parameters are those that impact the security state of the system, including the parameters required to satisfy other security requirements. Security parameters include registry settings; account, file, and directory permission settings (i.e., privileges); and settings for functions, ports, protocols, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including those required to satisfy other privacy controls. Privacy parameters include settings for access controls, personal information, data accuracy requirements, data manipulation capabilities, data processing preferences, and information handling and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for the system. The established settings become part of the system’s configuration baseline.

Common secure configurations (also referred to as security configuration checklists, lockdown and hardening guides, security reference guides, and security technical implementation guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for specific IT platforms/products and instructions for configuring those system components to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including IT product developers, manufacturers, vendors, consortia, academia, industry, federal departments and agencies, and other organizations in the public and private sectors.

References

Source control: CM-06
Supporting publications:

03.04.03 Configuration change control

  1. Define the types of changes to the system that are configuration-controlled
  2. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security impacts
  3. Implement and document approved configuration-controlled changes to the system
  4. Monitor and review activities associated with configuration-controlled changes to the system
Discussion

Configuration change control refers to tracking, reviewing, approving or disapproving, and logging changes to the system. Specifically, it involves the systematic proposal, justification, implementation, testing, review, and disposition of changes to the system, including system upgrades and modifications. Configuration change control includes changes to baseline configurations for system components (e.g., operating systems, applications, firewalls, routers, mobile devices) and configuration items of the system, changes to configuration settings, unscheduled and unauthorized changes, and changes to remediate vulnerabilities. This requirement is related to Impact analyses 03.04.04.

References

Source control: CM-03
Supporting publications:

03.04.04 Impact analyses

  1. Analyze the security and privacy impacts of changes to the system prior to implementation
  2. Verify that the security requirements for the system continue to be satisfied after the system changes have been implemented
Discussion

Organizational personnel with security or privacy responsibilities conduct impact analyses that include reviewing security and privacy plans, policies, and procedures to understand security and privacy requirements; reviewing system design documentation and operational procedures to understand how system changes might affect the security and privacy state of the system; reviewing the impacts of changes on supply chain partners with stakeholders; and determining how potential changes to a system create new risks to the privacy of individuals, and the ability to mitigate those risks. Impact analyses also include risk assessments to understand the impacts of changes and to determine whether additional security or privacy requirements are needed. Changes to the system may affect the safeguards and countermeasures previously implemented. This requirement is related to Configuration change control 03.04.03. Not all changes to the system are configuration controlled.

References

Source controls: CM-04, CM-04(02)
Supporting publications: NIST SP 800-128 Guide for Security-Focused Configuration Management of Information Systems

03.04.05 Access restrictions for change

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

Discussion

Changes to the hardware, software, or firmware components of the system or the operational procedures related to the system can have potentially significant effects on the security of the system or individuals’ privacy. Therefore, organizations permit only qualified and authorized individuals to access the system for the purpose of initiating changes. Access restrictions include physical and logical access controls, software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into the system), and change windows (i.e., changes occur only during specified times).

References

Source control: CM-05
Supporting publications:

03.04.06 Least functionality

  1. Configure the system to provide only mission-essential capabilities
  2. Prohibit or restrict use of the following functions, ports, protocols, connections, and services: [Assignment: organization-defined functions, ports, protocols, connections, and services]
  3. Review the system [Assignment: organization-defined frequency] to identify unnecessary or nonsecure functions, ports, protocols, connections, and services
  4. Disable or remove functions, ports, protocols, connections, and services that are unnecessary or nonsecure
Discussion

Systems can provide a variety of functions and services. Some functions and services that are routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. It may be convenient to provide multiple services from single system components. However, doing so increases risk over limiting the services provided by any one component. Where feasible, organizations limit functionality to a single function per component.

Organizations review the functions and services provided by the system or system components to determine which functions and services are candidates for elimination. Organizations disable unused or unnecessary physical and logical ports and protocols to prevent the unauthorized connection of devices, transfer of information, and tunneling. Organizations can employ network scanning tools, intrusion detection and prevention systems, and endpoint protection systems (e.g., firewalls and host-based intrusion detection systems) to identify and prevent the use of prohibited functions, ports, protocols, system connections, and services. Bluetooth, File Transfer Protocol (FTP), and peer-to-peer networking are examples of the types of protocols that organizations consider eliminating, restricting, or disabling.

References

Source controls: CM-07, CM-07(01)
Supporting publications:

03.04.07 Not allocated

Withdrawn by NIST.

03.04.08 Authorized software – allow by exception

  1. Identify software programs authorized to execute on the system
  2. Implement a deny-all, allow-by-exception policy for the execution of software programs on the system
  3. Review and update the list of authorized software programs [Assignment: organization-defined frequency]
Discussion

If provided with the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved “app stores.” The policies selected for governing user-installed software are organization-developed or provided by an external entity. Policy enforcement methods can include procedural methods and automated methods.

Authorized software programs can be limited to specific versions or from a specific source. To facilitate a comprehensive authorized software process and increase the strength of protection against attacks that bypass application-level authorized software, software programs may be decomposed into and monitored at different levels of detail. These levels include applications, application programming interfaces, application modules, scripts, system processes, system services, kernel functions, registries, drivers, and dynamic link libraries.

References

Source control: CM-07(05)
Supporting publications:

03.04.09 Not allocated

Withdrawn by NIST.

03.04.10 System component inventory

  1. Develop and document an inventory of system components
  2. Review and update the system component inventory [Assignment: organization-defined frequency]
  3. Update the system component inventory as part of installations, removals, and system updates
Discussion

System components are discrete, identifiable assets (i.e., hardware, software, and firmware elements) that compose a system. Organizations may implement centralized system component inventories that include components from all systems. In such situations, organizations ensure that the inventories include system-specific information required for component accountability. The information necessary for effective accountability of system components includes the system name, software owners, software version numbers, hardware inventory specifications, software license information — and for networked components — the machine names and network addresses for all implemented protocols (e.g., IPv4, IPv6). Inventory specifications include component type, physical location, date of receipt, manufacturer, cost, model, serial number, and supplier information.

References

Source controls: CM-08, CM-08(01)
Supporting publications:

03.04.11 Information location

  1. Identify and document the location of specified information and the system components on which the information is processed and stored.
  2. Document changes to the system or system component location where specified information is processed and stored.
Discussion

Information location addresses the need to understand the specific system components where specified information is being processed and stored and the users who have access to specified information so that appropriate protection mechanisms can be provided, including information flow controls, access controls, and information management.

References

Source control: CM-12
Supporting publications: None

03.04.12 System and component configuration for high-risk areas

  1. Issue systems or system components with the following configurations to individuals traveling to high-risk locations: [Assignment: organization-defined system configurations].
  2. Apply the following security requirements to the system or system components when the individuals return from travel: [Assignment: organization-defined security requirements].
Discussion

When it is known that a system or a specific system component will be in a high-risk area, additional security requirements may be needed to counter the increased threat. Organizations can implement protective measures on systems or system components used by individuals departing on and returning from travel. Actions include determining locations of concern, defining the required configurations for the components, ensuring that the components are configured as intended before travel is initiated, and taking additional actions after travel is completed. For example, systems going into high-risk areas can be configured with sanitized hard drives, limited applications, and more stringent configuration settings. Actions applied to mobile devices upon return from travel include examining the device for signs of physical tampering and purging and reimaging the device storage.

References

Source control: CM-02(07)
Supporting publications:

 
Top of page 

3.5 Identification and authentication

The Identification and authentication controls support the unique identification of users, processes acting on behalf of users and devices. They also support the authentication or verification of the identities of those users, processes or devices as a prerequisite to allowing access to organizational systems.

03.05.01 User identification, authentication, and re-authentication

  1. Uniquely identify and authenticate system users and associate that unique identification with processes acting on behalf of those users
  2. Re-authenticate users when [Assignment: organization-defined circumstances or situations requiring re-authentication]
Discussion

System users include individuals (or system processes acting on behalf of individuals) who are authorized to access a system. Typically, individual identifiers are the usernames associated with the system accounts assigned to those individuals. Since system processes execute on behalf of groups and roles, organizations may require the unique identification of individuals in group accounts or accountability of individual activity. The unique identification and authentication of users applies to all system accesses. Organizations employ passwords, physical authenticators, biometrics, or some combination thereof to authenticate user identities. Organizations may re-authenticate individuals in certain situations, including when roles, authenticators, or credentials change; when the execution of privileged functions occurs; after a fixed time period; or periodically.

References

Source controls: IA-02, IA-11
Supporting publications: Cyber Centre User Authentication Guidance for Information Technology Systems (ITSP.30.031)

03.05.02 Device identification and authentication

Uniquely identify and authenticate [Assignment: organization-defined devices or types of devices] before establishing a system connection.

Discussion

Devices that require unique device-to-device identification and authentication are defined by type, device, or a combination of type and device. Organization-defined device types include devices that are not owned by the organization. Systems use shared known information (e.g., Media Access Control [MAC], Transmission Control Protocol/Internet Protocol [TCP/IP] addresses) for device identification or organizational authentication solutions (e.g., Institute of Electrical and Electronics Engineers [IEEE] 802.1x and Extensible Authentication Protocol [EAP], RADIUS server with EAP-Transport Layer Security [TLS] authentication, Kerberos) to identify and authenticate devices on local and wide area networks. Public Key Infrastructure (PKI) and certificate revocation checking for the certificates exchanged can also be included as part of device authentication.

References

Source control: IA-03
Supporting publications: Cyber Centre User Authentication Guidance for Information Technology Systems (ITSP.30.031)

03.05.03 Multi-factor authentication

Implement strong multi-factor authentication (MFA) for access to privileged and non-privileged accounts.

Discussion

This requirement applies to user accounts. Multi-factor authentication requires the use of two or more different factors to achieve authentication. The authentication factors are defined as follows: something you know (e.g., a personal identification number [PIN]), something you have (e.g., a physical authenticator, such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards. In addition to authenticating users at the system level, organizations may also employ authentication mechanisms at the application level to provide increased information security.

References

Source controls: IA-02(01), IA-02(02)
Supporting publications: Cyber Centre User Authentication Guidance for Information Technology Systems (ITSP.30.031)

03.05.04 Replay-resistant authentication

Implement replay-resistant authentication mechanisms for access to privileged and non-privileged accounts.

Discussion

Authentication processes resist replay attacks if it is impractical to successfully authenticate by recording or replaying previous authentication messages. Replay-resistant techniques include protocols that use nonces or challenges, such as time synchronous or challenge-response one-time authenticators.

References

Source control: IA-02(08)
Supporting publications: Cyber Centre User Authentication Guidance for Information Technology Systems (ITSP.30.031)

03.05.05 Identifier management

  1. Receive authorization from organizational personnel or roles to assign an individual, group, role, service, or device identifier
  2. Select and assign an identifier that identifies an individual, group, role, service, or device
  3. Prevent reuse of identifiers for [Assignment: organization-defined time period]
  4. Manage individual identifiers by uniquely identifying each individual as [Assignment: organization-defined characteristic identifying individual status]
Discussion

Identifiers are provided for users, processes acting on behalf of users, and devices. Prohibiting the reuse of identifiers prevents the assignment of previously used individual, group, role, service, or device identifiers to different individuals, groups, roles, services, or devices.

Characteristics that identify the status of individuals include contractors, foreign nationals, and non-organizational users. Identifying the status of individuals by these characteristics provides information about the people with whom organizational personnel are communicating. For example, it is useful for an employee to know that one of the individuals on an email message is a contractor.

References

Source controls: IA-04, IA-04(04)
Supporting publications: Cyber Centre User Authentication Guidance for Information Technology Systems (ITSP.30.031)

03.05.06 Not allocated

Withdrawn by NIST.

03.05.07 Password management

  1. Maintain a list of commonly used, expected, or compromised passwords and update the list [Assignment: organization-defined frequency] and when organizational passwords are suspected to have been compromised
  2. Verify that passwords are not found on the list of commonly used, expected, or compromised passwords when users create or update passwords
  3. Transmit passwords only over cryptographically protected channels
  4. Store passwords in a cryptographically protected form
  5. Select a new password upon first use after account recovery
  6. Enforce the following composition and complexity rules for passwords: [Assignment: organization-defined composition and complexity rules]
Discussion

Password-based authentication applies to passwords used in single-factor or multi-factor authentication. Long passwords or passphrases are preferable to shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish and enforce certain rules for password generation (e.g., minimum character length) under certain circumstances. For example, account recovery can occur when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof. Changing temporary passwords to permanent passwords immediately after system logon ensures that the necessary strength of the authentication mechanism is implemented at the earliest opportunity and reduces the susceptibility to authenticator compromises. Long passwords and passphrases can be used to increase the complexity of passwords.

References

Source control: IA-05(01)
Supporting publications: Cyber Centre User Authentication Guidance for Information Technology Systems (ITSP.30.031)

03.05.08 Not allocated

Withdrawn by NIST.

03.05.09 Not allocated

Withdrawn by NIST.

03.05.10 Not allocated

Withdrawn by NIST.

03.05.11 Authentication feedback

Obscure feedback of authentication information during the authentication process.

Discussion

Authentication feedback does not provide information that would allow unauthorized individuals to compromise authentication mechanisms. For example, for desktop or notebook computers with relatively large monitors, the threat may be significant (commonly referred to as shoulder surfing). For mobile devices with small displays, this threat may be less significant and is balanced against the increased likelihood of input errors due to small keyboards. Therefore, the means for obscuring the authentication feedback is selected accordingly. Obscuring feedback includes displaying asterisks when users type passwords into input devices or displaying feedback for a limited time before fully obscuring it.

References

Source control: IA-06
Supporting publications: None

03.05.12 Authenticator management

  1. Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution
  2. Establish initial authenticator content for any authenticators issued by the organization
  3. Establish and implement administrative procedures for initial authenticator distribution, for lost, compromised, or damaged authenticators, and for revoking authenticators
  4. Change default authenticators at first use
  5. Change or refresh authenticators [Assignment: organization-defined frequency] or when the following events occur: [Assignment: organization-defined events]
  6. Protect authenticator content from unauthorized disclosure and modification
Discussion

Authenticators include passwords, cryptographic devices, biometrics, certificates, one-time password devices, and ID badges. The initial authenticator content is the actual content of the authenticator (e.g., the initial password). In contrast, requirements for authenticator content contain specific characteristics. Authenticator management is supported by organization-defined settings and restrictions for various authenticator characteristics (e.g., password complexity and composition rules, validation time window for time synchronous one-time tokens, and the number of allowed rejections during the verification stage of biometric authentication).

The requirement to protect individual authenticators may be implemented by Rules of behaviour 03.15.03 for authenticators in the possession of individuals and by Account management 03.01.01, Access enforcement 03.01.02, Least privilege 03.01.05, and Transmission and storage confidentiality 03.13.08 for authenticators stored in organizational systems. This includes passwords stored in hashed or encrypted formats or files that contain encrypted or hashed passwords accessible with administrator privileges. Actions can be taken to protect authenticators, including maintaining possession of authenticators, not sharing authenticators with others, and immediately reporting lost, stolen, or compromised authenticators.

Developers may deliver system components with factory default authentication credentials to allow for initial installation and configuration. Default authentication credentials are often well-known, easily discoverable, and present a significant risk. Authenticator management includes issuing and revoking authenticators for temporary access when no longer needed. The use of long passwords or passphrases may obviate the need to periodically change authenticators.

References

Source control: IA-05
Supporting publications: Cyber Centre User Authentication Guidance for Information Technology Systems (ITSP.30.031)

 
Top of page 

3.6 Incident response

The Incident response controls support the establishment of an operational incident handling capability for organizational systems that includes adequate preparation, monitoring, detection, analysis, containment, recovery, and response. Incidents are monitored, documented, and reported to appropriate organizational officials and authorities.

03.06.01 Incident handling

Implement an incident-handling capability that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery

Discussion

Incident-related information can be obtained from a variety of sources, including audit monitoring, network monitoring, physical access monitoring, user and administrator reports, and reported supply chain events. An effective incident handling capability involves coordination among many organizational entities, including mission and business owners, system owners, human resources offices, physical and personnel security offices, legal departments, operations personnel, and procurement offices.

An incident that involves personal information is considered a privacy breach. A privacy breach results in the loss of control, compromise, unauthorized disclosure, unpermitted use, unlawful collection, improper retention or disposal, or a similar occurrence where a person other than an authorized user accesses or potentially accesses or an authorized user accesses or potentially accesses such information for other than authorized purposes.

If the incident involves the breach of personal information, notification to the contract owner is mandatory.

References

Source control: IR-04
Supporting publications:

03.06.02 Incident monitoring, reporting, and response assistance

  1. Track and document system security incidents
  2. Report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period]
  3. Report incident information to [Assignment: organization-defined authorities]
  4. Provide an incident response support resource that offers advice and assistance to system users for the handling and reporting of incidents
Discussion

Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from many sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. Incident handling 03.06.01 provides information on the types of incidents that are appropriate for monitoring. The types of incidents reported, the content and timeliness of the reports, and the reporting authorities reflect applicable laws, jurisprudence, Orders in Council, directives, regulations, policies, standards, and guidelines. Incident information informs risk assessments, the effectiveness of security and privacy assessments, the security requirements for acquisitions, and the selection criteria for technology products. Incident response support resources provided by organizations include help desks, assistance groups, automated ticketing systems to open and track incident response tickets, and access to forensic services or consumer redress services, when required.

References

Source controls: IR-05, IR-06, IR-07
Supporting publications:

03.06.03 Incident response testing

Test the effectiveness of the incident response capability [Assignment: organization-defined frequency].

Discussion

Organizations test incident response capabilities to determine their effectiveness and identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, and simulations. Incident response testing can include a determination of the effects of incident response on organizational operations, organizational assets, and individuals. Qualitative and quantitative data can help determine the effectiveness of incident response processes.

References

Source control: IR-03
Supporting publications: NIST SP 800-84 Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities

03.06.04 Incident response training

  1. Provide incident response training to system users consistent with assigned roles and responsibilities:
    1. within [Assignment: organization-defined time period] of assuming an incident response role or responsibility or acquiring system access
    2. when required by system changes
    3. [Assignment: organization-defined frequency] thereafter
  2. Review and update incident response training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]
Discussion

Incident response training is associated with the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail are included in such training. For example, users may only need to know whom to call or how to recognize an incident; system administrators may require additional training on how to handle incidents; and incident responders may receive specific training on forensics, data collection techniques, reporting, system recovery, and system restoration. Incident response training includes user training in identifying and reporting suspicious activities from external and internal sources. Incident response training for users may be provided as part of Role-based training 03.02.02. Events that may cause an update to incident response training content include incident response plan testing, response to an actual incident, audit or assessment findings, or changes in applicable laws, jurisprudence, Orders in Council, policies, directives, regulations, standards, and guidelines.

References

Source control: IR-02
Supporting publications:

03.06.05 Incident response plan

  1. Develop an incident response plan that:
    1. provides the organization with a roadmap for implementing its incident response capability
    2. describes the structure and organization of the incident response capability
    3. provides a high-level approach for how the incident response capability fits into the overall organization
    4. defines reportable incidents
    5. addresses the sharing of incident information
    6. designates responsibilities to organizational entities, personnel, or roles
  2. Distribute copies of the incident response plan to designated incident response personnel (identified by name and/or by role) and organizational elements
  3. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing
  4. Protect the incident response plan from unauthorized disclosure
Discussion

It is important that organizations develop and implement a coordinated approach to incident response. Organizational mission and business functions determine the structure of incident response capabilities. As part of the incident response capabilities, organizations consider the coordination and sharing of information with external organizations, including external service providers and other organizations involved in the supply chain.

References

Source control: IR-08
Supporting publications:

 
Top of page 

3.7 Maintenance

The Maintenance controls support periodic and timely maintenance on organizational systems and provide effective controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance to ensure its ongoing availability.

03.07.01 Not allocated

Withdrawn by NIST.

03.07.02 Not allocated

Withdrawn by NIST.

03.07.03 Not allocated

Withdrawn by NIST.

03.07.04 Maintenance tools

  1. Approve, control, and monitor the use of system maintenance tools
  2. Check media containing diagnostic and test programs for malicious code before the media are used in the system
  3. Prevent the removal of system maintenance equipment containing specified information by verifying that there is no specified information on the equipment, sanitizing or destroying the equipment, or retaining the equipment within the facility
Discussion

Approving, controlling, monitoring, and reviewing maintenance tools address security-related issues associated with the tools that are used for diagnostic and repair actions on the system. Maintenance tools can include hardware and software diagnostic and test equipment as well as packet sniffers. The tools may be pre-installed, brought in with maintenance personnel on media, cloud-based, or downloaded from a website. Diagnostic and test programs are potential vehicles for transporting malicious code into the system, either intentionally or unintentionally. Examples of media inspection include checking the cryptographic hash or digital signatures of diagnostic and test programs and media.

If organizations inspect media that contain diagnostic and test programs and determine that the media also contains malicious code, the incident is handled consistent with incident handling policies and procedures. A periodic review of maintenance tools can result in the withdrawal of approval for outdated, unsupported, irrelevant, or no-longer-used tools. Maintenance tools do not address the hardware and software components that support maintenance and are considered a part of the system.

References

Source controls: MA-03, MA-03(01), MA-03(02), MA-03(03)
Supporting publications: Cyber Centre IT media sanitization (ITSP.40.006)

03.07.05 Non-local maintenance

  1. Approve and monitor non-local maintenance and diagnostic activities.
  2. Implement multi-factor authentication and replay resistance in the establishment of non-local maintenance and diagnostic sessions.
  3. Terminate session and network connections when non-local maintenance is completed.
Discussion

Non-local maintenance and diagnostic activities are conducted by individuals who communicate through an external or internal network. Local maintenance and diagnostic activities are carried out by individuals who are physically present at the system location and not communicating across a network connection. Authentication techniques used to establish non-local maintenance and diagnostic sessions reflect the requirements in User identification, authentication, and re-authentication 03.05.01.

References

Source control: MA-04
Supporting publications:

03.07.06 Maintenance personnel

  1. Establish a process for maintenance personnel authorization
  2. Maintain a list of authorized maintenance organizations or personnel
  3. Verify that non-escorted personnel who perform maintenance on the system possess the required access authorizations
  4. Designate organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations
Discussion

Maintenance personnel refers to individuals who perform hardware or software maintenance on the system, while Physical access authorizations 03.10.01 addresses physical access for individuals whose maintenance duties place them within the physical protection perimeter of the system. The technical competence of supervising individuals relates to the maintenance performed on the system, while having required access authorizations refers to maintenance on and near the system. Individuals who have not been previously identified as authorized maintenance personnel (e.g., manufacturers, consultants, systems integrators, and vendors) may require privileged access to the system, such as when they are required to conduct maintenance with little or no notice. Organizations may choose to issue temporary credentials to these individuals based on their risk assessments. Temporary credentials may be for one-time use or for very limited time periods.

References

Source control: MA-05
Supporting publications: None

 
Top of page 

3.8 Media protection

Physically control and securely store system media containing CI.

03.08.01 Media storage

Physically control and securely store system media containing specified information.

Discussion

System media includes digital and non-digital media. Digital media includes diskettes, flash drives, magnetic tapes, external or removable solid state or magnetic drives, compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Physically controlling stored media includes conducting inventories, establishing procedures to allow individuals to check out and return media to libraries, and maintaining accountability for stored media. Secure storage includes a locked drawer, desk, or cabinet or a controlled media library. Controlled areas provide physical and procedural controls to meet the requirements established for protecting information and systems. Sanitization techniques (e.g., cryptographically erasing, destroying, clearing, and purging) prevent the disclosure of specified information to unauthorized individuals. The sanitization process removes specified information from media such that the information cannot be retrieved or reconstructed.

References

Source control: MP-04
Supporting publications:

03.08.02 Media access

Restrict access to specified information on system media to authorized personnel or roles.

Discussion

System media includes digital and non-digital media. Access to specified information on system media can be restricted by physically controlling such media. This includes conducting inventories, ensuring that procedures are in place to allow individuals to check out and return media to the media library, and maintaining accountability for stored media. For digital media, access to specified information can be restricted by using cryptographic means. Encrypting data in storage or at rest is addressed in Transmission and storage confidentiality 03.13.08.

References

Source control: MP-02
Supporting publications: NIST SP 800-111 Guide to Storage Encryption Technologies for End User Devices

03.08.03 Media sanitization

Sanitize system media containing specified information prior to disposal, release out of organizational control, or release for reuse.

Discussion

Media sanitization applies to digital and non-digital media subject to disposal or reuse, whether or not the media are considered removable. Examples include digital media in scanners, copiers, printers, notebook computers, workstations, mobile devices, network components, and non-digital media. The sanitization process removes specified information from media such that the information cannot be retrieved or reconstructed. Sanitization techniques (e.g., cryptographically erasing, clearing, purging, and destroying) prevent the disclosure of specified information to unauthorized individuals when such media is reused or released for disposal. Cyber Centre and RCMP endorsed standards control the sanitization process for media containing specified information and may require destruction when other methods cannot be applied to the media.

References

Source control: MP-06
Supporting publications:

03.08.04 Media marking

Mark system media containing specified information to indicate distribution limitations, handling caveats, and applicable specified information markings.

Discussion

System media includes digital and non-digital media. Marking refers to the use or application of human-readable security attributes. Labeling refers to the use of security attributes for internal system data structures. Digital media includes diskettes, magnetic tapes, external or removable solid state or magnetic drives, flash drives, compact discs, and digital versatile discs. Non-digital media includes paper and microfilm. Specified information includes any information, other than classified, that a GC authority identifies and qualifies in a contract as requiring safeguarding.

References

Source control: MP-03
Supporting publications: None

03.08.05 Media transport

  1. Protect and control system media that contain specified information during transport outside of controlled areas
  2. Maintain accountability of system media that contain specified information during transport outside of controlled areas.
  3. Document activities associated with the transport of system media that contain specified information
Discussion

System media includes digital and non-digital media. Digital media includes flash drives, diskettes, magnetic tapes, external or removable solid state or magnetic drives, compact discs, and digital versatile discs. Non-digital media includes microfilm and paper. Controlled areas are spaces for which organizations provide physical or procedural measures to meet the requirements established for protecting specified information and systems. Media protection during transport can include cryptography and/or locked containers. Activities associated with media transport include releasing media for transport, ensuring that media enter the appropriate transport processes, and the actual transport. Authorized transport and courier personnel may include individuals external to the organization. Maintaining accountability of media during transport includes restricting transport activities to authorized personnel and tracking or obtaining records of transport activities as the media move through the transportation system to prevent and detect loss, destruction, or tampering. This requirement is related to Transmission and storage confidentiality 03.13.08 and Cryptographic protection 03.13.11.

References

Source controls: MP-05, SC-28
Supporting publications: NIST SP 800-111 Guide to Storage Encryption Technologies for End User Devices

03.08.06 Not allocated

Withdrawn by NIST.

03.08.07 Media use

  1. Restrict or prohibit the use of [Assignment: organization-defined types of system media]
  2. Prohibit the use of removable system media without an identifiable owner
Discussion

In contrast to requirement Media storage 03.08.01, which restricts user access to media, this requirement restricts or prohibits the use of certain types of media, such as external hard drives, flash drives, or smart displays. Organizations can use technical and non-technical measures (e.g., policies, procedures, and rules of behaviour) to control the use of system media. For example, organizations may control the use of portable storage devices by using physical cages on workstations to prohibit access to external ports or disabling or removing the ability to insert, read, or write to devices.

Organizations may limit the use of portable storage devices to only approved devices, including devices provided by the organization, devices provided by other approved organizations, and devices that are not personally owned. Organizations may also control the use of portable storage devices based on the type of device — prohibiting the use of writeable, portable devices — and implement this restriction by disabling or removing the capability to write to such devices. Limits on the use of organization-controlled system media in external systems include restrictions on how the media may be used and under what conditions. Requiring identifiable owners (e.g., individuals, organizations, or projects) for removable system media reduces the risk of using such technologies by allowing organizations to assign responsibility and accountability for addressing known vulnerabilities in the media (e.g., insertion of malicious code).

References

Source control: MP-07
Supporting publications: NIST SP 800-111 Guide to Storage Encryption Technologies for End User Devices

03.08.08 Not allocated

Withdrawn by NIST.

03.08.09 System backup – cryptographic protection

  1. Protect the confidentiality of backup information
  2. Implement cryptographic mechanisms to prevent the unauthorized disclosure of specified information at backup storage locations
Discussion

The selection of cryptographic mechanisms is based on the need to protect the confidentiality of backup information. Hardware security module (HSM) devices safeguard and manage cryptographic keys and provide cryptographic processing. Cryptographic operations (e.g., encryption, decryption, and signature generation and verification) are typically hosted on the HSM device, and many implementations provide hardware-accelerated mechanisms for cryptographic operations. This requirement is related to Cryptographic protection 03.13.11.

References

Source controls: CP-09, CP-09(08)
Supporting publications:

 
Top of page 

3.9 Personnel security

The Personnel security controls support the procedures required to ensure that all personnel who have access to systems have the necessary authorizations as well as appropriate security screening levels. They ensure that organizational information and systems are protected during and after personnel actions such as terminations and transfers.

03.09.01 Personnel screening

  1. Screen individuals prior to authorizing access to the system
  2. Rescreen individuals in accordance with [Assignment: organization-defined conditions requiring rescreening]
Discussion

Personnel security screening activities involve the assessment of the conduct, integrity, judgment, loyalty, reliability, and stability of an individual (i.e., the individual’s trustworthiness) prior to authorizing access to the system or when elevating system access. The screening and rescreening activities reflect applicable federal laws, Orders in Council, directives, policies, regulations, and criteria established for the level of access required for the assigned positions.

References

Source control: PS-03
Supporting publications:

03.09.02 Personnel termination and transfer

  1. When individual employment is terminated:
    1. disable system access within [Assignment: organization-defined time period]
    2. terminate or revoke authenticators and credentials associated with the individual
    3. retrieve security-related system property
  2. When individuals are reassigned or transferred to other positions in the organization:
    1. review and confirm the ongoing operational need for current logical and physical access authorizations to the system and facility
    2. modify access authorization to correspond with any changes in operational need
Discussion

Security-related system property includes hardware authentication tokens, system administration technical manuals, keys, identification cards, and building passes. Exit interviews ensure that terminated individuals understand the security constraints imposed by being former employees and that accountability is achieved for the organizational property. Security topics at exit interviews include reminding individuals of potential limitations on future employment and nondisclosure agreements. Exit interviews may not always be possible for some individuals, including in cases related to the unavailability of supervisors, illnesses, or job abandonment.

The timely execution of termination actions is essential for individuals who have been terminated for cause. Organizations may consider disabling the accounts of individuals who are being terminated prior to the individuals being notified. This requirement applies to the reassignment or transfer of individuals when the personnel action is permanent or of such extended duration as to require protection. Protections that may be required for transfers or reassignments to other positions within organizations include returning old and issuing new identification cards, keys, and building passes; changing system access authorizations (i.e., privileges); closing system accounts and establishing new accounts; and providing access to official records to which individuals had access at previous work locations in previous system accounts.

References

Source controls: PS-04, PS-05
Supporting publications: None

 
Top of page 

3.10 Physical protection

The Physical protection controls support the control of physical access to systems, equipment, and the respective operating environments to authorized individuals. They facilitate the protection of the physical plant and support infrastructure for systems, the protection of systems against environmental hazards, and provide appropriate environmental controls in facilities containing systems.

03.10.01 Physical access authorizations

  1. Develop, approve, and maintain a list of individuals with authorized access to the physical location where the system resides
  2. Issue authorization credentials for physical access
  3. Review the physical access list [Assignment: organization-defined frequency]
  4. Remove individuals from the physical access list when access is no longer required
Discussion

A facility can include one or more physical locations containing systems or system components that process, store, or transmit specified information. Physical access authorizations apply to employees and visitors. Individuals with permanent physical access authorization credentials are not considered visitors. Authorization credentials include identification badges, identification cards, and smart cards. Organizations determine the strength of the authorization credentials consistent with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines. Physical access authorizations may not be necessary to access certain areas within facilities that are designated as publicly accessible.

References

Source control: PE-02
Supporting publications: None

03.10.02 Monitoring physical access

  1. Monitor physical access to the facility where the system resides to detect and respond to physical security incidents
  2. Review physical access logs [Assignment: organization-defined frequency] and upon occurrence of [Assignment: organization-defined events or potential indications of events]
Discussion

A facility can include one or more physical locations containing systems or system components that process, store, or transmit specified information. Physical access monitoring includes publicly accessible areas within organizational facilities. Examples of physical access monitoring include guards, video surveillance equipment (i.e., cameras), and sensor devices. Reviewing physical access logs can help identify suspicious activity, anomalous events, or potential threats. The reviews can be supported by audit logging controls if the access logs are part of an automated system. Incident response capabilities include investigations of physical security incidents and responses to those incidents. Incidents include security violations or suspicious physical access activities, such as access outside of normal work hours, repeated access to areas not normally accessed, access for unusual lengths of time, and out-of-sequence access.

References

Source control: PE-06
Supporting publications: None

03.10.03 Not allocated

Withdrawn by NIST.

03.10.04 Not allocated

Withdrawn by NIST.

03.10.05 Not allocated

Withdrawn by NIST.

03.10.06 Alternate work site

  1. Determine alternate work sites allowed for use by employees
  2. Employ the following security requirements at alternate work sites: [Assignment: organization-defined security requirements]
Discussion

Alternate work sites include the private residences of employees or other facilities designated by the organization. Alternate work sites can provide readily available alternate locations during contingency operations. Organizations can define different security requirements for specific alternate work sites or types of sites, depending on the work-related activities conducted at the sites. Assessing the effectiveness of the requirements and providing a means to communicate incidents at alternate work sites supports the contingency planning activities of organizations.

References

Source control: PE-17
Supporting publications:

03.10.07 Physical access control

  1. Enforce physical access authorizations at entry and exit points to the facility where the system resides by:
    1. verifying individual physical access authorizations before granting access to the facility
    2. controlling ingress and egress with physical access control systems, devices or guards
  2. Maintain physical access audit logs for entry or exit points
  3. Escort visitors and control visitor activity
  4. Secure keys, combinations, and other physical access devices
  5. Control physical access to output devices to prevent unauthorized individuals from obtaining access to specified information
Discussion

This requirement addresses physical locations containing systems or system components that process, store, or transmit specified information. Organizations determine the types of guards needed, including professional security staff or administrative staff. Physical access devices include keys, locks, combinations, biometric readers, and card readers. Physical access control systems comply with applicable laws, Orders in Council, directives, policies, regulations, standards, and guidelines. Organizations have flexibility in the types of audit logs employed. Audit logs can be procedural, automated, or some combination thereof. Physical access points can include exterior access points, interior access points to systems that require supplemental access controls, or both. Physical access control applies to employees and visitors. Individuals with permanent physical access authorizations are not considered visitors.

Controlling physical access to output devices includes placing output devices in locked rooms or other secured areas with keypad or card reader access controls and only allowing access to authorized individuals, placing output devices in locations that can be monitored by personnel, installing monitor or screen filters, and using headphones. Examples of output devices include monitors, printers, scanners, facsimile machines, audio devices, and copiers.

References

Source controls: PE-03, PE-05
Supporting publications: None

03.10.08 Access control for transmission

Control physical access to system distribution and transmission lines in organizational facilities.

Discussion

Safeguarding measures applied to system distribution and transmission lines prevent accidental damage, disruption, and physical tampering. Such measures may also be necessary to prevent eavesdropping or the modification of unencrypted transmissions. Safeguarding measures used to control physical access to system distribution and transmission lines include disconnected or locked spare jacks, locked wiring closets, protecting cabling with conduit or cable trays, and wiretapping sensors.

References

Source control: PE-04
Supporting publications: None

 
Top of page 

3.11 Risk assessment

The Risk assessment controls deal with the periodic conduct of risk assessments, including privacy impact assessments, resulting from the operation of organizational systems and associated handling, storage, or transmission of data and information.

03.11.01 Risk assessment

  1. Assess the risk (including supply chain risk) of unauthorized disclosure resulting from the handling, processing, storage, or transmission of specified information
  2. Update risk assessments [Assignment: organization-defined frequency]
Discussion

Establishing the system boundary is a prerequisite to assessing the risk of unauthorized disclosure of specified information. Risk assessments consider threats, vulnerabilities, likelihood, and adverse impacts to organizational operations and assets based on the operation and use of the system and the unauthorized disclosure of specified information. Risk assessments also consider risks from external parties (e.g., contractors operating systems on behalf of the organization, service providers, individuals accessing systems, and outsourcing entities). Risk assessments can be conducted at the organization level, the mission or business process level, or the system level and at any phase in the system development life cycle. Risk assessments include supply chain-related risks associated with suppliers or contractors and the system, system component, or system service that they provide.

References

Source controls: RA-03, RA-03(01), SR-06
Supporting publications:

03.11.02 Vulnerability monitoring and scanning

  1. Monitor and scan for vulnerabilities in the system [Assignment: organization-defined frequency] and when new vulnerabilities affecting the system are identified
  2. Remediate system vulnerabilities within [Assignment: organization-defined response times]
  3. Update system vulnerabilities to be scanned [Assignment: organization-defined frequency] and when new vulnerabilities are identified and reported
Discussion

Organizations determine the required vulnerability scanning for system components and ensure that potential sources of vulnerabilities (e.g., networked printers, scanners, and copiers) are not overlooked. Vulnerability analyses for custom software may require additional approaches, such as static analysis, dynamic analysis, or binary analysis. Organizations can use these approaches in source code reviews and tools (e.g., static analysis tools, web-based application scanners, binary analyzers). Vulnerability scanning includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for improperly configured or incorrectly operating flow control mechanisms.

To facilitate interoperability, organizations consider using scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention. Sources for vulnerability information also include the Common Weakness Enumeration (CWE) listing, the National Vulnerability Database (NVD), and the Common Vulnerability Scoring System (CVSS).

References

Source controls: RA-05, RA-05(02)
Supporting publications:

03.11.03 Not allocated

Withdrawn by NIST.

03.11.04 Risk response

Respond to findings from security assessments, monitoring, and audits.

Discussion

This requirement addresses the need to determine an appropriate response to risk before generating a plan of action and milestones (POAM) entry. It may be possible to mitigate the risk immediately so that a POAM entry is not needed. However, a POAM entry is generated if the risk response is to mitigate the identified risk and the mitigation cannot be completed immediately.

References

Source control: RA-07
Supporting publications:

 
Top of page 

3.12 Security assessment and monitoring

The Security assessment and monitoring controls deal with the security assessment and monitoring of the system.

03.12.01 Security assessment

Assess the security and privacy requirements for the system and its environment of operation [Assignment: organization-defined frequency] to determine if the requirements have been satisfied.

Discussion

By assessing the security and privacy requirements, organizations determine whether the necessary safeguards and countermeasures are implemented correctly, operating as intended, and producing the desired outcome. Security assessments identify weaknesses and deficiencies in the system and provide the essential information needed to make risk-based decisions. Security and privacy assessment reports document assessment results in sufficient detail as deemed necessary by the organization to determine the accuracy and completeness of the reports. Security assessment results are provided to the individuals or roles appropriate for the types of assessments being conducted.

References

Source control: CA-02
Supporting publications:

03.12.02 Plan of action and milestones

  1. Develop a plan of action and milestones (POAMs) for the system to:
    1. document the planned remediation actions to correct weaknesses or deficiencies noted during security assessments
    2. reduce or eliminate known system vulnerabilities
  2. Update the existing POAMs based on the findings from:
    1. security assessments
    2. audits or reviews
    3. continuous monitoring activities
Discussion

POAMs are important documents in organizational security and privacy programs. Organizations use POAMs to describe how unsatisfied security requirements will be met and how planned mitigations will be implemented. Organizations can document system security plans and POAMs as separate or combined documents and in any format.

References

Source control: CA-05
Supporting publications: Cyber Centre Organizational cyber security and privacy risk management activities (ITSP.10.036)

03.12.03 Continuous monitoring

Develop and implement a system-level continuous monitoring strategy that includes ongoing monitoring and security assessments.

Discussion

Continuous monitoring at the system level facilitates ongoing awareness of the system security and privacy posture to support risk management decisions. The terms "continuous" and "ongoing" imply that organizations assess and monitor their systems at a frequency that is sufficient to support risk-based decisions. Different types of security and privacy requirements may require different monitoring frequencies.

References

Source control: CA-07
Supporting publications:

03.12.04 Not allocated

Withdrawn by NIST.

03.12.05 Information exchange

  1. Approve and manage the exchange of specified information between the system and other systems using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; information sharing arrangements; service level agreements; user agreements; nondisclosure agreements]
  2. Document, as part of the exchange agreements, interface characteristics, security and privacy requirements, and responsibilities for each system
  3. Review and update the exchange agreements [Assignment: organization-defined frequency]
Discussion

Information exchange applies to information exchanges between two or more systems, both internal and external to the organization. Organizations consider the risks related to new or increased threats that may be introduced when systems exchange information with other systems that may have different security requirements or policies. The types of agreements selected are based on factors such as the relationship between the organizations exchanging information (e.g., government to government, government to business, business to business, government or business to service provider, government or business to individual) and the level of access to the organizational system by users of the other system. The types of agreements can include information exchange security agreements, interconnection security agreements, memoranda of understanding or agreement, information sharing arrangements, service-level agreements, or other types of agreements.

Organizations may incorporate agreement information into formal contracts, especially for information exchanges established between federal departments and agencies and non-federal organizations (e.g., service providers, contractors, system developers, and system integrators). The types of information contained in exchange agreements include the interface characteristics, security and privacy requirements, controls, and responsibilities for each system.

References

Source control: CA-03
Supporting publications:

 
Top of page 

3.13 System and communications protection

The System and communications protection controls support the monitoring, control and protection of the systems themselves and of the communications between and within the systems.

03.13.01 Boundary protection

  1. Monitor and control communications at the external managed interfaces to the system and key internal managed interfaces within the system
  2. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
  3. Connect to external systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture
Discussion

Managed interfaces include gateways, routers, firewalls, network-based malicious code analysis, virtualization systems, and encrypted tunnels implemented within a security architecture. Subnetworks that are either physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting both internal and external address spoofing for protocols crossing the boundary.

References

Source control: SC-07
Supporting publications:

03.13.02 Not allocated

Withdrawn by NIST.

03.13.03 Not allocated

Withdrawn by NIST.

03.13.04 Information in shared system resources

Prevent unauthorized and unintended information transfer via shared system resources.

Discussion

Preventing unauthorized and unintended information transfer via shared system resources stops information produced by the actions of prior users or roles (or actions of processes acting on behalf of prior users or roles) from being available to current users or roles (or current processes acting on behalf of current users or roles) that obtain access to shared system resources after those resources have been released back to the system. Information in shared system resources also applies to encrypted representations of information. In other contexts, the control of information in shared system resources is referred to as object reuse and residual information protection. Information in shared system resources does not address information remanence, which refers to the residual representation of data that has been nominally deleted, covert channels (including storage and timing channels) in which shared system resources are manipulated to violate information flow restrictions, or components within systems for which there are only single users or roles.

References

Source control: SC-04
Supporting publications: None

03.13.05 Not allocated

Withdrawn by NIST.

03.13.06 Network communications – deny by default – allow by exception

Deny network communications traffic by default and allow network communications traffic by exception.

Discussion

This requirement applies to inbound and outbound network communications traffic at the system boundary and at identified points within the system. A deny-all, allow-by-exception network communications traffic policy ensures that only essential and approved connections are allowed.

References

Source control: SC-07(05)
Supporting publications:

03.13.07 Not allocated

Withdrawn by NIST.

03.13.08 Transmission and storage confidentiality

Implement cryptographic mechanisms to prevent the unauthorized disclosure of specified information during transmission and while in storage.

Discussion

This requirement applies to internal and external networks and any system components that can transmit specified information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are susceptible to interception and modification. Encryption protects specified information from unauthorized disclosure during transmission and while in storage. Cryptographic mechanisms that protect the confidentiality of specified information during transmission include TLS and IPsec. Information in storage (i.e., information at rest) refers to the state of specified information when it is not in process or in transit and resides on internal or external storage devices, storage area network devices, and databases. Protecting specified information in storage does not focus on the type of storage device or the frequency of access to that device but rather on the state of the information. This requirement relates to Cryptographic protection 03.13.11.

References

Source controls: SC-08, SC-08(01), SC-28, SC-28(01)
Supporting publications:

03.13.09 Network disconnect

Terminate network connections associated with communications sessions at the end of the sessions or after [Assignment: organization-defined time period] of inactivity.

Discussion

This requirement applies to internal and external networks. Terminating network connections associated with communications sessions includes deallocating TCP/IP addresses or port pairs at the operating system level or deallocating networking assignments at the application level if multiple application sessions are using a single network connection. Time periods of inactivity may be established by organizations and include time periods by type of network access or for specific network accesses.

References

Source control: SC-10
Supporting publications: None

03.13.10 Cryptographic key establishment and management

Establish and manage cryptographic keys in the system in accordance with the following key management requirements: [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].

Discussion

Cryptographic keys can be established and managed using either manual procedures or automated mechanisms supported by manual procedures. Organizations satisfy key establishment and management requirements in accordance with applicable federal laws, Orders in Council, policies, directives, regulations, and standards that specify appropriate options, levels, and parameters. This requirement is related to Cryptographic protection 03.13.11.

References

Source control: SC-12
Supporting publications:

03.13.11 Cryptographic protection

Implement the following types of cryptography when used to protect the confidentiality of specified information: [Assignment: organization-defined types of cryptography].

Discussion

Cryptography is implemented in accordance with applicable laws, Orders in Council, directives, regulations, policies, standards, and guidelines. Federal information processing standard (FIPS)-validated cryptography is recommended for the protection of specified information.

References

Source control: SC-13
Supporting publications: NIST FIPS 140-3 Security Requirements for Cryptographic Modules

03.13.12 Collaborative computing devices and applications

  1. Prohibit remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: organization-defined exceptions where remote activation is to be allowed]
  2. Provide an explicit indication of use to users physically present at the devices
Discussion

Collaborative computing devices include white boards, microphones, and cameras. Notebook computers, smartphones, display monitors, and tablets containing cameras and microphones are considered part of collaborative computing devices when conferencing software is in use. Indication of use includes notifying users (e.g., a pop-up menu stating that recording is in progress, or that the microphone has been turned on) when collaborative computing devices are activated. Dedicated video conferencing systems, which typically rely on one of the participants calling or connecting to the other party to activate the video conference, are excluded. Solutions to prevent device usage include webcam covers and buttons to disable microphones.

References

Source control: SC-15
Supporting publications: None

03.13.13 Mobile code

  1. Define acceptable mobile code and mobile code technologies
  2. Authorize, monitor, and control the use of mobile code
Discussion

Mobile code includes software programs or parts of programs that are obtained from remote systems, transmitted across a network, and executed on a local system without explicit installation or execution by the recipient. Decisions regarding the use of mobile code are based on the potential for the code to cause damage to the system if used maliciously. Mobile code technologies include Java applets, JavaScript, HTML5, VBScript, and WebGL. Usage restrictions and implementation guidelines apply to the selection and use of mobile code installed on servers and mobile code downloaded and executed on individual workstations and devices, including notebook computers, smart phones, and smart devices. Mobile code policies and procedures address the actions taken to prevent the development, acquisition, and use of unacceptable mobile code within the system, including requiring mobile code to be digitally signed by a trusted source.

References

Source control: SC-18
Supporting publications: NIST SP 800-28 Guidelines on Active Content and Mobile Code

03.13.14 Not allocated

Withdrawn by NIST.

03.13.15 Session authenticity

Protect the authenticity of communications sessions.

Discussion

Protecting session authenticity addresses communications protection at the session level, not at the packet level. Such protection establishes grounds for confidence at both ends of the communications sessions in the ongoing identities of other parties and the validity of the transmitted information. Authenticity protection includes protecting against adversary-in-the-middle attacks, session hijacking, and the insertion of false information into sessions.

References

Source control: SC-23
Supporting publications:

03.13.16 Not allocated

Withdrawn by NIST.

 
Top of page 

3.14 System and information integrity

The System and information integrity controls support the protection of the integrity of the system components and the data that it processes. They allow an organization to identify, report and correct data and system flaws in a timely manner, to provide protection against malicious code, and to monitor system security alerts and advisories, and to take appropriate actions in response.

03.14.01 Flaw remediation

  1. Identify, report, and correct system flaws
  2. Install security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates
Discussion

Organizations identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities that result from those flaws, and report this information to designated personnel with information security and privacy responsibilities. Security-relevant updates include patches, service packs, hot fixes, and anti-virus signatures. Organizations address the flaws discovered during security assessments, continuous monitoring, incident response activities, and system error handling. Organizations can take advantage of available resources (e.g., CWE or CVE databases) when remediating system flaws. Organization-defined time periods for updating security-relevant software and firmware may vary based on a variety of factors, including the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). Some types of flaw remediation may require more testing than other types.

References

Source control: SI-02
Supporting publications:

03.14.02 Malicious code protection

  1. Implement malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code
  2. Update malicious code protection mechanisms as new releases are available in accordance with configuration management policies and procedures
  3. Configure malicious code protection mechanisms to:
    1. perform scans of the system [assignment: organization-defined frequency] and real-time scans of files from external sources at endpoints or system entry and exit points as the files are downloaded, opened, or executed
    2. block or quarantine malicious code, or take other mitigation actions in response to malicious code detection
Discussion

Malicious code insertions occur through the exploitation of system vulnerabilities. Malicious code can be inserted into the system in a variety of ways, including email, the Internet, and portable storage devices. Malicious code includes viruses, worms, Trojan horses, and spyware. Malicious code can be encoded in various formats, contained in compressed or hidden files, or hidden in files using techniques such as steganography. Malicious code may be present in commercial off-the-shelf software and custom-built software and could include logic bombs, backdoors, and other types of attacks that could affect organizational mission and business functions. Periodic scans of the system and real-time scans of files from external sources as files are downloaded, opened, or executed can detect malicious code. Malicious code protection mechanisms can also monitor systems for anomalous or unexpected behaviours and take appropriate actions.

Malicious code protection mechanisms include signature- and non-signature-based technologies. Non-signature-based detection mechanisms include artificial intelligence (AI) techniques that use heuristics to detect, analyze, and describe the characteristics or behaviour of malicious code. They also provide controls against such code for which signatures do not yet exist or for which existing signatures may not be effective. Malicious code for which active signatures do not yet exist or may be ineffective includes polymorphic malicious code (i.e., code that changes signatures when it replicates). Non-signature-based mechanisms include reputation-based technologies. Pervasive configuration management, anti-exploitation software, and software integrity controls may also be effective in preventing unauthorized code execution.

If malicious code cannot be detected by detection methods or technologies, organizations can rely on secure coding practices, configuration management and control, trusted procurement processes, and monitoring practices to help ensure that the software only performs intended functions. Organizations may determine that different actions are warranted in response to the detection of malicious code. For example, organizations can define actions to be taken in response to the detection of malicious code during scans, malicious downloads, or malicious activity when attempting to open or execute files.

References

Source control: SI-03
Supporting publications:

03.14.03 Security alerts, advisories, and directives

  1. Receive system security alerts, advisories, and directives from external organizations on an ongoing basis
  2. Generate and disseminate internal system security alerts, advisories, and directives, as necessary
Discussion

There are many publicly available sources of system security alerts and advisories. For example, the Canadian Centre for Cyber Security (Cyber Centre) generates security alerts and advisories to maintain situational awareness across the GC and in non-GC organizations. Software vendors, subscription services, and industry Information Sharing and Analysis Centres (ISACs) may also provide security alerts and advisories. Compliance with security directives is essential due to the critical nature of many of these directives and the potential immediate adverse effects on organizational operations and assets, individuals, other organizations, and Canada should the directives not be implemented in a timely manner.

References

Source control: SI-05
Supporting publications: NIST SP 800-161 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

03.14.04 Not allocated

Withdrawn by NIST.

03.14.05 Not allocated

Withdrawn by NIST.

03.14.06 System monitoring

  1. Monitor the system to detect:
    1. attacks and indicators of potential attacks
    2. unauthorized connections
  2. Identify unauthorized use of the system
  3. Monitor inbound and outbound communications traffic to detect unusual or unauthorized activities or conditions
Discussion

System monitoring involves external and internal monitoring. Internal monitoring includes the observation of events that occur within the system. External monitoring includes the observation of events that occur at the system boundary. Organizations can monitor the system by observing audit record activities in real time or by observing other system aspects, such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events.

A system monitoring capability is achieved through a variety of tools and techniques (e.g., audit record monitoring software, intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, network monitoring software). Strategic locations for monitoring devices include selected perimeter locations and near server farms that support critical applications with such devices being employed at managed system interfaces. The granularity of monitoring the information collected is based on organizational monitoring objectives and the capability of the system to support such objectives.

Systems connections can be network, remote, or local. A network connection is any connection with a device that communicates through a network (e.g., local area network, the Internet). A remote connection is any connection with a device that communicates through an external network (e.g., the Internet). Network, remote, and local connections can be either wired or wireless.

Unusual or unauthorized activities or conditions related to inbound and outbound communications traffic include internal traffic that indicates the presence of malicious code in the system or propagating among system components, the unauthorized export of information, or signaling to external systems. Evidence of malicious code is used to identify a potentially compromised system. System monitoring requirements, including the need for types of system monitoring, may be referenced in other requirements.

References

Source controls: SI-04, SI-04(04)
Supporting publications:

03.14.07 Not allocated

Withdrawn by NIST.

03.14.08 Information management and retention

Manage and retain specified information within the system and specified information output from the system in accordance with applicable laws, Orders in Council, directives, regulations, policies, standards, guidelines, and operational requirements.

Discussion

Federal departments and agencies consider data retention requirements for non-federal organizations. Retaining specified information on non-federal systems after contracts or agreements have concluded increases the attack surface for those systems and the risk of the information being compromised. The Library and Archives Canada provides federal policy and guidance on records retention and schedules.

References

Source control: SI-12
Supporting publications: None

03.14.09 Dedicated administration workstation

  1. Require any administrative or superuser actions to be performed from a physical workstation which is dedicated to those specific tasks and isolated from all other functions and networks, and especially from any form of internet access
  2. Remote connection of a DAW to a target network is to use carrier private networks (e.g., virtual private LAN service (VPLS) or multiprotocol label switching (MPLS)) with VPN encryption
  3. Use a dedicated and hardened single-purpose physical workstation or thin client as the DAW, that is not shared between security realms
Discussion

A dedicated administration workstation (DAW) is typically comprised of a user terminal with a very small selection of software designed for interfacing with the target system. For the purpose of this control, workstation means the system from which you are performing the administration, as opposed to the target system of administration. The DAW must be hardened for the role, in order to minimize the likelihood that a superuser’s or administrator’s endpoint may be compromised by any threat actor (which would logically lead to the compromise of the target system). Typical office productivity tools are not required on the DAW. All non-essential applications and services are removed. DAWs are not domain-joined, cannot download patches from the internet, and cannot update documentation in networked applications.

Removing public Internet access from administrative workstations substantially reduces risk of compromise. Internet-exposed VPN gateways are not preferred for remote administration, private carriers provide better protection, but still require VPN encryption within that network. The DAW must not become a means of moving laterally between security realms.

References

Source controls: SI-400, SI-400(02), SI-400(05)
Supporting publications: None

 
Top of page 

3.15 Planning

The Planning controls and assurance activities deal with the development, documentation, update, and implementation of security and privacy plans for organizational systems. Those plans describe the security and privacy controls and assurance activities in place or planned for the systems, and the rules of behaviour for individuals accessing the systems.

03.15.01 Policy and procedures

  1. Develop, document, and disseminate to organizational personnel or roles, policies and procedures needed to satisfy the security requirements for the protection of specified information
  2. Review and update policies and procedures [Assignment: organization-defined frequency]
Discussion

This requirement addresses policies and procedures for the protection of specified information. Policies and procedures contribute to security assurance and should address each family of the specified information security requirements. Policies can be included as part of the organizational security policy or be represented by separate policies that address each family of requirements. Procedures describe how policies are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security plans or in one or more separate documents.

References

Source controls: AC-01, AT-01, AU-01, CA-01, CM-01, IA-01, IR-01, MA-01, MP-01, PE-01, PL-01, PS-01, RA-01, SA-01, SC-01, SI-01, SR-01
Supporting publications:

03.15.02 System security plan

  1. Develop a system security and privacy plan that:
    1. defines the constituent system components
    2. identifies the information types processed, stored, and transmitted by the system
    3. describes specific threats to the system that are of concern to the organization
    4. describes the operational environment for the system and any dependencies on or connections to other systems or system components
    5. provides an overview of the security requirements for the system
    6. describes the safeguards in place or planned for meeting the security requirements
    7. identifies individuals that fulfill system roles and responsibilities
    8. includes other relevant information necessary for the protection of specified information
  2. Review and update the system security plan [Assignment: organization-defined frequency]
  3. Protect the system security plan from unauthorized disclosure
Discussion

System security and privacy plans provide key characteristics of the system that is processing, storing, and transmitting specified information and how the system and information are protected. System security and privacy plans contain sufficient information to facilitate a design and implementation that are unambiguously compliant with the intent of the plans and the subsequent determinations of risk if the plan is implemented as intended. System security and privacy plans can be a collection of documents, including documents that already exist. Effective system security plans make use of references to policies, procedures, and additional documents (e.g., design specifications) where detailed information can be obtained. This reduces the documentation requirements associated with security programs and maintains security information in other established management or operational areas related to enterprise architecture, the system development life cycle, systems engineering, and acquisition.

References

Source control: PL-02
Supporting publications:

03.15.03 Rules of behaviour

  1. Establish, rules that describe the responsibilities and expected behaviour for system usage and protecting specified information
  2. Provide rules to individuals who require access to the system
  3. Receive a documented acknowledgement from individuals indicating that they have read, understand, and agree to abide by the rules of behaviour before authorizing access to specified information and the system
  4. Review and update the rules of behaviour [Assignment: organization-defined frequency]
Discussion

Rules of behaviour represent a type of access agreement for system users. Organizations consider rules of behaviour for the handling of specified information based on individual user roles and responsibilities and differentiate between rules that apply to privileged users and rules that apply to general users.

References

Source control: PL-04
Supporting publications:

 
Top of page 

3.16 System and services acquisition

The System and services acquisition controls deal with the contracting of products and services required to support the implementation and operation of organizational systems. They ensure that sufficient resources are allocated for the protection of organizational systems, and they support system development lifecycle processes that incorporate security considerations.

03.16.01 Security engineering principles

Apply the following systems security engineering principles to the development or modification of the system and system components: [Assignment: organization-defined systems security engineering principles].

Discussion

Organizations apply systems security engineering principles to new development systems. For legacy systems, organizations apply systems security engineering principles to system modifications to the extent feasible, given the current state of hardware, software, and firmware components. The application of systems security engineering principles helps to develop trustworthy, secure, and resilient systems and reduce the susceptibility of organizations to disruptions, hazards, and threats. Examples include developing layered protections; establishing security policies, architectures, and controls as the foundation for system design; incorporating security requirements into the system development life cycle; delineating physical and logical security boundaries; ensuring that developers are trained on how to build trustworthy secure software; and performing threat modeling to identify use cases, threat agents, attack vectors and patterns, design patterns, and compensating controls needed to mitigate risk. Organizations that apply security engineering principles can facilitate the development of trustworthy, secure systems, system components, and system services; reduce risks to acceptable levels; and make informed risk-management decisions.

References

Source control: SA-08
Supporting publications:

03.16.02 Unsupported system components

  1. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer
  2. Provide options for risk mitigation or alternative sources for continued support for unsupported components if components cannot be replaced
Discussion

Support for system components includes software patches, firmware updates, replacement parts, and maintenance contracts. An example of unsupported components includes when vendors no longer provide critical software patches or product updates, which can result in opportunities for adversaries to exploit weaknesses or deficiencies in the installed components. Exceptions to replacing unsupported system components include systems that provide critical mission or business capabilities when newer technologies are unavailable or when the systems are so isolated that installing replacement components is not an option.

Alternative sources of support address the need to provide continued support for system components that are no longer supported by the original manufacturers, developers, or vendors when such components remain essential to organizational mission and business functions. If necessary, organizations can establish in-house support by developing customized patches for critical software components or obtain the services of external providers who provide ongoing support for unsupported components through contractual relationships. Such contractual relationships can include open-source software value-added vendors. The increased risk of using unsupported system components can be mitigated by prohibiting the connection of such components to public or uncontrolled networks or implementing other forms of isolation.

References

Source control: SA-22
Supporting publications: None

03.16.03 External system services

  1. Require the providers of external system services used for the processing, storage, or transmission of specified information, to comply with the following security requirements: [Assignment: organization-defined security requirements]
  2. Define and document user roles and responsibilities with regard to external system services including shared responsibilities with external service providers
  3. Implement processes, methods, and techniques to monitor security requirement compliance by external service providers on an ongoing basis
Discussion

External system services are provided by external service providers. Organizations establish relationships with external service providers in a variety of ways, including through business partnerships, contracts, interagency agreements, lines of business arrangements, licensing agreements, joint ventures, and supply chain exchanges. The responsibility for managing risks from the use of external system services remains with the organization charged with protecting specified information. Service-level agreements define expectations of performance, describe measurable outcomes, and identify remedies, mitigations, and response requirements for instances of noncompliance. Information from external service providers regarding the specific functions, ports, protocols, and services used in the provision of such services can be useful when there is a need to understand the trade-offs involved in restricting certain functions and services or blocking certain ports and protocols. This requirement is related to Use of external systems 03.01.20.

References

Source control: SA-09
Supporting publications:

 
Top of page 

3.17 Supply chain risk management

The Supply chain risk management controls support the mitigation of cyber security risks throughout all phases of the supply chain.

03.17.01 Supply chain risk management plan

  1. Develop a plan for managing supply chain risks associated with the research, development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of the system, system components, or system services
  2. Review and update the supply chain risk management plan [Assignment: organization-defined frequency]
  3. Protect the supply chain risk management plan from unauthorized disclosure
Discussion

Dependence on the products, systems, and services of external providers and the nature of the relationships with those providers present an increasing level of risk to an organization. Threat actions that may increase security or privacy risks include unauthorized production, the insertion or use of counterfeits, tampering, poor manufacturing and development practices in the supply chain, theft, and the insertion of malicious software, firmware, and hardware. Supply chain risks can be endemic or systemic within a system, component, or service. Managing supply chain risks is a complex, multifaceted undertaking that requires a coordinated effort across an organization to build trust relationships and communicate with internal and external stakeholders.

Supply chain risk management (SCRM) activities include identifying and assessing risks, determining appropriate risk response actions, developing SCRM plans to document response actions, and monitoring performance against the plans. The system-level SCRM plan is implementation-specific and provides policy implementation, requirements, constraints, and implications. It can either be stand-alone or incorporated into system security and privacy plans. The SCRM plan addresses the management, implementation, and monitoring of SCRM controls and the development or sustainment of systems across the system development life cycle to support mission and business functions. Because supply chains can differ significantly across and within organizations, SCRM plans are tailored to individual program, organizational, and operational contexts.

References

Source control: SR-02
Supporting publications:

03.17.02 Acquisition strategies, tools, and methods

Develop and implement acquisition strategies, contract tools, and procurement methods to identify, protect against, and mitigate supply chain risks.

Discussion

The acquisition process provides an important vehicle for protecting the supply chain. There are many useful tools and techniques available, including obscuring the end use of a system or system component, using blind purchases, requiring tamper-evident packaging, or using trusted or controlled distribution. The results from a supply chain risk assessment can inform the strategies, tools, and methods that are most applicable to the situation. Tools and techniques may provide protections against unauthorized production, theft, tampering, the insertion of counterfeits, the insertion of malicious software or backdoors, and poor development practices throughout the system life cycle.

Organizations also consider providing incentives for suppliers to implement controls, promote transparency in their processes and security practices, provide contract language that addresses the prohibition of tainted or counterfeit components, and restrict purchases from untrustworthy suppliers. Organizations consider providing training, education, and awareness programs for personnel regarding supply chain risks, available mitigation strategies, and when the programs should be employed. Methods for reviewing and protecting development plans, documentation, and evidence are commensurate with the security requirements of the organization. Contracts may specify documentation protection requirements.

References

Source control: SR-05
Supporting publications:

03.17.03 Supply chain requirements and processes

  1. Establish a process for identifying and addressing weaknesses or deficiencies in the supply chain elements and processes
  2. Enforce the following security requirements to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences from supply chain-related events: [Assignment: organization-defined security requirements]
Discussion

Supply chain elements include organizations, entities, or tools that are employed for the research, development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal of systems and system components. Supply chain processes include hardware, software, firmware, and systems development processes; shipping and handling procedures; physical security programs; personnel security programs; configuration management tools, techniques, and measures to maintain provenance; or other programs, processes, or procedures associated with the development, acquisition, maintenance, and disposal of systems and system components. Supply chain elements and processes may be provided by organizations, system integrators, or external providers. Weaknesses or deficiencies in supply chain elements or processes represent potential vulnerabilities that can be exploited by adversaries to harm the organization and affect its ability to carry out its core missions or business functions.

References

Source control: SR-03
Supporting publications:

 
Top of page 

Annex A Tailoring criteria

In this section

This appendix describes the security control tailoring criteria used to develop the specified information security requirements. Table 1 through Table 20 specify the tailoring actions applied to the controls in the ITSP.10.033-01 medium impact baseline to obtain the security requirements in section 3. The controls, assurances activities and enhancements are hyperlinked to their corresponding entry in ITSP.10.033.

The security control tailoring criteria are the following:

  • NCO: the control is not directly related to protecting the confidentiality of specified information
  • GC: the control is primarily the responsibility of the Government of Canada
  • ORC: the outcome of the control related to protecting the confidentiality of specified information is adequately covered by other related controls
  • N/A: the control is not applicable
  • C: the control is directly related to protecting the confidentiality of specified information
Table 1: Access control (AC)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
AC-01 Access control policy and procedures  C Policy and procedures 03.15.01
AC-02 Account management C Account management 03.01.01
AC-02(01) Account management: Automated system account management NCO none
AC-02(02) Account management: Automated temporary and emergency account management NCO none
AC-02(03) Account management: Disable accounts C Account management 03.01.01
AC-02(04) Account management: Automated audit actions NCO none
AC-02(05) Account management: Inactivity logout C Account management 03.01.01
AC-02(07) Account management: Privileged user accounts NCO none
AC-02(13) Account management: Disable accounts for high-risk individuals C Account management 03.01.01
AC-03 Access enforcement C Access enforcement 03.01.02
AC-03(02) Access enforcement: Dual authorization NCO none
AC-03(04) Access enforcement: Discretionary access control ORC none
AC-03(09) Access enforcement: Controlled release ORC none
AC-04 Information flow enforcement C Information flow enforcement 03.01.03
AC-05 Separation of duties C Separation of duties 03.01.04
AC-06 Least privilege C Least privilege 03.01.05
AC-06(01) Least privilege: Authorize access to security functions C Least privilege 03.01.05
AC-06(02) Least privilege: Non-privileged access for non-security functions C Least privilege - privileged accounts 03.01.06
AC-06(05) Least privilege: Privileged accounts C Least privilege - privileged accounts 03.01.06
AC-06(07) Least privilege: Review of user privileges C Least privilege 03.01.05
AC-06(09) Least privilege: Log use of privileged functions C Privileged accounts - privileged functions 03.01.07
AC-06(10) Least privilege: Prohibit non-privileged users from executing privileged functions C Privileged accounts - privileged functions 03.01.07
AC-07 Unsuccessful logon attempts C Unsuccessful logon attempts 03.01.08
AC-08 System use notification C System use notification 03.01.09
AC-11 Device lock C Device lock 03.01.10
AC-11(01) Device lock: Pattern-hiding displays C Device lock 03.01.10
AC-12 Session termination C Session termination 03.01.11
AC-14 Permitted actions without identification or authentication GC none
AC-16 Security and privacy attributes ORC none
AC-16(02) Security and privacy attributes: Attribute value changes by authorized individuals ORC none
AC-16(05) Security and privacy attributes: Attribute displays on objects to be output ORC none
AC-17 Remote access C Access enforcement 03.01.02
AC-17(01) Remote access: Monitoring and control NCO none
AC-17(02) Remote access: Protection of confidentiality and integrity using encryption C Transmission and storage confidentiality 03.13.08
AC-17(03) Remote access: Managed access control points C Remote access 03.01.12
AC-17(04) Remote access: Privileged commands and access C Remote access 03.01.12
AC-17(400) Remote access: Privileged accounts remote access ORC none
AC-18 Wireless access C Wireless access 03.01.16
AC-18(01) Wireless access: Authentication and encryption C Wireless access 03.01.16
AC-18(03) Wireless access: Disable wireless networking C Wireless access 03.01.16
AC-18(04) Wireless access: Restrict configurations by users ORC none
AC-19 Access control for mobile devices C Access control for mobile devices 03.01.18
AC-19(05) Access control for mobile devices: Full device or container-based encryption C Access control for mobile devices 03.01.18
AC-20 Use of external systems C Use of external systems 03.01.20
AC-20(01) Use of external systems: Limits on authorized use C Use of external systems 03.01.20
AC-20(02) Use of external systems: Portable storage devices – restricted use C Use of external systems 03.01.20
AC-20(04) Use of external systems: Network accessible storage devices – restricted use ORC none
AC-21 Information sharing GC none
AC-21(400) Information sharing: Information sharing agreement GC none
AC-21(401) Information sharing: Information sharing arrangement GC none
AC-22 Publicly accessible content C Publicly accessible content 03.01.22
 
Top of page 
Table 2: Awareness and training
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
AT-01 Awareness and training policy and procedures C Policy and procedures 03.15.01
AT-02 Literacy training and awareness C Literacy training and awareness 03.02.01
AT-02(02) Literacy training and awareness: Insider threat C Literacy training and awareness 03.02.01
AT-02(03) Literacy training and awareness: Social engineering and mining C Literacy training and awareness 03.02.01
AT-03 Role-based training C Role-based training 03.02.02
AT-04 Training records NCO none
 
Top of page 
Table 3: Audit and accountability
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
AU-01 Audit and accountability policy and procedures C Policy and procedures 03.15.01
AU-02 Event logging C Event logging 03.03.01
AU-03 Content of audit records C Audit record content 03.03.02
AU-03(01) Additional audit information C Audit record content 03.03.02
AU-04 Audit log storage capacity NCO none
AU-04(01) Audit log storage capacity: Transfer to alternate storage NCO none
AU-05 Response to audit logging process failures C Response to audit logging process failures 03.03.04
AU-05(01) Response to audit logging process failures: Storage capacity warning NCO none
AU-06 Audit record review, analysis, and reporting C Audit record review, analysis, and reporting 03.03.05
AU-06(01) Audit record review, analysis, and reporting: Automated process integration NCO none
AU-06(03) Audit record review, analysis, and reporting: Correlate audit record repositories C Audit record review, analysis, and reporting 03.03.05
AU-06(04) Audit record review, analysis, and reporting: Central review and analysis NCO none
AU-07 Audit record reduction and report generation C Audit record reduction and report generation 03.03.06
AU-07(01) Audit record reduction and report generation: Automatic processing NCO none
AU-08 Time stamps C Time stamps 03.03.07
AU-09 Protection of audit information C Protection of audit information 03.03.08
AU-09(02) Protection of audit information: Store on separate physical system or component NCO none
AU-09(04) Protection of audit information: Access by subset of privileged users C Protection of audit information 03.03.08
AU-09(06) Protection of audit information: Read-only access NCO none
AU-11 Audit record retention C Audit record generation 03.03.03
AU-12 Audit record generation C Audit record generation 03.03.03
AU-12(01) Audit record generation: System-wide and time-correlated audit trail NCO none
 
Top of page 
Table 4: Assessment, authorization, and monitoring (CA)
Control / activity number TSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
CA-01 Assessment, authorization, and monitoring policy and procedures C Policy and procedures 03.15.01
CA-02 Control assessments C Security assessment 03.12.01
CA-02(01) Control assessments: Independent assessors NCO none
CA-03 Information exchange C Information exchange 03.12.05
CA-05 Plan of action and milestones C Plan of action and milestones 03.12.02
CA-06 Authorization GC none
CA-07 Continuous monitoring C Continuous monitoring 03.12.03
CA-07(01) Continuous monitoring: Independent assessment NCO none
CA-07(04) Continuous monitoring: Risk monitoring NCO none
CA-09 Internal system connections NCO none
CA-09(01) Internal system connections: Compliance checks ORC none
 
Top of page 
Table 5: Configuration management (CM)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
CM-01 Configuration management policy and procedures C Policy and procedures 03.15.01
CM-02 Baseline configuration C Baseline configuration 03.04.01
CM-02(02) Baseline configuration: Automation support for accuracy and currency NCO none
CM-02(03) Baseline configuration: Retention of previous configurations NCO none
CM-02(06) Baseline configuration: Development and test environments NCO none
CM-02(07) Baseline configuration: Configure systems and components for high-risk areas C System and component configuration for high-risk areas 03.04.12
CM-03 Configuration change control C Configuration change control 03.04.03
CM-03(02) Configuration change control: Testing, validation, and documentation of changes NCO none
CM-03(04) Configuration change control: Security and privacy representatives NCO none
CM-04 Impact analyses C Impact analyses 03.04.04
CM-04(01) Impact analyses: Separate test environments NCO none
CM-04(02) Impact analyses: Verification of controls C Impact analyses 03.04.04
CM-05 Access restrictions for change C Access restrictions for change 03.04.05
CM-06 Configuration settings C Configuration settings 03.04.02
CM-07 Least functionality C Least functionality 03.04.06
CM-07(01) Least functionality: Periodic review C Least functionality 03.04.06
CM-07(02) Least functionality: Prevent program execution ORC none
CM-07(05) Least functionality: Authorized software – allow by exception C Authorized software - allow by exception 03.04.08
CM-08 System component inventory C System component inventory 03.04.10
CM-08(01) System component inventory: Updates during installation and removal C System component inventory 03.04.10
CM-08(03) System component inventory: Automated unauthorized component detection NCO none
CM-08(04) System component inventory: Accountability information NCO none
CM-08(06) System component inventory: Assessed configurations and approved deviations NCO none
CM-09 Configuration management plan NCO none
CM-10 Software usage restrictions NCO none
CM-11 User-installed software ORC none
CM-11(02) User-installed software: Software installation with privileged status ORC none
CM-12 Information location C Information location 03.04.11
CM-12(01) Information location: Automated tools to support information location NCO none
 
Top of page 
Table 6: Contingency planning (CP)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
CP-01 Contingency planning policy and procedures NCO none
CP-02 Contingency plan NCO none
CP-02(01) Contingency plan: Coordinate with related plans NCO none
CP-02(02) Contingency plan: Capacity planning NCO none
CP-02(03) Contingency plan: Resume mission and business functions NCO none
CP-02(08) Contingency plan: Identify critical assets NCO none
CP-03 Contingency training NCO none
CP-04 Contingency plan testing NCO none
CP-04(01) Contingency plan testing: Coordinate related plans NCO none
CP-06 Alternate storage site NCO none
CP-06(01) Alternate storage site: Separation of primary site NCO none
CP-06(03) Alternate storage site: Accessibility NCO none
CP-07 Alternate processing site NCO none
CP-07(01) Alternate processing site: Separation of primary site NCO none
CP-07(02) Alternate processing site: Accessibility NCO none
CP-07(03) Alternate processing site: Priority of service NCO none
CP-07(04) Alternate processing site: Preparation for use NCO none
CP-07(06) Alternate processing site: Inability to return to primary site NCO none
CP-08 Telecommunications services NCO none
CP-08(01) Telecommunications services: Priority of service provisions NCO none
CP-08(02) Telecommunications services: Single points of failure NCO none
CP-08(03) Telecommunications services: Separation of primary and alternate providers NCO none
CP-08(05) Telecommunications services: Alternate telecommunication service testing NCO none
CP-09 System backup C System backup - cryptographic protection 03.08.09
CP-09(01) System backup: Testing for reliability and integrity NCO none
CP-09(03) System backup: Separate storage for critical information NCO none
CP-09(05) System backup: Transfer to alternate storage site NCO none
CP-09(07) System backup: Dual authorization for deletion or destruction NCO none
CP-09(08) System backup: Cryptographic protection C System backup - cryptographic protection 03.08.09
CP-10 System recovery and reconstitution NCO none
CP-10(02) System recovery and reconstitution: Transaction recovery NCO none
CP-10(04) System recovery and reconstitution: Restore within time period NCO none
CP-10(06) System recovery and reconstitution: Component protection NCO none
 
Top of page 
Table 7: Identification and Authentication (IA)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
IA-01 Identification and authentication policy and procedures C Policy and procedures 03.15.01
IA-02 Identification and authentication (organizational users) C User identification, authentication, and re-authentication 03.05.01
IA-02(01) Identification and authentication (organizational users): Multi-factor authentication to privileged accounts C Multi-factor authentication 03.05.03
IA-02(02) Identification and authentication (organizational users): Multi-factor authentication to non-privileged accounts C Multi-factor authentication 03.05.03
IA-02(08) Identification and authentication (organizational users): Access to accounts – replay resistant C Replay-resistant authentication 03.05.04
IA-02(10) Identification and authentication (organizational users): Single sign-on NCO none
IA-02(12) Identification and authentication (organizational users): Use of hardware token GC-issued PKI-based credentials GC none
IA-03 Device identification and authentication C Device identification and authentication 03.05.02
IA-04 Identifier management C Identifier management 03.05.05
IA-04(04) Identifier management: Identify user status C Identifier management 03.05.05
IA-05 Authenticator management C Authenticator management 03.05.12
IA-05(01) Authenticator management: Password-based authentication C Password management 03.05.07
IA-05(02) Authenticator management: Public key-based authentication GC none
IA-05(06) Authenticator management: Protection of authenticators GC none
IA-05(07) Authenticator management: No embedded unencrypted static authenticators NCO none
IA-05(08) Authenticator management: Multiple system accounts NCO none
IA-05(09) Authenticator management: Federated credential management GC none
IA-05(13) Authenticator management: Expiration of cached authenticators ORC none
IA-05(14) Authenticator management: Managing content of PKI trust stores GC none
IA-06 Authentication feedback C Authentication feedback 03.05.11
IA-07 Cryptographic module authentication GC none
IA-08 Identification and authentication (non-organizational users) GC none
IA-08(01) Identification and authentication (non-organizational users): Acceptance of PKI-based credentials from other agencies GC none
IA-08(02) Identification and authentication (non-organizational users): Acceptance of external authenticators GC none
IA-08(04) Identification and authentication (non-organizational users): Use of defined profiles GC none
IA-11 Re-authentication C User identification, authentication, and re-authentication 03.05.01
IA-12 Identity proofing GC none
IA-12(02) Identity proofing: Identity evidence GC none
IA-12(03) Identity proofing: Identity evidence validation and verification GC none
IA-12(04) Identity proofing: In-person validation and verification GC none
IA-12(05) Identity proofing: Address confirmation GC none
 
Top of page 
Table 8: Incident Response (IR)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
IR-01 Incident response policy and procedures C Policy and procedures 03.15.01
IR-02 Incident response training C Incident response training 03.06.04
IR-03 Incident response testing C Incident response testing 03.06.03
IR-03(02) Incident response testing: Coordinate with related plans NCO none
IR-04 Incident handling C Incident handling 03.06.01
IR-04(03) Incident handling: Continuity of operations NCO none
IR-04(08) Incident handling: Correlation with external organizations NCO none
IR-04(09) Incident handling: Dynamic response capability NCO none
IR-05 Incident monitoring C Incident monitoring, reporting, and response assistance 03.06.02
IR-06 Incident reporting C Incident monitoring, reporting, and response assistance 03.06.02
IR-06(01) Incident reporting: Automated reporting NCO none
IR-06(02) Incident reporting: Vulnerabilities related to incidents NCO none
IR-06(03) Incident reporting: Supply chain coordination NCO none
IR-07 Incident response assistance C Incident monitoring, reporting, and response assistance 03.06.02
IR-07(01) Incident response assistance: Automation support for availability of information and support NCO none
IR-08 Incident response plan C Incident response plan 03.06.05
 
Top of page 
Table 9: Maintenance (MA)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
MA-01 System maintenance policy and procedures C Policy and procedures 03.15.01
MA-02 Controlled maintenance NCO none
MA-03 Maintenance tools C Maintenance tools 03.07.04
MA-03(01) Maintenance tools: Inspect tools C Maintenance tools 03.07.04
MA-03(02) Maintenance tools: Inspect media C Maintenance tools 03.07.04
MA-03(03) Maintenance tools: Prevent unauthorized removal C Maintenance tools 03.07.04
MA-04 Non-local maintenance C Non-local maintenance 03.07.05
MA-04(01) Non-local maintenance: Logging and review NCO none
MA-04(03) Non-local maintenance: Comparable security and sanitization ORC none
MA-04(04) Non-local maintenance: Authentication and separation of maintenance sessions ORC none
MA-04(05) Non-local maintenance: Approvals and notifications ORC none
MA-04(06) Non-local maintenance: Cryptographic protection ORC none
MA-05 Maintenance personnel C Maintenance personnel 03.07.06
MA-05(01) Maintenance personnel: Individuals without appropriate access ORC none
MA-06 Timely maintenance NCO none
 
Top of page 
Table 10: Media protection (MP)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
MP-01 Media protection policy and procedures C Policy and procedures 03.15.01
MP-02 Media access C Media access 03.08.02
MP-03 Media marking C Media marking 03.08.04
MP-04 Media storage C Media storage 03.08.01
MP-05 Media transport C Media transport 03.08.05
MP-06 Media sanitization C Media sanitization 03.08.03
MP-06(03) Media sanitization: Non-destructive techniques ORC none
MP-06(08) Media sanitization: Remote purging or wiping of information ORC none
MP-07 Media use C Media use 03.08.07
MP-08 Media downgrading ORC none
MP-08(03) Media downgrading: Protected information ORC none
 
Top of page 
Table 11: Physical and environmental protection (PE)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
PE-01 Physical and environmental protection policy and procedures C Policy and procedures 03.15.01
PE-02 Physical access authorizations C Physical access authorizations 03.10.01
PE-02(400) Physical access authorizations: Identification cards requirements GC none
PE-03 Physical access control C Physical access control 03.10.07
PE-03(400) Physical access control: Security inspections GC none
PE-04 Access control for transmission C Access control for transmission 03.10.08
PE-05 Access control for output devices C Physical access control 03.10.07
PE-06 Monitoring physical access C Monitoring physical access 03.10.02
PE-06(01) Monitoring physical access: Intrusion alarms and surveillance equipment NCO none
PE-08 Visitor access records NCO none
PE-09 Power equipment and cabling NCO none
PE-10 Emergency shutoff NCO none
PE-11 Emergency power NCO none
PE-12 Emergency lighting NCO none
PE-13 Fire protection NCO none
PE-13(01) Fire protection: Detection systems – automatic activation and notification NCO none
PE-13(04) Fire protection: Inspections NCO none
PE-13(400) Fire protection: Emergency services NCO none
PE-14 Environmental controls NCO none
PE-15 Water damage protection NCO none
PE-16 Delivery and removal NCO none
PE-17 Alternate work site C Alternate work site 03.10.06
PE-400 Remote and telework environments GC none
PE-400(01) Remote and telework environments: Physical information and assets storage GC none
PE-400(02) Remote and telework environments: International remote/telework GC none
PE-401 Security operations centre NCO none
 
Top of page 
Table 12: Planning (PL)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
PL-01 Planning policy and procedures C Policy and procedures 03.15.01
PL-02 System security and privacy plans C System security plan 03.15.02
PL-04 Rules of behaviour C Rules of behaviour 03.15.03
PL-04(01) Rules of behaviour: Social media and external site/application usage restrictions NCO none
PL-08 Security and privacy architectures NCO none
PL-10 Baseline selection GC none
PL-11 Baseline tailoring GC none
 
Top of page 
Table 13: Program management (PM)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
PM-01 Information security program plan N/A none
PM-02 Information security program leadership role N/A none
PM-03 Information security and privacy resources N/A none
PM-04 Plan of action and milestones process N/A none
PM-05 System and program inventory N/A none
PM-05(01) System inventory: Inventory of personal information N/A none
PM-06 Measures of performance N/A none
PM-07 Enterprise architecture N/A none
PM-07(01) Enterprise architecture: Offloading N/A none
PM-08 Critical infrastructure plan N/A none
PM-09 Risk management strategy N/A none
PM-10 Authorization process N/A none
PM-11 Mission and business process definition N/A none
PM-12 Insider threat program N/A none
PM-13 Security and privacy workforce N/A none
PM-14 Testing, training, and monitoring N/A none
PM-15 Security and privacy groups and associations N/A none
PM-16 Threat awareness program N/A none
PM-16(01) Threat awareness program: Automated means for sharing threat intelligence N/A none
PM-17 Protecting specified information on outsourced external systems N/A none
PM-18 Privacy program plan N/A none
PM-19 Privacy program leadership role N/A none
PM-20 Communication of key privacy services N/A none
PM-20(01) Communication of key privacy services: Privacy policies on websites, applications, and digital services N/A none
PM-21 Maintain a record of disclosures N/A none
PM-22 Personal information quality management N/A none
PM-23 Data governance committee N/A none
PM-24 Data integrity board N/A none
PM-25 Minimization of personal information used in testing, training, and research N/A none
PM-26 Complaint management N/A none
PM-27 Privacy reporting N/A none
PM-28 Risk framing N/A none
PM-29 Risk management program leadership roles N/A none
PM-30 Supply chain risk management strategy N/A none
PM-30(01) Supply chain risk management strategy: Suppliers of critical or mission-essential items N/A none
PM-31 Continuous monitoring strategy N/A none
PM-32 Purposing N/A none
 
Top of page 
Table 14: Personnel security (PS)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
PS-01 Personnel security policy and procedures C Policy and procedures 03.15.01
PS-02 Position security analysis GC none
PS-03 Personnel screening C Personnel screening 03.09.01
PS-04 Personnel termination C Personnel termination and transfer 03.09.02
PS-05 Personnel transfer C Personnel termination and transfer 03.09.02
PS-06 Access agreements NCO none
PS-07 External personnel security NCO none
PS-08 Personnel sanctions NCO none
PS-09 Position descriptions GC none
 
Top of page 
Table 15: Personal information handling and transparency (PT)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
PT-01 Personal information handling and transparency policy and procedures N/A none
PT-02 Authority to collect and use personal information N/A none
PT-02(01) Authority to collect and use personal information: Data tagging N/A none
PT-02(02) Authority to collect and use personal information: Automation N/A none
PT-03 Personal information handling uses and disclosures N/A none
PT-03(01) Personal information handling uses and disclosures: Data tagging N/A none
PT-03(02) Personal information handling uses and disclosures: Automation N/A none
PT-04 Consent N/A none
PT-04(01) Consent: Tailored consent Government of Canada N/A none
PT-04(02) Consent: Timely consent N/A none
PT-04(03) Consent: Revocation N/A none
PT-04(400) Consent: Tailored consent privatesector N/A none
PT-05 Privacy notice N/A none
PT-05(01) Privacy notice: Timely privacy notice statements N/A none
PT-05(02) Privacy notice: Privacy notice statements N/A none
PT-06 Personal information banks N/A none
PT-06(01) Personal information banks: Consistent uses and disclosures N/A none
PT-06(02) Personal information banks: Exempt banks N/A none
PT-07 Particularly sensitive personal information N/A none
PT-07(01) Particularly sensitive personal information: Social insurance numbers N/A none
PT-07(02) Particularly sensitive personal information: Canadian Charter of Rights and Freedoms N/A none
PT-07(400) Particularly sensitive personal information: Private sector N/A none
PT-08 Data matching requirements N/A none
 
Top of page 
Table 16: Risk assessment (RA)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
RA-01 Risk assessment policy and procedures C Policy and procedures 03.15.01
RA-02 Security categorization GC none
RA-03 Risk assessment C Risk assessment 03.11.01
RA-03(01) Risk assessment: Supply chain risk assessment C Risk assessment 03.11.01
RA-05 Vulnerability monitoring and scanning C Vulnerability monitoring and scanning 03.11.02
RA-05(02) Vulnerability monitoring and scanning: Update vulnerabilities to be scanned C Vulnerability monitoring and scanning 03.11.02
RA-05(05) Vulnerability monitoring and scanning: Privileged access ORC none
RA-05(11) Vulnerability monitoring and scanning: Public disclosure program NCO none
RA-07 Risk response C Risk response 03.11.04
RA-09 Criticality analysis NCO none
 
Top of page 
Table 17: System and services acquisition (SA)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
SA-01 System and services acquisition policy and procedures C Policy and procedures 03.15.01
SA-02 Allocation of resources NCO none
SA-03 System development life cycle NCO none
SA-04 Acquisition process NCO none
SA-04(01) Acquisition process: Functional properties of controls NCO none
SA-04(09) Acquisition process: Functions, ports, protocols, and services in use NCO none
SA-04(10) Acquisition process: Use of approved digital credential products GC none
SA-04(12) Acquisition process: Data ownership GC none
SA-05 System documentation NCO none
SA-08 Security and privacy engineering principles C Security engineering principles 03.16.01
SA-09 External system services C External system services 03.16.03
SA-09(01) External system services: Risk assessments and organizational approvals NCO none
SA-09(02) External System Services: Identification of functions, ports,protocols, and services ORC none
SA-10 Developer configuration management NCO none
SA-10(01) Developer configuration management: Software and firmware integrity verification NCO none
SA-11 Developer testing and evaluation NCO none
SA-15 Development process, standards, and tools NCO none
SA-15(03) Development process, standards, and tools: Criticality Analysis NCO none
SA-16 Developer provided training NCO none
SA-17 Developer security and privacy architecture and design NCO none
SA-22 Unsupported system components C Unsupported system components 03.16.02
 
Top of page 
Table 18: System and communications protection (SC)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
SC-01 System and communications protection policy and procedures C Policy and procedures 03.15.01
SC-02 Separation of system and user functionality ORC none
SC-04 Information in shared system resources C Information in shared system resources 03.13.04
SC-05 Denial-of-service protection NCO none
SC-05(02) Denial-of-service protection: Capacity, bandwidth, and redundancy NCO none
SC-05(03) Denial-of-service protection: Detection and monitoring NCO none
SC-07 Boundary protection C Boundary protection 03.13.01
SC-07(03) Boundary protection: Access points ORC none
SC-07(04) Boundary protection: External telecommunications services ORC none
SC-07(05) Boundary protection: Deny by default – allow by exception C Network communications - deny by default - allow by exception 03.13.06
SC-07(07) Boundary protection: Split tunneling for remote devices ORC none
SC-07(08) Boundary protection: Route traffic to authenticated proxy servers ORC none
SC-07(09) Boundary protection: Restrict threatening outgoing communications traffic NCO none
SC-07(11) Boundary protection: Incoming communications traffic NCO none
SC-07(12) Boundary protection: Host-based protection ORC none
SC-07(13) Boundary protection: Isolation of security tools, mechanisms, and support components NCO none
SC-08 Transmission confidentiality and integrity C Transmission and storage confidentiality 03.13.08
SC-08(01) Transmission confidentiality and integrity: Cryptographic protection C Transmission and storage confidentiality 03.13.08
SC-10 Network disconnect C Network disconnect 03.13.09
SC-12 Cryptographic key establishment and management C Cryptographic key establishment and management 03.13.10
SC-12(01) Cryptographic key establishment and management: Availability NCO none
SC-13 Cryptographic protection C Cryptographic protection 03.13.11
SC-15 Collaborative computing devices and applications C Collaborative computing devices and applications 03.13.12
SC-15(03) Collaborative computing devices and applications: Disabling and removal in secure work areas GC none
SC-17 Public key infrastructure certificates GC none
SC-18 Mobile code C Mobile code 03.13.13
SC-18(01) Mobile code: Identify unacceptable code and take corrective actions NCO none
SC-18(02) Mobile code: Acquisition, development, and use NCO none
SC-18(03) Mobile code: Prevent downloading and execution NCO none
SC-18(04) Mobile code: Prevent automatic execution NCO none
SC-18(05) Mobile code: Allow execution only in confined environments NCO none
SC-20 Secure name/address resolution service (authoritative source) NCO none
SC-21 Secure name/address resolution service (recursive or caching resolver) NCO none
SC-22 Architecture and provisioning for name/address resolution service NCO none
SC-23 Session authenticity C Session authenticity 03.13.15
SC-23(01) Session authenticity: Invalidate session identifiers at logout ORC none
SC-23(03) Session authenticity: Unique system-generated session identifiers ORC none
SC-28 Protection of information at rest C Transmission and storage confidentiality 03.13.08
SC-28(01) Protection of information at rest: Cryptographic protection C Transmission and storage confidentiality 03.13.08
SC-29 Heterogeneity NCO none
SC-39 Process isolation NCO none
 
Top of page 
Table 19: System and information integrity (SI)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
SI-01 System and information integrity policy and procedures C Policy and procedures 03.15.01
SI-02 Flaw remediation C Flaw remediation 03.14.01
SI-02(02) Flaw remediation: Automated flaw remediation status NCO none
SI-02(06) Flaw remediation: Removal of previous versions of software and firmware NCO none
SI-03 Malicious code protection C Malicious code protection 03.14.02
SI-03(04) Malicious code protection: Updates only by privileged users NCO none
SI-04 System monitoring C System monitoring 03.14.06
SI-04(02) System monitoring: Automated tools and mechanisms for real-time analysis NCO none
SI-04(04) System monitoring: Inbound and outbound communications traffic C System monitoring 03.14.06
SI-04(05) System monitoring: System-generated alerts NCO none
SI-04(10) System monitoring: Visibility of encrypted communications NCO none
SI-04(11) System monitoring: Analyze communications traffic anomalies NCO none
SI-04(12) System monitoring: Automated organization-generated alerts NCO none
SI-04(13) System monitoring: Analyze traffic and event patterns NCO none
SI-04(14) System monitoring: Wireless intrusion detection NCO none
SI-04(15) System monitoring: Wireless to wireline communications NCO none
SI-05 Security alerts, advisories, and directives C Security alerts, advisories, and directives 03.14.03
SI-07 Software, firmware, and information integrity NCO none
SI-07(01) Software, firmware, and information integrity: Integrity checks NCO none
SI-07(02) Software, firmware, and information integrity: Automated notifications of integrity violations NCO none
SI-07(03) Software, firmware, and information integrity: Centrally-managed integrity tools NCO none
SI-07(07) Software, firmware, and information integrity: Integration of detection and response NCO none
SI-08 Spam protection ORC none
SI-08(02) Spam protection: Automatic updates NCO none
SI-10 Information input validation NCO none
SI-11 Error handling NCO none
SI-12 Information management and retention  C Information management and retention 03.14.08
SI-16 Memory protection NCO none
SI-400 Dedicated administration workstation C Dedicated administration workstation 03.14.09
 
Top of page 
Table 20: Supply chain risk management (SR)
Control / activity number ITSP.10.033-01 Medium impact baseline Tailoring criteria Security requirement
SR-01 Supply chain risk management policy and procedures C Policy and procedures 03.15.01
SR-02 Supply chain risk management plan C Supply chain risk management plan 03.17.01
SR-02(01) Supply chain risk management plan: Establish SCRM team NCO none
SR-03 Supply chain controls and processes C Supply chain requirements and processes 03.17.03
SR-05 Acquisition strategies, tools, and methods C Acquisition strategies, tools, and methods 03.17.02
SR-06 Supplier assessments and reviews C Risk assessment 03.11.01
SR-08 Notification agreements NCO none
SR-10 Inspection of systems or components NCO none
SR-11 Component authenticity NCO none
SR-11(01) Component authenticity: Anti-counterfeit training NCO none
SR-11(02) Component authenticity: Configuration control for component service and repair NCO none
SR-12 Component disposal ORC none
 
Top of page 

Annex B Organization-defined parameters

This appendix lists the organization-defined parameters (ODPs) that are included in the security requirements in Section 3. The ODPs are listed sequentially by requirement family, beginning with the first requirement containing an ODP in the Access Control (AC) family and ending with the last requirement containing an ODP in the Supply Chain Risk Management (SR) family.

Table 21: Organization-defined parameters
Security requirement Organization-defined parameter
Account management 03.01.01.F.02 [Assignment: organization-defined time period]
Account management 03.01.01.G.01 [Assignment: organization-defined time period]
Account management 03.01.01.G.02 [Assignment: organization-defined time period]
Account management 03.01.01.G.03 [Assignment: organization-defined time period]
Account management 03.01.01.H [Assignment: organization-defined time period]
Account management 03.01.01.H [Assignment: organization-defined circumstances]
Least privilege 03.01.05.B [Assignment: organization-defined security functions]
Least privilege 03.01.05.B [Assignment: organization-defined security-relevant information]
Least privilege 03.01.05.C [Assignment: organization-defined frequency]
Least privilege - privileged accounts 03.01.06.A [Assignment: organization-defined personnel or roles]
Unsuccessful logon attempts 03.01.08.A [Assignment: organization-defined number]
Unsuccessful logon attempts 03.01.08.A [Assignment: organization-defined time period]
Unsuccessful logon attempts 03.01.08.B [Selection (one or more): lock the account or node for an [Assignment: organization-defined time period]; lock the account or node until released by an administrator; delay next logon prompt; notify system administrator; take other action]
Device lock 03.01.10.A [Selection (one or more): initiating a device lock after [Assignment: organization-defined time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended]
Session termination 03.01.11 [Assignment: organization-defined conditions or trigger events requiring session disconnect]
Use of external systems 03.01.20.B [Assignment: organization-defined security requirements]
Literacy training and awareness 03.02.01.A.01 [Assignment: organization-defined frequency]
Literacy training and awareness 03.02.01.A.02 [Assignment: organization-defined events]
Literacy training and awareness 03.02.01.B [Assignment: organization-defined frequency]
Literacy training and awareness 03.02.01.B [Assignment: organization-defined events]
Role-based training 03.02.02.A.01 [Assignment: organization-defined frequency]
Role-based training 03.02.02.A.02 [Assignment: organization-defined events]
Role-based training 03.02.02.B [Assignment: organization-defined frequency]
Role-based training 03.02.02.B [Assignment: organization-defined events]
Event logging 03.03.01.A [Assignment: organization-defined event types]
Event logging 03.03.01.B [Assignment: organization-defined frequency]
Response to audit logging process failures 03.03.04.A [Assignment: organization-defined time period]
Response to audit logging process failures 03.03.04.B [Assignment: organization-defined additional actions]
Audit record review, analysis, and reporting 03.03.05.A [Assignment: organization-defined frequency]
Time stamps 03.03.07.B [Assignment: organization-defined granularity of time measurement]
Baseline configuration 03.04.01.B [Assignment: organization-defined frequency]
Configuration settings 03.04.02.A [Assignment: organization-defined configuration settings]
Least functionality 03.04.06.B [Assignment: organization-defined functions, ports, protocols, connections, and/or services]
Least functionality 03.04.06.C [Assignment: organization-defined frequency]
Authorized software - allow by exception 03.04.08.C [Assignment: organization-defined frequency]
System component inventory 03.04.10.B [Assignment: organization-defined frequency]
System and component configuration for high-risk areas 03.04.12.A [Assignment: organization-defined system configurations]
System and component configuration for high-risk areas 03.04.12.B [Assignment: organization-defined security requirements]
User identification, authentication, and re-authentication 03.05.01.B [Assignment: organization-defined circumstances or situations requiring re-authentication]
Device identification and authentication 03.05.02 [Assignment: organization-defined devices or types of devices]
Identifier management 03.05.05.C [Assignment: organization-defined time period]
Identifier management 03.05.05.D [Assignment: organization-defined characteristic identifying individual status]
Password management 03.05.07.A [Assignment: organization-defined frequency]
Password management 03.05.07.F [Assignment: organization-defined composition and complexity rules]
Authenticator management 03.05.12.E [Assignment: organization-defined frequency]
Authenticator management 03.05.12.E [Assignment: organization-defined events]
Incident monitoring, reporting, and response assistance 03.06.02.B [Assignment: organization-defined time period]
Incident monitoring, reporting, and response assistance 03.06.02.C [Assignment: organization-defined authorities]
Incident response testing 03.06.03 [Assignment: organization-defined frequency]
Incident response training 03.06.04.A.01 [Assignment: organization-defined time period]
Incident response training 03.06.04.A.03 [Assignment: organization-defined frequency]
Incident response training 03.06.04.B [Assignment: organization-defined frequency]
Incident response training 03.06.04.B [Assignment: organization-defined events]
Media use 03.08.07.A [Assignment: organization-defined types of system media]
Personnel screening 03.09.01.B [Assignment: organization-defined conditions requiring rescreening]
Personnel termination and transfer 03.09.02.A.01 [Assignment: organization-defined time period]
Physical access authorizations 03.10.01.C [Assignment: organization-defined frequency]
Monitoring physical access 03.10.02.B [Assignment: organization-defined frequency]
Monitoring physical access 03.10.02.B [Assignment: organization-defined events or potential indications of events]
Alternate work site 03.10.06.B [Assignment: organization-defined security requirements]
Risk assessment 03.11.01.B [Assignment: organization-defined frequency]
Vulnerability monitoring and scanning 03.11.02.A [Assignment: organization-defined frequency]
Vulnerability monitoring and scanning 03.11.02.B [Assignment: organization-defined response times]
Vulnerability monitoring and scanning 03.11.02.C [Assignment: organization-defined frequency]
Security assessment 03.12.01 [Assignment: organization-defined frequency]
Information exchange 03.12.05.A [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service-level agreements; user agreements; nondisclosure agreements; other types of agreements]
Information exchange 03.12.05.C [Assignment: organization-defined frequency]
Network disconnect 03.13.09 [Assignment: organization-defined time period]
Cryptographic key establishment and management 03.13.10 [Assignment: organization-defined requirements for key establishment and management]
Cryptographic protection 03.13.11 [Assignment: organization-defined types of cryptography]
Collaborative computing devices and applications 03.13.12.A [Assignment: organization-defined exceptions where remote activation is to be allowed]
Flaw remediation 03.14.01.B [Assignment: organization-defined time period]
Malicious code protection 03.14.02.C.01 [Assignment: organization-defined frequency]
Policy and procedures 03.15.01.B [Assignment: organization-defined frequency]
System security plan 03.15.02.B [Assignment: organization-defined frequency]
Rules of behaviour 03.15.03.D [Assignment: organization-defined frequency]
Security engineering principles 03.16.01 [Assignment: organization-defined systems security engineering principles]
External system services 03.16.03.A [Assignment: organization-defined security requirements]
Supply chain risk management plan 03.17.01.B [Assignment: organization-defined frequency]
Supply chain requirements and processes 03.17.03.B [Assignment: organization-defined security requirements]
 
Top of page 
]]>https://cyber.gc.ca/en/news-events/series-joint-guidance-modern-defensible-architecture<![CDATA[Series of joint guidance on modern defensible architecture]]>2025-10-23T14:05:12Z

The Canadian Centre for Cyber Security (Cyber Centre) has joined the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and the following international partners in releasing guidance on modern defensible architecture (MDA):

  • Czech Republic’s National Cyber and Information Security Agency (NÚKIB)
  • Germany’s Federal Office for Information Security (BSI)
  • Japan’s Computer Emergency Response Team Coordination Center (JPCERT/CC)
  • Japan’s National Cybersecurity Office (NCO)
  • Japan’s National Police Agency (NPA)
  • New Zealand’s National Cyber Security Centre (NCSC-NZ)
  • Republic of Korea’s National Intelligence Service (NIS)

MDA is ASD’s ACSC initiative to ensure that organizations consider and actively apply secure design and architecture in their cyber security strategy, resilience planning and implementations.

This series of guidance includes 3 publications.

Foundations for modern defensible architecture

This joint guidance provides organizations with a baseline of secure design and architecture practices that prepare them to adapt to current and emerging cyber threats and challenges.

Read the full joint publication: Foundations for modern defensible architecture

Modern defensible architecture for senior decision makers

This joint guidance aims to assist senior decision-makers in understanding the contemporary threat landscape and how MDA can support organizations in defending against current threats and preparing for future threats.

Read the full joint publication: Modern defensible architecture for senior decision makers

Investing in modern defensible architecture

This joint guidance aims to assist organizations in developing an MDA investment roadmap based on their organizational:

  • strategy
  • business and security objectives
  • risk profile
  • threat context

Read the full joint publication: Investing in modern defensible architecture

]]>https://cyber.gc.ca/en/guidance/security-considerations-internet-protocol-version-6-itsm80003<![CDATA[Security considerations for Internet Protocol version 6 (ITSM.80.003)]]>2025-10-10T17:23:26Z

Alternate format: Security considerations for Internet Protocol version 6 - ITSM.80.003 (PDF, 551 KB)

Foreword

This is an unclassfied, publication, issued under the authority of the Head of the Canadian Centre for Cyber Security (Cyber Centre). For more information, contact the Cyber Centre:

email contact@cyber.gc.ca |Mobile 613-949-7048 or 1‑833‑CYBER‑88

Effective date

This publication takes effect on October 10, 2025.

Revision history

  1. First release: October 10, 2025.

Table of Contents

Overview

Exponential growth in the use of Internet-based technologies to deliver modern business services and applications is linked to the depletion of globally available Internet Protocol version 4 (IPv4) addresses. The Internet Protocol version 6 (IPv6) addressing scheme was designed by the Internet Engineering Task Force (IETF) to replace IPv4, and it offers significantly larger private and public address blocks to adequately support modern enterprise and non-enterprise needs. Deploying IPv6 endpoints alongside existing IPv4 infrastructure is emerging as a common strategy within enterprise networks. While IPv6 offers several security enhancements that IPv4 does not, running dual-stack architectures introduces new risks that must be appropriately managed.

To ensure its service architecture continues to evolve, the Government of Canada (GC) will need to design new network architectures and migrate existing digital infrastructure to support IPv6. As part of this strategy, IPv6-enabled services must be designed to securely co-exist alongside existing IPv4 infrastructure until an IPv6-only enterprise architecture emerges. While introducing IPv6 within GC infrastructure may have little or no direct impact on users and front-end services, GC departments must examine and assess the implications of IPv6 on their business services and security objectives.

This publication highlights critical security considerations for IPv6 deployments within GC networks. GC departments must design transition plans to support IPv6 addressing while ensuring operational and security risks are mitigated.

Top of page

1 Introduction

The GC relies on digital, inter-networked systems for delivering essential services to Canadians. Networking technologies continuously evolve due to the requirements of the digital infrastructure needed to support modern service connectivity. While the average Canadian user may not understand which Internet Protocol (IP) stack supports their services, the expectation is that GC digital service infrastructure should be able to process service requests from IPv6-enabled or IPv4-enabled devices. As GC networks and services are built to support the IPv6 technology stack, key stakeholders must assess the potential risks and impact of adopting the IPv6 protocol within the enterprise network, particularly security risks associated with implementing a dual-stack (IPv4 and IPv6) architecture.

Modern systems and applications have varying IPv6 protocol support; sometimes the protocol is available by default while other times, vendor-unique customizations are implemented, which can lead to interoperability challenges. These can expose enterprise networks to considerable security risks, increasing the likelihood for misconfigurations and gaps in security controls.

In 2013, TBS released the IPv6 Network Equipment Procurement Guideline as a follow-up to the IPv6 Adoption Strategy. This guideline was meant to help GC departments understand the technical requirements when procuring network equipment (for example, routers, network monitoring devices, proxy servers, firewalls) to ensure IPv6 capabilities are evaluated as part of system procurement processes. However, neither the strategy nor the procurement guidelines adequately address security considerations for IPv6.

While sections of the existing departmental digital architecture may be capable of supporting IPv6, without a secured framework for implementation, security risks may be inadvertently introduced into the enterprise environment. Departments should not assume that enabling support for IPv6 can simply occur by flipping a switch.

According to the IPv6 protocol specification, IPv6 is prioritized over IPv4 by default. Although business enterprise applications may not use the IPv6 protocol, defined specification standards and vendor-implemented default configurations may allow communications with IPv6 link-local addresses. For example, MicrosoftFootnote 1 does not recommend disabling IPv6 support on Windows operating environments even when not in use. To assess these and other issues, the Cyber Centre recommends that GC departments conduct a review of IPv6 network flows within their environment and address gaps that may exist within their network security monitoring tools before implementation. Enabling IPv6 traffic flows without adequate network visibility monitoring or appropriate network filtering protections may increase the enterprise attack surface and expose the network to additional security risks.

Top of page

1.1 Internet Protocol version 6

IP is the primary communications protocol of the Internet; it specifies how network packets are to be transported across network boundaries. IP is a component of the network layer in the Open Systems Interconnection reference model, a framework for organizing communication protocols and sharing information over the public Internet.

IPv6 was designed to replace IPv4, with some enhancements in operational and security functions. Differences exist between IPv6 and IPv4 which have implications on network architecture designs. The IPv6 protocol standard is a 128-bit network addressing scheme, which provides a significantly wider address space compared to IPv4 (which uses a 32-bit network addressing scheme). By default, IPv6 is not backward compatible with IPv4, which may require network administrators to implement changes to existing network architectures.

Internet Protocol version 6 compared to Internet Protocol version 4

Protocol components - Address space and notation

Internet Protocol version 4

  • uses 32-bit address space, and therefore offers a limited address space for private and public use cases
  • address notation consists of numbers separated by a period, for example, 192.168.0.1

Internet Protocol version 6

  • uses 128-bit address space, and therefore allows up to 2^128 unique network addresses (approximately 340 trillion)
  • address notation consists of eight colon-separated hexadecimal values, for example, 2001:0DB8:0000:0000:0000:000A:09C0:00B4

Protocol components - Security functions

Internet Protocol version 4

  • Protocol does not natively support authentication and security functions

Internet Protocol version 6

  • Natively supports authentication, data integrity, and data confidentiality (for example, IP security (IPsec) support)

Protocol components - Types

Internet Protocol version 4

  • Supports public and private static addressing to manage networks; however, address space is limited

Internet Protocol version 6

  • supports public routing and private static addressing to manage network devices
  • typical network address is composed of sections and identifiers (global routing prefix, local subnet identifier and interface identifier)

Protocol components - Address distribution

Internet Protocol version 4

  • Autoconfiguration is not supported and would require static or Dynamic Host Configuration Protocol (DHCP) assignment of IP addresses

Internet Protocol version 6

  • Allows autoconfiguration (stateless address configurations), easing the need for address assignment by a DHCP server. Autoconfiguration relies on router information for network addresses to access network services
Top of page

1.2 Internet Protocol version 6 enhancements

The IPv6 specification standard proposed enhancements which were not previously available in IPv4. The following subsections provide additional information on the security enhancements.

1.2.1 Internet Protocol security support

IPsec is a suite of protocols that can be used for authentication, encryption, and integrity protections. While IPsec can be used as a retroactive extension in IPv4, for IPv6 it is supported as part of the standard. Note, IPsec is no longer mandatory in IPv6 as per RFC 8504Footnote 2.

1.2.2 Autoconfiguration

Autoconfiguration provides the ability for a node to self-assign its IPv6 network address based on the network prefix information advertised by the router. Stateless address autoconfiguration (SLAAC) is the mechanism by which this can be achieved.

1.2.3 Neighbor discovery

The neighbor discovery (ND) protocol replaces the address resolution protocol used in IPv4 networks, providing cryptographic options to secure discovery messages.

1.2.4 Dynamic host configuration protocol security

The dynamic host configuration protocol for IPv6 (DHCPv6) supports authentication (and encryption) of DHCP messages using IPsec, thus preventing eavesdropping and message intercept attacks.

1.2.5 Extension headers

IPv6 extension headers can be used to improve security, debugging, and management functions.

1.2.6 No broadcast addresses

The IPv6 standard abolished the use of broadcast addresses and adopted multicast addresses as the primary mechanism for group communications.

Top of page

1.3 Problem statement

As enterprise networks evolve, IPv6 will inevitably need to be supported and managed. New network devices will likely support IPv6 and have it enabled by default, prioritizing its traffic flow in line with the specification standard. Deploying IPv6-enabled devices without proper understanding, adequate monitoring, hardening, and deployment of appropriate mitigation controls will increase the enterprise attack surface and expose the organization to significant risks.

Top of page

1.4 Threat context

This guidance is intended for systems operating at the UNCLASSIFIED, PROTECTED A, and PROTECTED B levels. In general, the Cyber Centre recommends that GC departments and agencies conduct a threat and risk assessment within the context of their business needs before partial or full-scale adoption of IPv6. As organizations consider threat sources that may exploit IPv6 vulnerabilities, the Cyber Centre assesses that unsophisticated threat actors (Td3) may target device misconfiguration errors and unintentionally exposed devices to infiltrate networks and maximize their criminal operations. Cybercrime groups and financially motivated cyber threat actors (Td4 and Td5) may target IPv6-related device vulnerabilities and design implementation weaknessesFootnote 3. State-sponsored actors (Td6 and above), in addition to lower-level tactics, may target IPv6 protocol specification weaknesses and system integration vulnerabilities to achieve larger strategic objectives. Mitigations to address state-sponsored advanced threats are considered out of scope for this guidance.

Below are some identified potential threat events (attacks) that could be applicable within IPv6 environments:

1.4.1 Protocol tunneling

Threat actors may encapsulate network packets within another protocol or create multiple tunnels through a network device to evade detection controls. For example, network devices may allow a malicious actor to embed unauthorized IPv6 packets within IPv4 tunnels to evade or bypass network filtering controls. Additionally, threat actors may launch spoofing attacks utilizing tunnel injection techniques, i.e. where a threat actor forges a valid encapsulated packet (based on partial knowledge of the tunnel endpoints and the encapsulation protocol)Footnote 4.

1.4.2 Distributed denial-of-service attacks

Threat actors may utilize IPv6 protocol capabilities such as multicast messages or extension headers to launch distributed denial-of-service (DDoS) attacks to overwhelm network defence systems. For example, a threat actor can use spoofed IPv6 link-layer multicast messages to launch a denial-of-service attack on a target source address.

1.4.3 Command and control

Threat actors may leverage IPv6 enhancements (extension headers or others) to embed and communicate control signals or beacons through a compromised network. Globally accessible and larger address space blocks make IPv6 attractive for threat actors to deploy command and control channels.

1.4.4 Network device misconfigurations

Threat actors may exploit network device misconfigurations or inconsistencies when perimeter gateway access control filters are not properly implemented. Threat actors may exploit network devices which expose unconfigured IPv6 interfaces by default to bypass network security controls.

1.4.5 Network service discovery

IPv6 multicast service discovery messages (e.g. multicast DNS (mDNS)Footnote 5 or Link-Local Multicast Name Resolution (LLMNR)Footnote 6) can be spoofed or crafted to redirect endpoints to an attacker-controlled infrastructure. Also, threat actors may leverage IPv6’s default protocol capabilities (such as Neighbor Discovery) to support reconnaissance operations (for example, extracting sensitive network device information) which can then be used to target vulnerabilities.

Top of page

2 Security considerations

The security model required for enterprise network architectures to support IPv6-enabled devices is different from traditional IPv4 implementations. This section highlights cyber security considerations and recommended actions to mitigate risks associated with the use of IPv6 within an enterprise network. IPv6 transition plans must consider the impact on business services and the organization’s security posture.

Top of page

2.1 Migration risks

Enabling IPv6 alters an organization’s network communications and security monitoring requirements. Accordingly, a systematic approach considering transition plans, interoperability risks and future operational requirements is highly recommended. Organizations may have both IPv4 and IPv6 deployed over their transition period. As such, it is crucial to consider whether existing network security infrastructures can support IPv6. Management must ensure that IPv6 transition plans adhere to change management processes. Security program policies and procedures at the organization level may require updates as necessary.

Management should identify the target objective, transition timelines, and migration paths. Security control policies that manage audit and monitoring, interconnection requirements, device identification and authentication, boundary protection, and managed interfaces may require updates. In general, the Cyber Centre recommends using the risk management framework detailed in IT security risk management: A lifecycle approach (ITSG-33) to identify and manage related information system security risks.

Top of page

2.2 Procurement and testing

IPv6 transition and implementation plans must be aligned with the organization’s procurement strategy. Procurement of assets with networking functions should be assessed for IPv6 support. The National Institute of Standards and Technology (NIST) and the University of New Hampshire (UNH) InterOperability Laboratory have developed an assessment and testing program that can assist with functional evaluation of IPv6 products. This program maintains a product registry of IPv6 devices and applications that have been tested against the technical requirements of the United States Government IPv6 standards profile (USGv6-r1 Profile)Footnote 7 for performance and conformance. The Cyber Centre recommends that organizations consider products on the USGv6 program registry as part of their procurement strategy. Organizations should review a product’s Supplier Declaration of Conformity (SDoC), which documents IPv6 capability claims. Additionally, organizations should test the network infrastructure’s capability to support IPv6-only deployment scenarios.

Top of page

2.3 Target architecture

The target architecture for the adoption of IPv6 must fall within an acceptable level of residual risk (risk tolerance) for the organization. The Cyber Centre recommends a target architecture plan that ultimately leads to an IPv6-only network infrastructure end-state. While dual-stack architectures (IPv4/IPv6) might be an obvious transition choice, the Cyber Centre recommends designing the transition plan with the goal of an IPv6-only end-state architecture. A single-stack (IPv6-only) end-state architecture simplifies network management and security monitoring, as well as a reduction in the overall operational costs.

Top of page

2.4 Legacy applications

Legacy applications may lack native support for IPv6, making them incapable of processing IPv6 packet data. This can be particularly complicated with critical business applications with no mechanisms to support IPv6. When IPv6 is enabled, legacy applications or security controls that rely on hard-coded IPv4 addresses as hostnames may be impacted. If adequate traffic translation mechanisms are not implemented, IPv6-only endpoints may be prevented from connecting to services that are only IPv4-aware and vice-versa. The Cyber Centre recommends that organizations assess the impact of their transition plans on their software applications.

The Happy Eyeballs Version 2: Better Connectivity Using Concurrency algorithmFootnote 8 is an IETF-proposed standard for managing how system applications can initiate and process asynchronous Domain Name System (DNS) queries on dual-stack hosts. The algorithm allows web applications to switch seamlessly between IPv4 and IPv6 networks. Network administrators should therefore test business applications for IPv6-based capabilities. While the Happy Eyeballs algorithm offers the benefit of managing switches between IPv4 and IPv6, it may also mask network problems. Hence, successfully connecting to an application may not be an indication of a clean bill of health on the IPv4 or IPv6 networks in a dual-stack environment.

Top of page

2.5 Unauthorized tunnels

Organizations should implement network security controls to detect and block the use of unauthorized IPv6 transition tunnels. Transition tunnels are techniques used to transport IPv6 packets over IPv4 network infrastructure. IPv6 tunnels can be manual or automatic tunnels, such as those provided by Teredo, 6to4Footnote 9, or Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)Footnote 10. Teredo is an automatic tunneling protocol designed by Microsoft, and it uses User Datagram Protocol (UDP) to tunnel IPv6 packets over IPv4 networks. The IETF designed “6to4” to provide automatic IPv6-over-IPv4 tunneling to interconnect IPv6 networks, while ISATAP is used to transmit IPv6 packets between dual-stack nodes on an IPv4 network. While these techniques and protocols may offer benefits, particularly during the transition phase, transporting IPv6 packets over IPv4 infrastructure can have security implications. These tunneling applications can be used to bypass network filtering policies. Organizations should implement mechanisms to block the use of default, automatic tunnels on end-user and perimeter devices (firewalls and edge routers). The Cyber Centre recommends using tunnel-aware security solutions. On network edge devices such as firewalls, organizations should deny by default all UDP outbound traffic and implement exceptions for authorized services onlyFootnote 11.

Top of page

2.6 Default configurations

Modern operating systems (OS) and network devices will most likely support IPv6 and, due to the standard’s requirements, this may be enabled by default. In addition, critical system functions may also require IPv6 to be enabled. For example, Microsoft does not recommend disabling IPv6 support on Windows OS devices, even when not in use Footnote 5. To understand and assess related risks, organizations should proactively review the default status of IPv6 on their devices. Stay aware of risks associated with default configurations and design monitoring and preventative controls to mitigate those risks. For example, the 6to4 tunneling protocol is enabled by default on Windows servers when an interface is assigned a public IPv4 address. The tunnel assigns and dynamically registers an IPv6 address on the networkFootnote 12. If not monitored, this exposes the network to considerable risks. Organizations should implement mechanisms to drop unauthorized IPv6 traffic flows. To mitigate threats associated with IPv6 traffic transiting the network undetected, the Cyber Centre recommends proactive host-based monitoring for IPv6 network communications, even when the network interface is disabled. Detection of unauthorized network traffic should be investigated.

Top of page

2.7 Unauthorized Internet Protocol version 6 traffic flows

Lack of visibility into IPv6 traffic flows represents a considerable risk on the network. Organizations with no approved use for IPv6 traffic should ensure IPv6 traffic flows are filtered on network edge routers and firewalls according to their network policies. A network that has deployed IPv6 should only allow IPv6 traffic that is permitted by policy, with access control lists (ACL) allowing only authorized flows and protocols and blocking all others by default. When IPv6 is being deployed, depending on the business case, a threat and risk assessment (TRA) may be required to identify and mitigate associated risks. In some cases, it may be infeasible to fully disable IPv6 functionality even with no business use case. For example, Microsoft does not recommend disabling IPv6 on Windows as some components require it to function properly. The Cyber Centre recommends a risk assessment to identify operational and security protections that could mitigate associated risks. In general, we recommend disabling IPv6 except where there is an approved operational need for its use on the enterprise network Footnote 5.

Top of page

2.8 Monitoring and management tools

Network management and monitoring tools require substantial updates to manage and support IPv6 network traffic. Network security monitoring and reporting tools, such as an intrusion detection and prevention system (IDPS), log aggregation (via a security information and event management (SIEM) system), vulnerability scanners, and patch management tools, must support IPv6 protocols to ensure ongoing compliance with organizational security policies. The Cyber Centre recommends that organizations prioritize testing for different network monitoring scenarios (dual-stack and IPv6-only) as part of their IPv6 transition strategy. In addition, tailored test cases should be developed to validate support for IPv6 for software and business service development-related activities.

Top of page

2.9 Addressing scheme

A robust IPv6 addressing scheme increases the security of the network, while providing the flexibility to support business services and mitigate information leakage threats. Organizations should consider their network’s current state architecture as well as future needs when selecting an IPv6 addressing plan. Considering the sophistication and interdependencies of modern networks and applications, an addressing plan which supports a phased and incremental approach to IPv6 is recommended. An IP address management (IPAM) system is essential for effectively managing the addressing plan. Organizations should consider supported business applications and security policies when selecting an addressing scheme. The addressing plan can also be used to enhance an organization’s security posture, as a foundational means for separating networks, while enforcing the zero-trust principles of network segmentation and segregation. If considering Unique Local Addresses (ULAs), they must be generated following approved pseudorandom algorithms and should be filtered at the network boundaries and not exposed beyond the internal network. While ULAs offer some benefits in IPv6 deployments, we would not recommend their use in dual-stack environments. For ULAs to be effective in dual-stack deployments, the address selection policy table precedence and label values may need to be updated on all devices on the network, introducing additional operational complexities and complicating network management and security processes.

Top of page

2.10 Multi-addressing support

A single IPv6 interface can hold multiple addressesFootnote 13. For example, an interface loopback address, a link local address, a unique local address, or a globally routable address. By default, a network interface with IPv6 is assigned a link local address. Multiple addresses offer both security and operational benefits; however, this can make it difficult to enforce network monitoring and filtering policies, particularly if filtering policies are not robust enough. This represents an increased threat surface and may allow threat actors to evade network traffic detection rules. The Cyber Centre recommends that system administrators implement restrictions on unauthorized changes to IPv6 addresses and ensure that monitoring controls are in place to prevent and detect changes. To mitigate the threat of malicious actors evading network security policies, implement deny-by-default policies to ensure traffic to and from an interface is blocked on network boundaries except for traffic that is explicitly allowed by the organization’s network security policies.

Top of page

2.11 Dynamic Host Configuration Protocol for Internet Protocol version 6

Most enterprise networks rely on Dynamic Host Configuration Protocol (DHCP) for distributing IP addressing information across the network. For IPv6, DHCP version 6 (DHCPv6)Footnote 14 supports both stateless and stateful addressing for network devices. Like the traditional DHCP protocol, DHCPv6 is susceptible to a variety of attacks such as malicious intercept, spoofing, and DDoS attacks. For enterprise networks deploying DHCPv6, the Cyber Centre recommends protecting DHCP network messages by using IPsec with encryption Footnote 6. The Cyber Centre further recommends enabling authentication mechanisms between the DHCP servers, relay hosts, and client endpoints. Organizations should also implement additional protections such as DHCPv6 GuardFootnote 15 to block malicious DHCP reply and advertisement messages from unauthorized network devices. Organizations should consider DHCPv6 failoverFootnote 16 capabilities to provide high-availability and protect against denial-of-service (DoS) attacks.

Top of page

2.12 Address autoconfiguration protections

The IPv6 protocol specification allows devices to self-assign network addresses (i.e., interface identifiers (IIDs)) using the Stateless Address Autoconfiguration (SLAAC) protocol. As outlined in NIST SP 800-119 Guidelines for the secure deployment of IPv6 (PDF), SLAAC relies on network information received from the router and the device MAC address and can allow threat actors to track IPv6 endpoints. The Cyber Centre recommends disabling the use of SLAAC, particularly if a public addressing model is implemented. However, if an approved use case exists for SLAAC, the Cyber Centre recommends enabling SLAAC privacy extensions (which generate temporary IPv6 addresses) for external communications outside the enterprise network (for example, with the Internet or third-party networks). Enabling DHCPv6 temporary addressing can also provide the same protections as SLAAC privacy extensions. Please note that certain endpoints may not support DHCPv6, such as devices running on the Android OS, and may require self-configured SLAAC addressing as their only autoconfiguration option. In those scenarios, organizations should enable DHCPv6 Address Registration as a mechanism for SLAAC devices to inform the DHCPv6 serverFootnote 17 of the address they self-generated. However, note that this may not provide visibility into auto-configured devices that don’t support address registration or maliciously choose not to inform the DHCPv6 server. Organizations should implement network security controls to identify, manage and authorize network links with autoconfigured addresses.

Top of page

2.13 Dual-stack environments

Dual stacking is a cost-attractive proposition for organizations, allowing the use of existing IPv4 infrastructure alongside IPv6. However, the need to maintain the IPv4 infrastructure while onboarding new IPv6 networks can increase the management burden and the attack surface. Dual-stack networks pose additional security concerns due to the use of multiple IP stacks, which increases the attack surface and requires additional security controls to mitigate associated risks. Dual-stacked host endpoints in particular present higher security challenges. Endpoint controls must have addressing controls for both IPv4 and IPv6 addressing schemes, which introduces additional complexity. The Cyber Centre recommends that organizations consider restricting host endpoints to single IP stack solutions (IPv4-only or IPv6-only). Limiting dual-stack architectures to transition mechanisms, switches, routers, or network gateways will help reduce the attack surface. Organizations should ensure that network or application firewalls are aware of and capable of filtering both IPv4 and IPv6 network packets.

The IPv6 specification standard establishes precedence rules which govern dual-stack interfaces. According to the IETF’s request for comments (RFC) 6724 publication, default address selection for Internet Protocol Version 6, configured default policies may prioritize specific address groups over others, thereby leading to network operational complexities. This can have operational and security implications within dual-stack networks. Network and security administrators should be aware of address-selection precedence values deployed within their network environment. Administrators should also review and approve address-selection policies and ensure they are aligned with their network security objectives. Network security devices, including firewalls, edge routers, and gateways, should implement filtering policies to prevent unauthorized inbound or outbound IPv4 and IPv6 traffic.

In dual-stack DNS environments, A records (used to map domain names to IPv4 addresses) and AAAA records (used to map domain names to IPv6 addresses) are crucial for maintaining services. For Internet-exposed networks, the Cyber Centre recommends that organizations use separate DNS infrastructure for internal and external IPv4 and IPv6 networks (also known as split DNS architecture). This is to ensure the stability of system applications, increase security, and preserve the privacy of enterprise network data. For more information on split DNS architecture, read the NSA’s Internet Protocol Version 6 Security Guidance.

Top of page

2.14 Protection of data and management planes

Network administrative communications for IPv6 environments should be protected against eavesdropping, sniffing, and similar threats. The Cyber Centre recommends separating the management plane from the data plane using mechanisms such as virtual local area network (VLAN) separation or firewall filtering. ACLs, Intrusion Prevention Systems (IPS), and layer-2 filtering should also be used to protect the network management plane devices. For higher sensitivity networks, physical and cryptographic separation is highly recommended, for example, separation of management and data planes. The Cyber Centre further recommends that organizations use IPsec to protect IPv6 communications. Only CSE-approved cryptographic algorithms should be used, as indicated in the Cyber Centre’s publication Cryptographic algorithms for UNCLASSIFIED, PROTECTED A, and PROTECTED B information (ITSP.40.111). Control plane protocols for IPv6 networks include ND, DHCP, Border Gateway Protocol (BGP), Network Time Protocol (NTP), and others. Organizations should consider implementing network filtering security controls. These controls will prevent control plane messages from inadvertently leaking information and disable or block unauthorized control plane protocols.

Top of page

2.15 Neighbor discovery messages

Neighbor discovery (ND)Footnote 18 in the IPv6 specification is similar to the Address Resolution Protocol (ARP) used by IPv4. ND is used to manage crucial IPv6 capabilities such as address autoconfiguration, address resolution, duplicate address detection and others. However, the ND protocol is susceptible to several attacksFootnote 19 and can also be used by threat actors to perform address spoofing or poisoning attacks. The Cyber Centre recommends implementing network products which support cryptographic protections for ND such as Secure Neighbor Discovery (SEND)Q. Cryptographic signatures generated through SEND are used to validate and verify ND messages, protecting against address spoofing attacks. Enabling IPsec can help secure ND messages. It is also advisable to filter ND messages (i.e., Internet Control Message Protocol version 6 (ICMPv6)) on external network boundary gateways except those required for IPv6 network connectivity. Please refer to RFC 4890Footnote 20 for guidance on filtering ICMPv6 messages in firewalls.

Top of page

2.16 Address translation risks

Address translation and tunneling of IPv4 over IPv6 and vice versa can introduce additional risk concerns. Translation devices can be a single point of failure and therefore high-availability and redundancy protections should be included as part of their architecture whenever they are deployed. Translation interfaces also force the termination of security mechanisms such as IPsec and Domain Name System Security Extensions (DNSSEC).

Network Address Translation-Protocol Translation (NAT-PT)Footnote 21 is a common translation mechanism that allows IPv4-only devices to communicate with IPv6-only devices. The Cyber Centre does not recommend using NAT-PT to communicate between IPv6-only networks via an IPv4 backbone or vice versa because of availability and end-to-end security concerns. Organizations can consider NAT64 (StatefulFootnote 22 Network Address Translation for IPv6-only clients to reach IPv4 servers) alongside DNS64 (a mechanism for synthesizing DNS AAAA records from A records)Footnote 23 or 464XLAT (combination of statefulT and statelessFootnote 24 translation for IPv4 connectivity across IPv6-only networks.)Footnote 25

Top of page

2.17 Zero trust architecture

Zero trust architecture (ZTA) is built on the foundational security principle of eliminating implicit trusts within the enterprise network. Zero trust assumes no inherent trust for resources and thus requires each resource (application, device, user, and network interface) to be uniquely identified, authenticated, and authorized.

The IPv6 standard provides foundational capabilities for the implementation of zero trust. These capabilities include an expanded address space, multiple addresses per interface, and IPsec header extensions for source authentication, data integrity and data confidentiality.

A multiple addressing strategy can be used to identify devices, interfaces or applications on the network, providing foundational support for micro-segmentation. This makes micro-segmentation easier, allowing traffic flows to be managed through fine-grain network access control lists.

Additionally, organizations can leverage IPv6 extension headers by enabling IPsec to achieve secure end-to-end IP communications. Enabling IPsec provides interface authentication and end-to-end confidentiality and integrity protections for data and control messages on the network.

Top of page

2.18 Technical and operational depth

The lack of technical understanding and operational expertise in IPv6 represents a significant challenge for many organizations. Few network engineers possess detailed knowledge of the IPv6 specification standards. To build the technical competencies required for the future, organizations should invest in training networking and security professionals on IPv6 and its capabilities. Organizations should also develop expertise by exploring IPv6 capabilities within dedicated network labs and/or limited pilot deployments. Organizations are encouraged to strengthen technical competencies and capabilities required to ensure network performance, address network design and operational issues, and architect security requirements.

Top of page

3 Conclusion

The challenges associated with limited IPv4 addresses are likely to increase. IPv6 is designed to address these issues and offer additional security benefits. Modern networking stacks prioritize IPv6, conforming with the IETF specification standard, and organizational network enterprise strategies must be updated to manage associated risks. Traditional security controls that were built around IPv4 addressing, such as monitoring capabilities for example, will require updates and re-alignment. The Cyber Centre strongly recommends that GC organizations undertake proactive and informed actions to securely design and scope their IPv4 to IPv6 transition plans in line with Cyber Centre recommendations.

Top of page
]]>https://cyber.gc.ca/en/news-events/joint-guidance-creating-maintaining-definitive-view-your-operational-technology-architecture<![CDATA[Joint guidance on creating and maintaining a definitive view of your operational technology architecture]]>2025-09-29T12:06:35Z

The Canadian Centre for Cyber Security (Cyber Centre) has joined the United Kingdom’s National Cyber Security Centre (NCSC-UK) and the following international partners in releasing guidance on creating and maintaining a definitive view of operational technology (OT) architecture:

  • Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
  • Germany’s Federal Office for Information Security (BSI)
  • Netherlands’ National Cyber Security Centre (NCSC-NL)
  • New Zealand’s National Cyber Security Centre (NCSC-NZ)
  • United States’ Cybersecurity and Infrastructure Security Agency (CISA)
  • United States’ Federal Bureau of Investigation (FBI)

This joint guidance defines a principles-based approach that OT organizations can use to build, maintain and store their system’s understanding. It is intended for cyber security professionals working in OT organizations across greenfield and brownfield deployments and includes the following principles:

  • Principle 1: Defining processes for establishing and maintaining the definitive record
  • Principle 2: Establishing an OT information security management program
  • Principle 3: Identifying and categorizing assets to support informed risk-based decisions
  • Principle 4: Identifying and documenting connectivity within your OT system
  • Principle 5: Understanding and documenting third-party risks to your OT system

Cyber security professionals can use these principles as a framework to develop a comprehensive record of their systems.

This joint guidance has been developed with contributions from partnering agencies and is part of a series of publications aiming to draw attention to the importance of cyber security in operational technology.

Read the full joint publication: Creating and maintaining a definitive view of your operational technology (OT) architecture

]]>https://cyber.gc.ca/en/news-events/statement-canadian-centre-cyber-security-malware-targeting-global-organizations-through-cisco-systems<![CDATA[Statement from the Canadian Centre for Cyber Security on malware targeting global organizations through Cisco Systems]]>2025-09-25T16:04:29Z

The Canadian Centre for Cyber Security (Cyber Centre), a part of the Communications Security Establishment Canada (CSE), is urging Canadian organizations to take immediate action to protect themselves in response to a serious new cyber security threat identified today by Cisco: Cisco Event Response: Continued Attacks Against Cisco Firewalls. This threat affects end-of-life Cisco ASA devices.

Timing is crucial when vulnerabilities like these are identified. We strongly recommend network defenders bolster their defences based on our latest alert and advisory, and apply appropriate patches immediately.

This threat activity uses advanced techniques to avoid detection, making it difficult to identify through conventional means. If you believe your organization may be affected, please call us 1-833-CYBER-88 or email contact@cyber.gc.ca as soon as possible.

Quotes

"This is a critical moment for Canadian organizations. Threat actors are targeting legacy systems with increasing sophistication. I urge all critical infrastructure sectors to act swiftly. The Cyber Centre stands ready to assist. Early action is the best defence to protect your systems and safeguard your information."

- Rajiv Gupta, Head of the Canadian Centre for Cyber Security

Background

The Cyber Centre is aware of cyber threat activity against Cisco ASA 5500-X Series devices involving the deployment of highly sophisticated malware, targeting global organizations. These types of devices are commonly used by organizations across Canada.

Expert teams at the Cyber Centre are actively investigating the vulnerability’s scope and have initiated outreach to support stakeholders and coordinate a unified response.

Together, through vigilance and collective action, we can continue to strengthen Canada’s cyber resilience from coast to coast to coast.

For more information on vulnerabilities, please visit the Cyber Centre’s Alerts and advisories page.

For best practices, please visit the Cyber Centre’s Guidance page.

]]>https://cyber.gc.ca/en/guidance/recommended-contract-clauses-cryptography-itsm00501<![CDATA[Recommended Contract Clauses for Cryptography (ITSM.00.501)]]>2025-09-22T19:38:33Z

Alternate format: Recommended Contract Clauses for Cryptography – ITSM.00.501 (PDF, 462 KB)

Foreword

This is an unclassfied, publication, issued under the authority of the Head of the Canadian Centre for Cyber Security (Cyber Centre). For more information, contact the Cyber Centre:

email contact@cyber.gc.ca |Mobile 613-949-7048 or 1‑833‑CYBER‑88

Effective date

This publication takes effect on September 2025.

Revision history

  1. First release: September 1, 2025

Table of contents

Overview

As your organization increases the use of cryptography to protect your infrastructure and data, there is a growing need to ensure that your organization purchases products and services that provide effective protection. Whether procuring a single-use product or contracting with a service provider such as a cloud service provider (CSP), your organization must consider certain elements to ensure that the product or service will meet your needs. This publication provides advice and guidance on what to consider when procuring products and services that use cryptography, including example clauses.

1 Introduction

The guidance in this publication highlights important security considerations for your organization when purchasing products and services that use cryptography. This includes but is not limited to service providers and cloud service providers (CSPs).

While vendors may present initial foundational terms and conditions, your organization’s management team is responsible for demonstrating and validating that the terms and conditions and the contract’s supporting security clauses address your organization’s business security needs.

The terms and conditions should be adaptable for future modifications to safeguard the interests of your organization. The terms and conditions in the service contract should also provide your organization with the best possible business outcomes. Your organization must initiate proactive measures to ensure service provisions include cyber security mechanisms for identifying, communicating, mitigating and preventing risks.

This publication outlines cryptographic considerations that should be factored in alongside the primary functional and legal contracting aspects when working with a vendor.

The clauses outlined in this publication should not be considered legal advice. Rather, they offer context for your organization and can help your organization determine considerations and questions to ask when procuring cryptographic products and services.

Top of page

1.1 Scope

The Cyber Centre provides advice and guidance on selecting and using cryptographic algorithms to protect the authenticity, confidentiality and integrity of sensitive information. This publication provides advice and guidance on what to consider when engaging with a vendor to purchase products or services that use cryptography for the protection of unclassified, protected A and protected B information.

Disclaimer: The Communications Security Establishment Canada (CSE) and its Cyber Centre do not recommend or endorse the use of any particular contracting clause listed in this publication. The example clauses provided are only intended to be a source of examples of contract clauses that may be useful for procuring products and service that use cryptography and are provided for informational purposes only. We recommend seeking legal and procurement advice when using these clauses to ensure that they meet your organization’s requirements.

Top of page

2 Cryptographic considerations

To protect the confidentiality, integrity and authenticity of your organization’s data, you must ensure that all infrastructure effectively uses strong cryptography for both on-premises environments and service provider environments. This includes cloud environments.

The following sections present items that should be considered when engaging with vendors. The considerations discuss cryptographic algorithms, modules and parameters to support organizations in following Cyber Centre guidance.

Section 2.1 Product considerations outlines considerations to be taken when purchasing products and focuses on the requirements of the products being purchased. Section 2.2 Considerations for service providers and cloud services provides advice and guidance for engaging with service and cloud providers and focuses on how the vendor selects, configures and uses cryptography.

Top of page

2.1 Product considerations

This section provides product considerations and example contract clauses to use when purchasing products that support cryptography. The clauses have been developed for products that have built-in cryptographic modules, such as virtual private networks (VPN) and other network appliances that support cryptography natively. These considerations can also be used to develop requirements for generic computing devices that will have software installed after purchase (for example, servers).

Note: The Cyber Centre publication Cryptographic algorithms for unclassified, protected A, and protected B information (ITSP.40.111) is updated regularly as advice and guidance changes. Any clauses that are used to procure products and that reference ITSP.40.111 should specify the publication version.

Top of page

Contractual clauses should ensure that cryptographic modules use algorithms recommended in ITSP.40.111 that meet your system requirements. Additionally, to avoid extra costs during the migration to post-quantum cryptography (PQC), we recommend that all newly procured cryptographic modules support appropriate PQC algorithms.

The following clauses recognize that some vendors do not currently support PQC and that some standards that will use the algorithms may still be under development. By specifying a date by which the vendor must provide PQC capabilities, your organization can purchase from the vendor when needed without waiting for the vendor to have PQC capable products. The vendor will be required to provide upgrades to the cryptographic modules on or before the date specified.

Example clause structure and language

  • Cryptographic modules must use only CSE-approved cryptographic algorithms with cryptographic parameter sizes and key lengths as specified in Cryptographic algorithms for unclassified, protected A, and protected B information (ITSP.40.111).
  • By the end of 2026, cryptographic modules implementing key establishment schemes must support appropriate post-quantum cryptography compliant with Cryptographic algorithms for unclassified, protected A, and protected B information (ITSP.40.111).
  • By the end of 2026, cryptographic modules implementing digital signature schemes must support appropriate post-quantum cryptography compliant with Cryptographic algorithms for unclassified, protected A, and protected B information (ITSP.40.111).
Top of page

2.1.2 Cryptographic agility

Using systems that support cryptographic agility enables organizations to reconfigure or upgrade cryptographic technologies as needed. This is important because progress in cryptographic research, vulnerability research and computing can lead to cryptographic deployments with less strength than when they were initially deployed. Products should have the capability to modify parameters, such as key lengths, parameter sizes and key lifetimes, and to select cryptographic algorithms without replacing software or hardware components. This will reduce both the expense and time needed for purchasing new infrastructure. Products must also have the critical ability to securely patch systems that use cryptography to ensure that vulnerabilities are mitigated as they are discovered.

For more information on cryptographic agility, read our publication Guidance on becoming cryptographically agile (ITSAP.40.018).

Example clause structure and language

  • Cryptographic modules must support cryptographic agility by providing cryptographic algorithms, parameter sizes, key lengths and crypto periods that are configurable.
  • Cryptographic modules must support vendor-signed patches and updates.
Top of page

2.1.3 Cryptographic certification

We recommend that all cryptographic modules be validated through the Cryptographic Module Validation Program (CMVP). The CMVP is jointly managed by the Cyber Centre and the National Institute of Standards and Technology (NIST). It ensures that vendors implement cryptography correctly in their products and that they follow Cyber Centre–recommended security best practices. To find validated modules, organizations can search the database of CMVP-validated modules, which is hosted by NIST. Cryptographic algorithms used in the modules should be validated by the Cryptographic Algorithm Validation Program (CAVP).

CMVP certification is specific to the details provided in the security policy available on the product certificate webpage. It is important that products use the cryptographic module according to that security policy. This ensures with a high degree of certainty that the module will provide the expected security services in the expected manner.

Example clause structure and language

  • Cryptographic algorithms must be validated by the Cryptographic Algorithm Validation Program (CAVP) with a certificate listed on the CAVP validation list.
  • Cryptographic modules must be validated by the Cryptographic Module Validation Program (CMVP) with an active CMVP certification and a certificate number listed on the CMVP-validated modules list.
  • Cryptographic modules must be applied in accordance with the cryptographic module security policy listed on the CMVP-validated modules list, in either an approved or an allowed mode.
Top of page

2.2 Considerations for service providers and cloud services

Organizations that outsource IT infrastructure or software solution management to cloud vendors or service providers must consider the cryptography used to protect the information. This section provides additional cryptographic considerations when contracting a service or cloud provider.

Your organization should ensure that contracting requirements obligate the contractor to maintain IT systems that are aligned with current cryptographic guidance. In addition to this publication, the Cyber Centre publication Recommended cyber security contract clauses for cloud services (ITSM.50.104) provides general procurement clauses and considerations when acquiring cloud-based solutions or services.

Note: We recommend that contracts with service providers ensure contractors remain current with the latest versions of ITSP.40.111 and our Guidance on securely configuring network protocols (ITSP.40.062). As such, clauses that reference either ITSP.40.111 or ITSP.40.062 should not reference a specific version or publication date and should require contractors to remain aligned with current Cyber Centre recommendations.

Top of page

2.2.1 Post-quantum cryptography

We recommend that all cryptographic modules support CSE-approved PQC algorithms as soon as they are available. The following clauses allow organizations to procure from service providers as needed, with the understanding that the cryptographic modules must be migrated to support PQC no later than the date specified. This approach provides flexibility to both the purchaser and the vendor while ensuring that the PQC migration is not delayed or more costly than necessary.

Example clause structure and language

  • By the end of 2026, cryptographic modules implementing key establishment schemes must support appropriate post-quantum cryptography compliant with Cryptographic algorithms for unclassified, protected A, and protected B information (ITSP.40.111).
  • By the end of 2026, cryptographic modules implementing digital signature schemes must support appropriate post-quantum cryptography compliant with Cryptographic algorithms for unclassified, protected A, and protected B information (ITSP.40.111).
Top of page

2.2.2 Configuration

Cryptography should be configured to operate according to the advice and guidance provided in the Cyber Centre’s publications ITSP.40.111 and ITSP.40.062. Following the most recent versions of these publications will help to keep your environment secure as cryptographic guidance evolves. Additionally, we recommend that cryptography is configured and operated in an approved or allowed mode found in the CMVP security policy.

Example clause structure and language

The Contractor must:

Top of page

2.2.3 Using validated cryptographic modules and algorithms

Similar to Section 2.1.3 Cryptographic certification on procuring products, we recommend that only algorithms and modules that have been validated by CAVP and CMVP be used in cloud and service provider environments, respectively.

Example clause structure and language

  • Cryptographic algorithms permitted to operate must be validated by the Cryptographic Algorithm Validation Program (CAVP) with a certificate listed on the CAVP validation list.
  • Cryptographic modules must be validated by the Cryptographic Module Validation Program (CMVP) with an active CMVP certification and a certificate number listed on the CMVP-validated modules list.
  • Cryptographic modules must be applied and operated in accordance with the cryptographic module security policy listed on the CMVP-validated modules list, in either an approved or an allowed mode.
Top of page

3 Terms and conditions

A vendor or contractor may already have terms and conditions they use when selling their products and services. Many of the clauses recommended in this publication may be covered using different contractual language (for example, referencing NIST publications rather than Cyber Centre publications).

In these situations, we recommend that organizations carefully compare the recommended clauses with the ones presented by the vendor, as well as any documents that the vendor references. This will help to ensure that the product or service that your organization purchases will meet your cryptographic requirements. As with all situations, when dealing with legally binding contracts, we recommend seeking legal advice.

Top of page

4 Conclusion

Cryptography provides an important means to protect your organization’s IT environments, whether in the cloud or managed on premises. However, it is important to ensure that the cryptographic products that these systems use to protect your data are sufficiently strong and secure. Using products that meet the Cyber Centre’s recommendations on cryptography, including validations by CAVP and CMVP, will help provide effective data confidentiality and integrity.

This guidance has been provided for general knowledge and guidance for any organization purchasing cryptographic products or using them in their environments. As indicated, this is not legal advice.

Top of page
]]>https://cyber.gc.ca/en/news-events/threat-detection-sharepoint-vulnerabilities<![CDATA[Threat detection for SharePoint vulnerabilities]]>2025-09-05T14:11:58Z

The Canadian Centre for Cyber Security (Cyber Centre) is actively tracking multiple campaigns exploiting recently disclosed critical vulnerabilities in on-premises Microsoft SharePoint servers, including CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771. These widespread campaigns leverage an exploit chain known as ToolShell.

To help defenders combat attacks leveraging these vulnerabilities, the Cyber Centre has compiled a detailed analysis derived from recent investigations. This analysis outlines the full attack path, examines the evolution and use of the ToolShell exploit chain, and provides an in-depth characterization of the threat actor’s techniques, along with critical mitigation and detection guidance.

Table of contents

Executive summary

This technical article aims to raise awareness and describe some of the tactics, techniques, and procedures (TTPs) associated with a threat actor seen exploiting the vulnerabilities in on-premises Microsoft SharePoint servers. The Canadian Centre for Cyber Security’s (Cyber Centre) preliminary findings highlight that this threat actor initially exploited a server then used a novel technique with custom .NET payloads to gain and maintain code execution. Subsequent analysis of dozens of custom in-memory payloads provided valuable insight into the extent of the compromise and the threat actor’s intentions and activities.

An incident overview

The events in the timeline below highlight the type of post-exploitation behaviour observed by the Cyber Centre. This incident demonstrates how even well-prepared teams can be affected by issues outside of their control: although the victims in this use case upheld strong security practices and took appropriate precautions, they were impacted by an unforeseeable software defect.

Figure 1: Timeline of events associated with SharePoint vulnerabilities

Figure 1 - Long description immediately follows
Long description - Timeline of events associated with SharePoint vulnerabilities
  • Day -12: Initial access using SharePoint CVE, script execution and data exfiltration (until Day -8)
  • Day -8: SMB lateral movement and lateral movement to IIS servers
  • Day -10: SMB lateral movement (until Day -2), lateral movement to IIS servers (until Day -2), script executions (until Day -1), and data exfiltration (until Day -1)
  • Day 0: CVEs published (CVE-2025-53770 and CVE-2025-53771)
  • Day 2: Patches released
  • Day 9: Last known actor activity on network

The Cyber Centre confirmed that activities exploiting the SharePoint vulnerabilities were observed as early as Day -12, consistent with the following recent reports:

However, a key indicator of compromise (IoC) shared by Microsoft in its July 19 customer guidance for SharePoint vulnerability CVE-2025-53770—the presence of a file called spinstall0.aspx—was not found during the incident in question. This demonstrates that the threat actor initially exploited the server and then used a novel technique with custom .NET payloads to gain and maintain code execution. Therefore, the spinstall0.aspx file (or variations on it) was not observed as part of the attack path, nor was a PowerShell process spawned by Internet Information Services (IIS).

Having established an initial foothold in the network, the threat actor moved to an additional server to perform reconnaissance, solidify their access and establish persistence through discovery and lateral movement. To achieve this, they uploaded several different custom .NET payloads directly into the IIS process memory over a period of several hours. These payloads included:

  • a module to intercept requests for legitimate files on the web server based on certain criteria
  • a module to extract cryptographic configuration values to facilitate subsequent exploitation on the web server
  • a module to read and exfiltrate the host’s Security Account Manager (SAM) password database for offline cracking
  • a Server Message Block (SMB) client to perform reconnaissance on the network
  • a filesystem crawler
  • a Lightweight Directory Access Protocol (LDAP) querying tool

These payloads were frequently combined with a privilege escalation exploit and an encryption module.

Figure 2: Attack path depicting how the threat actor gained access and moved through the environment

Figure 2 - Long description immediately follows
Long description - Attack path depicting how the threat actor gained access and moved through the environment

The image illustrates an attack flow starting with an external threat actor exploiting a SharePoint server in the DMZ (Step 1). From the SharePoint server, the attacker collects information and performs privilege escalation (Step 2). The attacker performs account discovery from the domain controller (Step 3). The attacker moves laterally to an IIS server (Step 4). The attacker shows interest in the internal exchange server (Step 5). The attacker moves laterally into the internal network (Step 6).

 

The threat actor used Hypertext Transfer Protocol Secure (HTTPS) externally to access compromised servers and exfiltrate data. They used SMB internally to perform reconnaissance and stage a new web shell on a separate IIS web server that was not running SharePoint. The threat actor leveraged compromised network devices to obfuscate their true origin and access the victims’ network from unpredictable IP addresses. This allowed them to blend in with normal traffic and reduced the usefulness of IP-based IoCs for tracking and discovery.

From both beachheads, the threat actor proceeded to connect to multiple devices on the internal network and scrape the domain controller and LDAP servers for information.

The last known activity on the network by the threat actor occurred on Day 9, with some subsequent reconnaissance activity touching cloud resources using previously compromised credentials. As of this writing, we continue to observe persistent malicious efforts to access both on-prem and cloud infrastructure using these credentials, which have since been rotated.

 
Top of page

Analysis of the incident

Disclaimer: Comments in source code were added as part of reverse-engineering efforts and are not present in the original samples.

The Cyber Centre analyzed host and network activity by leveraging telemetry from its sensors. The victims also provided snapshots in time of firewall and Hypertext Transfer Protocol (HTTP) access logs, which were crucial in tracing the compromise back to its very beginning. Ultimately, it was the analysis of dozens of custom in-memory payloads that provided the full story.

These payloads consisted of dynamic-link libraries (DLL) loaded into memory over a period of several weeks. The Cyber Centre extracted these payloads from running processes on compromised hosts after the common vulnerabilities and exposures (CVEs) were made public and reverse engineered. This provided valuable insight into the extent of the SharePoint compromise and the threat actor’s intent and activities.

MITRE ATT&CK techniques observed during analysis

The information below is based on the attack path outlined in figure 2.

Observation 1

  • Main techniques
    • Exploit public-facing application (T1190)
    • Server software component: web shell (T1505.003)
  • Additional techniques
    • Exfiltration over alternative protocol: exfiltration over symmetric encrypted non-C2 protocol (T1048.001)
    • Compromise infrastructure: network devices (T1584.008)

Observation 2

  • Main techniques
    • System information discovery (T1082)
    • Exploitation for privilege escalation (T1068)
    • OS credential dumping: security account manager (T1003.002)
  • Additional techniques
    • Data from local system (T1005)
    • Unsecured credentials: credentials in files (T1552.001)

Observation 3

  • Main techniques
    • Account discovery: local account (T1087.001)
  • Additional techniques
    • Account discovery: domain account (T1087.002)

Observation 4

  • Main techniques
    • Remote services: SMB/Windows admin shares (T1021.002)
    • Server software component: web shell (T1505.003)
  • Additional techniques
    • Exfiltration over alternative protocol: exfiltration over symmetric encrypted non-C2 protocol (T1048.001)
    • Compromise infrastructure: network devices (T1584.008)

Observation 5

  • Main techniques
    • Email collection (T1114)

Observation 6

  • Main techniques
    • Remote services: SMB/Windows admin shares (T1021.002)
  • Additional techniques
    • Valid accounts: domain accounts (T1078.002)
    • Remote services: remote desktop protocol (T1021.001)

Further analysis revealed that:

  • the initial exploitation dated back to Day -12, almost 2 weeks earlier than the CVEs’ public disclosure on July 19
  • a significant number of malicious activities followed the preliminary compromise, leveraging more than 50 distinct payloads over a period of several weeks
  • the threat actor had a keen interest in acquiring and exfiltrating documents on accessible file shares and used SMB protocol to access them
  • many payloads were dynamically generated and contained hard-coded values such as server names and paths; some of these included occasional typos, which were fixed in subsequent uploads. These dynamically generated payloads limited the usefulness of hash-based IoCs
 
Top of page
 

Observed tactic 1: Initial access (TA0001)

Observed technique: Exploit public-facing application (T1190)

The threat actor leveraged vulnerabilities to gain remote code execution (RCE) on an Internet-exposed SharePoint server (T1190). Initial access occurred on Day -12, 2 weeks before the public disclosure of vulnerabilities, and was achieved through the exploitation of CVE-2025-49704, CVE-2025-49706, CVE-2025-53770 and CVE-2025-53771, an exploit chain also known as ToolShell. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-53770 to its Known Exploited Vulnerabilities Catalog on July 20, followed by CVE-2025-49704 and CVE-2025-49706 on July 22.

Observed tactic 2: Persistence (TA0003)

Observed technique: Server software component: web shell (T1505.003)

The threat actor implemented custom-developed code designed to intercept and manipulate web server requests to legitimate files for tailored processing (T1505.003). This code allowed interactions that facilitated the collection of internal system and network information and enabled the exfiltration of sensitive data from the compromised environment. Meanwhile, the chosen endpoint to stage subsequent activity allowed the threat actor to blend their traffic with normal application traffic. In the figure below, ows.js is a legitimate SharePoint file that the threat actor chose to use in an attempt to blend in and should not be considered an IoC.

Figure 3: Sample of web shell request handler
Figure 3 - Long description immediately follows
Long description - Sample of web shell request handler

The image contains a snippet of C# code that defines a method named OnPostAuthenticateRequestCurrent, which acts as a custom HTTP request handler. The method intercepts requests to a specific SharePoint JavaScript file (/_layouts/15/ows.js) and processes a custom header (WWW-Authorization) to potentially execute encrypted commands on the server. The code includes a conditional check to ensure the request is a GET method and that the WWW-Authorization header exists and has a length of at least 5 characters.

 
Top of page
 

Observed tactic 3: Credential access (TA0006)

Observed techniques: OS credential dumping: security account manager (T1003.002); Unsecured credentials: credentials in files (T1552.001)

The threat actor deployed custom code to gather credentials from the operating system (T1003.002) and secure access to sensitive information located in configuration files available on the web server (T1552.001). Validation and decryption keys for the server were obtained early on, which allowed for subsequent forging of ViewState requests. As per Microsoft guidance, once the keys are compromised, patching alone is not sufficient; attackers can continue to achieve code execution through ViewState deserialization until the keys themselves are rotated and the server is restarted.

Figure 4: Sample of exfiltration of cryptographic configuration settings
Figure 4 - Long description immediately follows
Long description - Sample of exfiltration of cryptographic configuration settings

The image shows a C# code snippet that dynamically loads the System.Web assembly and uses reflection to access the MachineKeySection class. It retrieves sensitive configuration details such as validation and decryption keys, as well as compatibility mode, and concatenates them into a string. This information is then added to the HTTP response header under the key "X-TXT-NET," potentially exposing critical security data.

 

The threat actor had also gathered 4 files from the compromised server within a few days of the initial breach (listed in order of occurrence):

  • C:\Windows\System32\config\SAM
  • C:\Windows\System32\config\SYSTEM
  • C:\Windows\System32\config\SECURITY
  • C:\Windows\System32\inetsrv\Config\applicationHost.config

This code snippet includes a privilege escalation exploit and a New Technology File System (NTFS) parsing library (NTFSLib) to bypass file locking by leveraging raw disk access. Access to the 4 system resources listed above allows for offline cracking of credentials.

Figure 5: Code snippet used to collect the SYSTEM hive from disk
Figure 5 - Long description immediately follows
Long description - Code snippet used to collect the SYSTEM hive from disk

The image shows a C# code snippet that processes an HTTP request if its content length is not zero. It decodes a Base64-encoded string, splits it into an array using directory separator characters, and extracts a file path. The code then interacts with a custom NTFSWrapper class to access raw disk data and retrieve the parent directory entry of the specified path, potentially indicating malicious or unauthorized file system access.

 
Top of page
 

Observed tactic 4: Discovery (TA0007)

Observed techniques: Account discovery: local account (T1087.001); Account discovery: domain account (T1087.002)

Over a 2-week period, the domain controller hosting the LDAP service was queried by the threat actor 19 times to collect information on users, service accounts, groups, administrators and user mailboxes.

Figure 6: Sample of LDAP scraping
Figure 6 - Long description immediately follows
Long description - Sample of LDAP scraping

The image shows a C# code snippet that performs an LDAP query on a specified domain to search for directory entries matching a given filter. The results are serialized into JSON format, encrypted using AES with predefined keys, and then encoded in Base64 before being written to the HTTP response. This code appears to facilitate unauthorized access or exfiltration of directory information.

 
Top of page
 

Observed tactic 5: Collection (TA0009)

Observed techniques: Data from local system (T1005); Email collection (T1114)

The threat actor leveraged their access to gather information related to the local system (T1005) and unsuccessfully attempted to pivot to the internal mail server (T1114). The following data collection techniques targeted the filesystem and local storage.

Figure 7: Sample of file collection from the local system
Figure 7 - Long description immediately follows
Long description - Sample of file collection from the local system

The image shows a C# code snippet that appears to enumerate directories and files within a specified path (C:\\users\\) and collects metadata such as last write time, creation time, and file size. The gathered information is processed into a string, encrypted using AES with predefined keys, and potentially sent as part of an HTTP response. This code suggests functionality for unauthorized data collection and exfiltration.

 
Top of page
 

Of note, the actor attempted to pivot to an internal webmail server proxied through the compromised SharePoint server.

Figure 8: Sample of email collection
Figure 8 - Long description immediately follows
Long description - Sample of email collection

The image shows a C# code snippet configuring an HttpClient to send an HTTP POST request to a specified URL with custom headers and form-encoded data, including placeholders for sensitive credentials (REDACTED_USERNAME and REDACTED_PASSWORD). It sets the security protocol to support SSL3 and TLS12, bypasses SSL certificate validation, and includes a user-agent string mimicking a browser.

 

Observed tactic 6: Privilege escalation (TA0004)

Observed technique: Exploitation for privilege escalation (T1068)

The threat actor leveraged open-source tools to escalate their privileges and gain access to files and data beyond the reach of the initial compromise (T1068). Artifacts of the PrintNotifyPotato privilege escalation tool were observed in several payloads. These allowed the threat actor access to otherwise restricted files. This technique was leveraged in multiple samples, with portions of code and strings directly matching the GitHub project source code.

Figure 9: Sample of PrintNotifyPotato privilege escalation
Figure 9 - Long description immediately follows
Long description - Sample of PrintNotifyPotato privilege escalation

The image shows a C# code snippet that performs token duplication and thread impersonation using native methods to elevate privileges. It duplicates a SYSTEM token, impersonates it on the current thread, and calls a function (F()) that appears to access sensitive data, such as the Security Account Manager (SAM) file. The code includes error handling and writes diagnostic messages to the HTTP response, indicating potential misuse for privilege escalation and data exfiltration.

 
Top of page
 

Observed tactic 7: Lateral movement (TA0008)

Observed techniques: Remote services: SMB/Windows admin shares (T1021.002); Remote services: remote desktop protocol (T1021.001)

The threat actor performed reconnaissance and moved laterally in the environment by leveraging SMB connectivity (T1021.002). Interestingly, they leveraged both a custom SMB client loaded inside a .NET module as well as the system’s own SMB client while they were active on the network. In addition, unsuccessful attempts to perform Remote Desktop Protocol (RDP) connections further into the network were observed from compromised servers.

Figure 10: Sample of SMB client
Figure 10 - Long description immediately follows
Long description - Sample of SMB client

The image shows a C# code snippet that processes HTTP input to extract user credentials (user, address, and password) and attempts to establish an SMB connection using these details. If the connection succeeds, it serializes and encodes the list of shared resources; otherwise, it encodes a "connection failed" message. The SMB client instance is stored in the application context, suggesting potential misuse for unauthorized access or credential harvesting.

 
Top of page
 

SMB commands implemented by the sample

In the sample above, we observed the following SMB commands and associated behaviours:

  • cn: establishes an SMB connection using a username, password, and IP address specified in the request. It saves the SMB connection to HttpApplication.Application["817FE0AC534D44E49"]
  • li: lists files in the connected SMB resource
  • re: reads a file from the connected SMB resource
  • we: writes, appends or creates a file on the connected SMB resource
  • de: deletes a file on the connected SMB resource
  • di: disconnects and cleans up the SMB client

The use of a bespoke SMB client inside .NET payloads enabled further detection opportunities by looking for outgoing connections over port 445 from the IIS server process, as opposed to the normal pattern of SMB connections originating from the Windows kernel.

Observed tactic 8: Persistence (TA0003)

Observed technique: Server software component: web shell (T1505.003)

After gaining a foothold in the network, the threat actor pivoted to an additional Internet-exposed IIS server (not SharePoint) within a matter of days, using the lateral movement techniques previously mentioned. This helped them establish a back-up persistent access point into the network (T1505.003), solidifying their presence, after which they remained dormant for almost 2 weeks.

The compromise of a non-SharePoint server emphasizes the need to look beyond initial TTPs for signs of lateral movement once an initial compromise is detected.

The threat actor returned briefly on Day 9 by leveraging the above-mentioned access. However, because of the Cyber Centre’s improved understanding of the actor’s TTPs, alongside newly deployed capabilities, this new activity was quickly detected and stopped.

Figure 11: Sample of additional web shell path
Figure 11 - Long description immediately follows
Long description - Sample of additional web shell path

The image shows a C# code snippet implementing an HTTP request handler that intercepts POST requests to a specific SharePoint path (/_layouts/15/start.aspx). It processes a Base64-encoded __EVENTVALIDATION parameter, decrypts it using DES, and parses the resulting data to handle specific modes, such as "Get." The code includes functionality for compressing and encoding data, suggesting potential misuse for unauthorized data manipulation or exfiltration.

 
Top of page
 

Observed tactic 9: Resource development (TA0042)

Observed technique: Compromise infrastructure: network devices (T1584.008)

Indicators suggest that exploitation and exfiltration activities originated from several compromised network devices, including some with close geographical proximity to the target network. For example, the IP address used for the initial exploitation was not the same one subsequently used for ongoing collection and access development. This flexible choice of source IPs allowed the threat actor to blend in with normal traffic and reduced the usefulness of typical IP-based IoCs for tracking, discovery and blocking.

Observed tactic 10: Exfiltration (TA0010)

Observed technique: Exfiltration over alternative protocol: exfiltration over symmetric encrypted non-C2 protocol (T1048.001)

The Cyber Centre observed several obfuscation techniques in use during the exfiltration phase related to executing payloads embedded in web server requests. The most commonly observed technique was encrypting the result using a symmetric key (T1048.001), encoding that result using Base64, and then returning the Base64-encoded buffer as part of the HTTP response from the web server. This encryption is encapsulated inside the regular Transport Layer Security (TLS) connections observed on normal port 443 traffic for the application.

 
Top of page
 

Indicators of compromise and recommendations

IoCs were distributed via the Cyber Centre’s automated threat intelligence sharing platform (AVENTAIL) and through alerts and communications by the Canadian Cyber Security Incident Response Team (CSIRT). This ensured that partners across all sectors had the information they needed to act decisively.

For up-to-date information on alerts, advisories and guidance relating to the SharePoint vulnerabilities, please refer to the Cyber Centre alert Vulnerability Impacting Microsoft SharePoint Server (CVE-2025-53770).

Cyber Centre tools and services

No single tool, service or turnkey solution can reconstruct an incident, trace an attacker’s path or validate a threat on its own. A holistic approach using multiple perspectives is required to conduct a thorough investigation. As such, the Cyber Centre relies on multiple layered telemetry sources to detect threats and protect monitored assets.

Active scanning tools helped identify Internet-exposed high-priority servers. AssemblyLine was used to enable triage at scale, processing hundreds of thousands of files per day. The Cyber Centre made enhancements to its DotnetDecompiler Service to automate the decompilation of .NET executables. This is now available in the Cyber Centre’s open-source repository, allowing the broader cyber security community the benefit of the same advanced capabilities.

In response to this incident, the Cyber Centre also created YARA rules to help with the detection of malicious files related to the threat actor’s activity. Additional YARA rules will be released periodically after an evaluation period to ensure accuracy.

The sample YARA rule below implements a detection for the LDAP scraping activity found in payloads extracted from the compromised server.

Figure 12: YARA rule for LDAP data collection detection

Figure 12 - Long description immediately follows
Long description - YARA rule for LDAP data collection detection

The image shows a YARA rule named WIN_LDAPQuery designed to detect DLL files performing LDAP queries. It includes metadata such as the rule's purpose, category, and reference to a SharePoint vulnerability advisory. The rule identifies suspicious behaviour by matching specific strings related to LDAP operations, encryption, and token handling, combined with conditions targeting file size and string occurrences.

Code
rule win_ldapquery
{
    meta:
        id = "1vOyulv5H6pIcnCKCQJxyB"
        fingerprint = "69d05a0633335c9c8c739d33e2af3b9f4be01369d4ccefb83e55d2fe094b0a87"
        version = "1.0"
        modified = "2025-08-27"
        status = "RELEASED"
        sharing = "TLP:CLEAR"
        source = "CCCS"
        author = "reveng@CCCS"
        description = "Detect a DLL that is performing a LDAP query."
        category = "MALWARE"
        malware = "ldapquery"
        malware_type = "INFOSTEALER"
        malware_type = "HACKTOOL"
        report = "TA25-0056"
        report = "TA25-0057"
        reference = "https://www.cyber.gc.ca/en/alerts-advisories/al25-009-vulnerability-impacting-microsoft-sharepoint-server-cve-2025-53770"

    strings:
        // Detection of classes and function names (latest version).
        $a1 = "LDir" ascii
        $a2 = "Explore" ascii
        $a3 = "Internals" ascii
        $a4 = "EncryptAes" ascii
        $a5 = "DecryptAes" ascii
        $a6 = "Set Token Error" wide
        $a7 = "AdsDateValue" ascii
        $a8 = "FindHandle" ascii

        // Detection of function names (oldest version).
        $x1 = "JavaScriptSerializer" ascii
        $x2 = "Serialize" ascii
        $x3 = "EncryptAes" ascii
        $x4 = "DecryptAes" ascii
        $x5 = "DirectorySearcher" ascii

        // Product and assembly version.
        $b1 = "0.0.0.0" wide

        // Guid for Internet Explorer (IE) COM object and strings for writing the HTTP response.
        $c1 = "9068270B-0939-11D1-8BE1-00C04FD8D503" ascii
        $c2 = "HttpResponse" ascii
        $c3 = "HttpContext" ascii
        $c4 = "ToBase64String" ascii
        $c5 = "GZipStream" ascii
        $c6 = "CreateEncryptor" ascii

        // Dynamic libraries with extern functions for security token escalation.
        $d1 = "advapi32.dll" ascii
        $d2 = "ntdll.dll" ascii
        $d3 = "kernel32.dll" ascii
        $d4 = "NtQuerySystemInformation" ascii
        $d5 = "OpenProcessToken" ascii
        $d6 = "GetTokenInformation" ascii
        $d7 = "SetThreadToken" ascii
        $d8 = "GetCurrentThreadToken" ascii
        $d9 = "Administrator" wide
        $d10 = "IUSR" wide

        // LDAP related strings.
        $e1 = "LDAP://" wide
        $e2 = "samaccountname=" wide nocase
        $e3 = "cn=" wide nocase
        $e4 = "msexchrecipienttypedetails=" wide
        $e5 = "userprincipalname=" wide
        $e6 = "mail=" wide

    condition:
        uint16(0) == 0x5A4D and
        (
            (5 of ($a*) and 4 of ($d*)) or
            all of ($x*)
        ) and
        $b1 and
        4 of ($c*) and
        2 of ($e*) and
        filesize < 2MB
}
 
Top of page
 

Acknowledgments

As a part of the Communications Security Establishment Canada (CSE), the Cyber Centre is a proud member of the Five Eyes, the world’s longest-standing and closest intelligence-sharing alliance. Sharing IoCs and TTPs with the cyber community and Five Eyes partners has been instrumental since the SharePoint vulnerabilities were first discovered, and ongoing analytical exchanges have maximized the value of collected data.

Further collaboration with organizations such as the Microsoft Threat Intelligence Center (MSTIC) and Palo Alto’s Unit42 has enabled the exchange of detailed malware analysis and technical findings, strengthening collective defences.

Disclaimer: The Cyber Centre disclaims all liability for any loss, damage, or costs arising from the use of or reliance on the information within this article. Readers are solely responsible for verifying the accuracy and applicability of any information before acting on it.

 
Top of page
 
]]>https://cyber.gc.ca/en/guidance/cyber-security-hygiene-best-practices-your-organization-itsap10102<![CDATA[Cyber security hygiene best practices for your organization - ITSAP.10.102]]>2025-09-04T12:56:09Z

Cyber security hygiene refers to the best practices your organization can take to maintain the overall health and security of your IT environment. Your cyber security hygiene helps you better defend your networks, systems and data from threat actors.

Threat actors, even in more sophisticated attacks, leverage common vulnerabilities and weaknesses to attack systems and gain initial access. By building a solid cyber security foundation, your organization is better positioned to protect, defend and recover from cyber incidents.

On this page

Cyber security hygiene checklist

The following checklist provides actions your organization can take to strengthen your cyber security.

While not all actions may be feasible, you should prioritize implementing those that are most impactful and sustainable for your organization. Doing so will enhance your cyber security posture.

Network and endpoint protection

  • Protect your network and endpoints with the following tools
    • anti-virus and anti-malware software
    • network protocol inspection tools
    • endpoint detection and response
    • firewalls
    • wireless intrusion detection and prevention systems
    • mobile endpoint threat management solutions and mobile threat defence products
  • Segment your networks to stop traffic from flowing to sensitive or restricted zones
  • Implement a security information and event management system to enable real-time, continuous monitoring to identify anomalies in your
    • network traffic
    • wireless access points
    • mobile device gateways
  • Monitor your security critical components, including the
    • Domain Name System (DNS) server
    • authentication server
    • public key infrastructure
  • Implement protective DNS to prevent users from inadvertently visiting potentially malicious domains on the Internet
  • Regularly renew cryptographic keys to maintain secure communications
  • Document secure baseline configurations for all your IT, operational technology components and cloud infrastructure
  • Establish and maintain a configuration management database
  • Conduct and maintain an inventory of your IT assets
  • Manage and detect unauthorized assets by developing and maintaining IT asset management procedures that ensure proper tagging and labelling of hardware and software assets

Read more

Top of page
 

System protection

  • Enable automatic updates and patches for your firmware, hardware, software and operating systems, especially for Internet-exposed services and systems
  • Patch operating systems and applications promptly after assessing organizational risk and confirming compatibility with your environment
  • Enforce phishing-resistant multi-factor authentication (MFA) for all accounts and systems, especially those with administrative privileges
  • Encourage the use of strong, unique, and confidential passphrases or passwords where MFA is not technically feasible
  • Ensure administrators use dedicated workstations that do not allow web browsing or email access
  • Regularly review and update user privileges, such as
    • remove users no longer in your organization
    • edit user privileges if users no longer require access to certain data or systems
    • limit administrative privileges to a small number of users
    • require two-person integrity for administrative privileges
    • conduct administrative functions from a dedicated administrative workstation
  • Apply the principle of least privilege, ensuring users only have the set of privileges that are essential to performing authorized tasks
  • Consider role-based access control
  • Manage mobile devices with unified endpoint management software
  • Implement application allow lists to control what applications and components are allowed on your networks and systems
  • Assess third-party applications to identify and disable unnecessary components or functions or require human intervention before activation (for example, macros)
  • Disable autorun or autoplay on all your operating systems and web browsers to avoid automatic installations of unauthorized software
  • Establish an incident response plan and conduct annual tests to ensure timely restoration of critical functions and effective recovery
  • Categorize your assets to identify those that are most critical to your organization's operations
  • Regularly backup critical data and systems to offline storage, ensuring backups are isolated from network connections
  • Test your backups periodically to ensure data and systems can be recovered quickly and successfully
  • Proactively manage device lifecycles to address vulnerabilities in end-of-life or end-of-service-life devices, which often remain unpatched and increase security risks

Read more 

Top of page
 

User education and additional protective measures

  • Provide ongoing, tailored cyber security training to ensure your employees know how to respond to suspicious links or emails
  • Provide privacy awareness training to your employees to reduce the risk of privacy breaches
  • Identify and subscribe to relevant security information sources or alert services to stay informed about threats that could impact your organization
  • Develop an internal and external contact list of key stakeholders to alert during cyber threat events

Read more

Top of page
 
]]>https://cyber.gc.ca/en/guidance/virtualizing-your-infrastructure-itsap70011<![CDATA[Virtualizing your infrastructure (ITSAP.70.011)]]>2025-09-04T11:54:22Z

Virtualization is a method of hardware abstraction that allows the creation of software versions of IT systems and services which are traditionally implemented on separate physical hardware. These software versions, or virtual instances, can dramatically increase efficiency and decrease costs. Virtualization uses hardware to its full capacity by distributing its capabilities among many different services.

Before implementing virtualization within your organization, you should understand the associated risks and ensure you protect your network, systems and information. This guidance covers the basics virtualization, how your organization can benefit from it and the potential risks involved.

On this page

How virtualization works

To run your systems and services virtually there are 3 main components.

Virtual machine

With virtualization, you can run your applications on fewer physical servers. Applications and software run virtually on a simulated computer system called a virtual machine (VM). The VM has all the features of a computer server, without needing the physical hardware attached. A hypervisor supports the VM.

Hypervisor

The hypervisor provides the layer of abstraction between the underlying hardware and hosted virtual machines. An abstraction layer can hide or show as much detail about your system as you want. The hypervisor allocates resources, such as centralized processing unit access, storage and memory, to multiple VMs. This allows them to run concurrently on the same underlying hardware as though they each had their own dedicated hardware.

The use of hypervisor technology may allow for quicker builds and snapshots of VM images. The administration of the hypervisor should be done using a dedicated administrator workstation (DAW). DAWs are limited-use workstations that can only be used by those who have privileged access to perform administrative tasks. They are meant to increase the security of your network.

There are 2 types of hypervisors:

  • bare-metal hypervisor (also known as Type 1), which runs directly on physical hardware
  • hosted (also known as Type 2), which runs as an application on a host operating system

Hypervisor technologies may also provide additional functionality or features such as the use of VM snapshots and backups, virtual networking capabilities between VMs, VM monitoring and more. Note, that the use of a hypervisor may incur additional overhead.

Hardware servers

A single hardware server may support multiple VMs. Without virtualization, idle applications have resources that are unused, for example:

  • processing power
  • RAM
  • storage

With virtualization, hardware servers can be used at full capacity to offer the hypervisor all the resources necessary to support the VMs.

Figure 1: Hardware server supporting a virtual machine
Hardware server supporting a virtual machine
Long description – Figure 1: Hardware server supporting a virtual machine

The figure 1, shows how the hardware server supports the hypervisor and the virtual machine. The image shows 3 components, from left to right, the hardware server connects to the hypervisor and then to the virtual machine(s).

What virtualization can do for your organization

Using virtualization, your organization can advance the performance of its infrastructure in the following ways:

  • run multiple operating systems on one physical machine
  • divide system resources between VMs, also known as load balancing
  • gain advanced resource controls
  • create virtualized security appliances, such as a firewall
  • easily move, copy and save VMs to other files and systems
  • run virtual desktop infrastructure in-office and remotely

Types of virtualization

Virtualization can be used to perform several different functions for different needs. Your organization may choose to use all or some of the following types of virtualization.

Server

A physical server is divided up into multiple virtual servers. Each virtual server can run its own operating system. This is effective for deploying IT services within an organization.

Desktop

A workstation is virtualized so that users can access it from anywhere. This includes accessing your organization’s network from a smart device and working remotely. To learn more about workstation virtualization, read our guidance on using virtual desktop at-home and in-office (ITSAP.70.111).

Storage

All your physical data storage units are combined to create a large, virtualized unit. This streamlines storage capabilities and creates a central storage console.

Network

A hardware-based network is transformed into a software-based network. This consolidates all the network resources and simplifies administrative control.

Application

Computer programs can run on various operating systems (OS). An application is installed on an underlying OS, but through virtualization can be accessed and executed on others, such as running a Microsoft application on a Linux OS. This requires a virtualization layer to be inserted between the OS and the app.

Cloud computing

While virtualization is closely related to cloud computing, they are not the same concept. However, cloud computing utilizes virtualization to support many of its functions. To learn more about cloud computing, read our guidance Thinking of moving to the cloud? Here’s how to do it securely.

Benefits of virtualization

Virtualization and the use of VMs have several benefits. These examples are not inherent capabilities of virtualization but may be achieved depending on how you use it:

  • lowers costs for high performance IT services
  • increases IT productivity, efficiency and responsiveness
  • accelerates the installation of applications and implementations of resources
  • minimizes network downtime
  • decreases disaster recovery time
  • simplifies data centre management
  • segregates applications and data to enhance security and reliability
  • creates environments to safely test applications

Risks of virtualization

Your organization can introduce security vulnerabilities if you do not properly configure or secure virtualization technology. Risks may include the following:

  • vulnerabilities can be introduced by obsolete and unpatched servers (known as VM sprawl)
  • sensitive data can be compromised by moving VMs
  • entry points, like external access to the device, can be exploited when a VM is offline and dormant
  • hardware can be compromised by malware that spreads from VMs or hypervisors, such as VM escape
  • unauthorized access may be permitted due to virtual separation not offering the required isolation for security baselines, such as privileged access
  • control and visibility can be lost within the virtual environments or networks if traditional security devices are used
  • resources can be exhausted if a hypervisor is compromised or if unauthorized changes are made to configurations
  • protection for each VM is more time consuming as each VM as
    • each VM requires unique considerations and configurations
    • each VM runs individually from the core structure
  • denial of service attack that affects one VM can affect all connected VMs unless quickly isolated

What to consider when selecting a hypervisor vendor

You should choose a hypervisor vendor that can support your organization’s security requirements. Before selecting a vendor, consider the following factors to help support your decision:

  • whether the data is encrypted when it is in transit and at rest
  • the security controls that the vendor has in place to protect sensitive data
  • whether the vendor uses bare-metal or hosted hypervisors
  • whether the vendor has monitoring and auditing capabilities
  • who has access to the data on the server
  • how administrative privileges are controlled
  • whether the vendor gives advice and guidance on configuring, deploying, and hardening the virtualized environment

How to mitigate the risks of implementing virtual technology

Your organization can mitigate some of the risks associated with implementing virtual technology by taking the following 15 actions:

  • Select a trustworthy and reliable vendor
  • Update and patch servers frequently
  • Have your IT team separate the different areas of your virtualized environment (e.g. public, storage, management) into network zones for better control
  • Store highly sensitive data on separate physical servers
  • Test high-risk applications in isolated environments
  • Apply the principle of least privilege to ensure users only have enough privilege to carry out their job functions
  • Use separation of duties to break down processes or tasks into a series of steps to reduce the likelihood of mistakes or malicious activity
  • Implement multi-factor authentication for all accounts
  • Train employees on cyber security best practices and provide role-based training
  • Back up your data regularly
  • Use a security information and even management approach to business operations to streamline the security of assets
  • Install antivirus and intrusion detection or prevention systems on your infrastructure to keep all VMs secure
  • Manage your assets take stock of all infrastructure being used and regularly audit and remove unused VMs
  • Encrypt network traffic and hard drives anywhere sensitive data is stored to protect data in transit and at rest
  • Develop and test an incident response plan

We strongly recommend using bare-metal hypervisors where possible for your organization’s virtualized environments. Bare-metal hypervisors have fewer layers and typically allow for more efficient use of hardware and additional functionality and capabilities compared to hosted hypervisors.

Learn more

]]>https://cyber.gc.ca/en/guidance/universal-plug-play-itsap00008<![CDATA[Universal plug and play (ITSAP.00.008)]]>2025-09-03T18:32:08Z

Universal plug and play (UPnP) is a protocol that allows devices on the same network to automatically discover, connect to and interact with one another. Common examples of devices that use UPnP include:

  • mobile devices
  • smart devices (for example, speakers, televisions and cameras)
  • computers
  • gaming systems
  • printers
  • Wi-Fi devices
  • routers

While UPnP services can be convenient for automating device connectivity, it can expose you to several security risks. We therefore recommend disabling UPnP, especially on perimeter devices such as home routers that manage firewalls, switches and Wi-Fi access points for other connected devices. Before you disable UPnP, check what level of security your devices need, since some require the service to work properly.

On this page

How universal plug and play is used

UPnP is used to connect devices seamlessly within a local network. It allows you to automatically connect smart devices, gaming consoles and computers, media streaming devices and remote device control. UPnP allows compatible devices to interact and work together within a related network for versatility and convenience. Here are some examples of how UPnP is commonly used.

Smart devices

Smart devices use UPnP to communicate with each other, allowing them to automatically adjust settings or change their environment based on the actions of other devices. For example, smart lighting that changes colour or brightness in response to temperature changes detected by a connected smart thermostat.

Gaming consoles and computers

Gaming consoles can discover and connect with each other to join multiplayer sessions and share game content in real time.

Media streaming

Devices that support media streaming can share and stream videos, music and photos among other UPnP-enabled devices.

Remote access

You can use remote device control from a smartphone or computer to control actions or settings on UPnP-supported devices. For example, UPnP can be used to remotely lock or unlock a smart lock to your house.

Related risks

While UPnP-enabled devices are convenient, they also introduce potential security risks because they often operate with minimal authentication or access controls. As a result, devices and networks using UPnP may be exposed to several common threats that can compromise security and privacy.

Malware

Threat actors can compromise UPnP-enabled devices with malware. For example, they may use distributed denial-of-service (DDoS) attacks to configure UPnP devices to be accessible and ready to receive and send data.

Unauthorized access

Any UPnP devices connected to a common network can be compromised by someone who gains access to that network. This could be a threat actor exploiting a device connected to the network or a local user accessing a connected device (for example, an insider threat).

The two main ways devices using UPnP on a network can be compromised include:

  • external threats: attackers who gain unauthorized access to your network (for example, by exploiting a vulnerable device) can target UPnP-enabled devices to manipulate device settings, intercept communications, or install malware
  • insider threats: individuals with legitimate access to the local network that tamper with or misuse UPnP-connected devices, including reconfiguring devices, accessing sensitive data or intentionally weakening network security

Network configuration

UPnP offers control of network configuration settings, such as port forwarding, which threat actors can leverage to bypass firewalls, change access lists, or modify security measures. This makes it difficult to detect and block malicious traffic. Threat actors can also use a UPnP-connected device to manipulate network configuration to expose router web administration details, redirect traffic to malicious external servers, modify credentials and control internal connections and device activities.

Data sharing

Connected UPnP devices share data that allows them to interact with each other and to action certain activities. This can pose a privacy risk if devices that handle sensitive information connect and share data with other devices on the network.

How to secure your devices

The most effective way to protect against UPnP-related attacks is to disable the service entirely. If disabling UPnP is not an option, you can reduce vulnerabilities to your network by:

  • restricting UPnP access by creating a virtual local area network (VLAN) or a separate network zone to isolate UPnP-enabled devices from other devices on your network
  • updating devices regularly and enabling automatic updates where available to further mitigate the risk of threat actors taking control of your devices and leveraging UPnP protocols maliciously
  • logging and regularly monitoring device activity for any irregularities and potential threats
  • regularly reviewing security settings and port-forwarding rules on your router and any other networking devices you own
  • keeping up to date with new and emerging technologies and threats by reading Cyber Centre resources and publications
  • training employees on and spreading awareness of cyber security best practices to identify, understand and manage potential threats to your systems
  • using Canadian Internet Registry Authority (CIRA) tools and services to strengthen security if your router needs to be UPnP-enabled

How to disable universal plug and play on a home router

The steps to disable UPnP on your home router will vary depending on the make and model of the router, but generally, you should follow these 3 steps:

  1. Log into your router's administrative or configuration webpage
  2. Select the UPnP settings that are often found under the "advanced" or the "NAT forwarding" configuration options
  3. Choose the option to "disable UPnP"

If you choose not to disable UPnP on your home router, you can block ports associated with UPnP at the Internet gateway. This helps prevent unauthorized external devices from accessing internal devices using UPnP.

Learn more

]]>