Policy on Government Security

This appendix describes the security controls that are mentioned in subsection 4.1.5 of this policy.

• A.1Security screening is conducted in a way that is effective, rigorous, consistent and fair, throughout all stages of the security screening life cyle to provide reasonable assurance that individuals can be trusted to safeguard government information and assets and can reliably conduct their work duties, and to enable transferability of security screening between departments.
• A.2Information technology security requirements, practices and controls are defined, documented, implemented, assessed, monitored and maintained throughout all stages of an information system’s life cycle to provide reasonable assurance that information systems can be trusted to adequately protect information, are used in an acceptable manner, and support government programs, services and activities.
• A.3Physical security requirements, practices and controls are defined, documented, implemented, assessed, monitored and maintained throughout all stages of the real property and materiel management life cycles to provide reasonable assurance that individuals, information and assets are adequately protected, thereby supporting the delivery of government programs, services and activities.
• A.4Business continuity management is conducted systematically and comprehensively to provide reasonable assurance that in the event of a disruption, the department can maintain an acceptable level of delivery of critical services and activities, and can achieve the timely recovery of other services and activities.
• A.5Information management security requirements, practices and controls are defined, documented, implemented, assessed, monitored and maintained throughout all stages of the information life cycle to provide reasonable assurance that information is adequately protected in a manner that respects legal and other obligations and balances the risk of injury and threats with the cost of applying safeguards.
• A.6Security requirements associated with contracts and other arrangements are identified and documented, and related security controls are implemented and monitored throughout all stages of the contracting or arrangement process to provide reasonable assurance that information, individuals, assets and services associated with the contract or arrangement are adequately protected.
• A.7Security event management practices are defined, documented, implemented and maintained to monitor, respond to and report on threats, vulnerabilities, security incidents and other security events, and ensure that such activities are effectively coordinated within the department, with partners and government-wide, to manage potential impacts, support decision-making and enable the application of corrective actions.
• A.8Security awareness and training is conducted systematically and comprehensively to ensure that individuals are informed of their security responsibilities and maintain the necessary knowledge and skills to effectively carry out their functions, and to provide reasonable assurance that individuals will not knowingly compromise security and that they understand the potential consequences of not meeting their security responsibilities.

administrative cancellation (annulation pour des raisons administratives)

A decision recorded on an individual’s security screening file that the security screening process has been discontinued or the reactivation period has elapsed. An administrative cancellation is not recorded as a denial or revocation.

associations (associations))

To unite with a connection or cooperative link with another or others in act, enterprise, business, partnership or collegially, in mind, imagination or person, as a partner, ally, or friend, and including but not limited to circumstances of accompaniment, attendance or presence at an event or with an entity.

authoritative source (source autorisée)

A collection or registry of records maintained by an authority that meets established criteria.

base building security(sécurité de l’immeuble de baseé)

Security safeguards provided by a building custodian to protect the building’s structure and supporting infrastructure.

compartmented information (information cloisonnée)

Information derived from sensitive sources and methods. Access to compartmented information is limited to Top Secret and/or Enhanced Top Secret cleared Canadian citizens who are authorized to access the information after receiving a formal indoctrination. Compartments are implemented by controlling access to information using frameworks known as control systems. Control systems define who may access the information, and under what conditions.

compromise (compromission)

A breach of government security. Includes but is not limited to:

• unauthorized access to, disclosure, modification, use, interruption, removal, or destruction of sensitive information or assets, causing a loss of confidentiality, integrity, availability or value;
• any action, conduct, threat or gesture of a person toward an employee in the workplace or an individual within federal facilities that caused harm or injury to that employee or individual; and
• an event causing a loss of integrity or availability of government services or activities.

criminal conviction (condamnation au criminel)

The outcome of a criminal prosecution which concludes that an individual is guilty of an offence and has:

1. been convicted in Canada of an offence under an Act of Parliament punishable by way of an indictable offence or summary conviction, or
2. been convicted of an offence outside Canada that, if committed in Canada, would constitute an offence punishable by way of an indictable offence or summary conviction under an Act of Parliament.

criminal record (casier judiciaire)

A record of criminal convictions and their dispositions, discharges, and outstanding entries including:

1. Criminal convictions contained in the Identification Databank of the Canadian Police Information Centre, RCMP National Repository of Criminal Records and/or police of jurisdiction databases; or
2. Foreign criminal convictions for offences which would have been an offence punishable by way of an indictable offence or summary conviction under Canadian law had it been committed in Canadian jurisdiction; or
3. Outstanding entries, such as charges, warrants, judicial orders, peace bonds, probation and prohibition orders; or
4. Absolute and conditional discharges as set out in section 730 of the Criminal Code.

Note: The release of criminal record information is governed by sections 4 to 6.4 of the Criminal Records Act, the Youth Criminal Justice Act, the Privacy Act, the Criminal Code, and directives from the Minister of Public Safety on the release of criminal record information.

critical service or activity (service ou activité critique)

A service or activity whose disruption would result in a high or very high degree of injury to the health, safety, security or economic well-being of Canadians or to the effective functioning of the Government of Canada.

evidence of identity ( preuve de l’identité)

A record from an authoritative source indicating an individual’s identity. There are two categories of evidence of identity: foundational and supporting.

foundational evidence of identity (preuve de l’identité essentielle) 

Evidence of identity that establishes core identity information such as given name(s), surname, date of birth, and place of birth. Examples are records of birth, immigration or citizenship from an authority with the necessary jurisdiction.

government security (sécurité du gouvernement)

The assurance that:

• information and assets that support government programs are protected throughout their life cycle against threats to their confidentiality, integrity, availability or value;
• employees in the workplace and individuals within federal facilities are protected against actions, conduct, threats or gestures of persons that could cause them harm or injury;
• continuity of government operations can be maintained during situations that may disrupt normal operations; and
• the Government of Canada can maintain the delivery of programs and services in the presence of threats to their integrity or availability.

internal enterprise services (services internes intégrés)

A service provided by a Government of Canada department to other Government of Canada departments intended on a government-wide basis.

internal enterprise service organization (organisation de services internes intégrés)

A department or organization that provides internal enterprise services to other Government of Canada departments. This includes lead security agencies that deliver government-wide security services.

identity (identité)

A reference or designation used to distinguish a unique individual, organization or device.

loyalty to Canada (loyauté envers le Canada)

A determination that an individual has not engaged, is not engaged, nor is likely to engage in activities that constitute a "threat to the security of Canada" as defined in section 2 of the Canadian Security Intelligence Service Act.

Need-to-know (besoin de connaître)

A criterion used by the custodian(s) of sensitive information, assets or facilities to establish, prior to disclosure or providing access, that the intended recipient must have access to perform their official duties.

other individuals (autres particuliers)

Any persons who is not an employee to whom the government may need to provide access to sensitive information or assets, or access to facilities.

residual risk (risque résiduel)

In the context of the Policy on Government Security, the level of security risk remaining after the application of security controls and other risk mitigation actions.

security and intelligence functions (activités de sécurité et de renseignement de sécurité)

Functions that contribute to the safety of Canadians and the national security of Canada, including taking the appropriate measures to prevent and protect against threats while enforcing Canadian statues and supporting Canada’s national interests.

security assessment (évaluation de sécurité)

The ongoing process of evaluating security practices and controls to establish the extent to which they are implemented correctly, operating as intended, and achieving the desired outcome with respect to meeting defined security requirements.

security authorization(autorisation de sécurité)

The ongoing process of obtaining and maintaining a security risk management decision and to explicitly accept the related residual risk, based on the results of security assessment.

security categorization (categorisation de sécurité)

The process of assigning a security category to information resources, assets or services based on the degree of injury that could reasonably be expected to result from their compromise.

security clearance (autorisation de sécurité)

The standard of security screening for all positions requiring access to Government of Canada classified information, assets, facilities or information technology systems. Security screening for a security clearance appraises an individual’s loyalty to Canada and their reliability as it relates to that loyalty. Security screening for security clearance can include enhanced inquiries, verifications and assessments when duties involve or directly support security and intelligence functions.

security conditions (conditions de sécurité)

A condition(s) attached to the granting of a security status or clearance that details an individual’s eligibility to access to sensitive information or assets, and facilities. Security conditions may be used when, despite concerns encountered in the security screening of an individual, a risk management decision is made to engage the individual on the basis that the duties cannot be performed by another.

security control (mesure de sécurité)

A legal, administrative, operational or technical measure for satisfying security requirements.  This term is synonymous with “safeguard.”

security event (événement lié à la sécurité)

Any event, act, omission or situation that may be detrimental to government security, including threats, vulnerabilities and security incidents.

security function(fonction de sécurité)

Activity that directly supports the achievement of government security objectives, including security screening, information technology security, physical security, business continuity management, information management security, security in contracts and other arrangements, security event management, security awareness and training, and the overall management of security (including governance, planning, monitoring and reporting). 

security incident (incident de sécurité)

Any event (or collection of events), act, omission or situation that has resulted in a compromise.

security practices (pratiques de sécurité)

Processes, procedures and standards that govern the implementation, monitoring and maintenance of security controls.

security requirement (exigence en matière de sécurité)

A requirement that must be satisfied in order to reduce security risks to an acceptable level and/or to meet statutory, regulatory, policy, contractual and other security obligations.

security screening (filtrage de sécurité)

The process of conducting a security screening activity and evaluating an individual’s reliability and/or loyalty to Canada in support of a decision to grant, grant with conditions, deny, or revoke a security status, security clearance or site access status or site access clearance.

security status (cote de sécurité)

The minimum level of security screening for positions requiring unsupervised access to Government of Canada information, assets, facilities or information technology systems. Security screening for reliability status appraises an individual’s honesty and whether they can be trusted to protect the employer’s interests. Reliability status may also be referred to herein as a security status.

senior official (haut fonctionnaire)

For the purposes of the Policy on Government Security, individuals designated by the deputy head in the departmental security governance as having overall responsibility for the security aspects of a program, service or activity area or for a security function. Senior officials may include program officials, chief financial officers, chief audit executives, chief information officers, chief privacy officers and other officials designated pursuant to a statutory requirement, Treasury Board policy or other requirement. Senior officials also include individuals designated by the deputy heads of internal enterprise service organizations to oversee their internal enterprise service activities under the Policy on Government Security.

sensitive information or asset(renseignement ou bien de nature délicate)

Information or asset that if compromised would reasonably be expected to cause an injury. This includes all information that falls within the exemption or exclusion criteria under the Access to Information Act and the Privacy Act. This also includes controlled goods as well as other information and assets that have regulatory or statutory prohibitions and controls. 

supporting evidence of identity (preuve à l’appui de l’identité)

Evidence of identity that corroborates the foundational evidence of identity and assists in linking the identity information to an individual. It may also provide additional information such as a photo, signature or address.

threat (menace)

Any potential event or act, deliberate or unintentional, or natural hazard that could result in a compromise.

trusted digital identity (identité numérique de confiance)

An electronic representation of a person, used exclusively by that same person, to receive valued services and to carry out transactions with trust and confidence.

trust framework (cadre de fiabilité)

In the context of the Directive on Identity Management, a set of agreed on definitions, principles, conformance criteria, assessment approach, standards, and specifications.

vulnerability (vulnérabilité)

A factor that could increase susceptibility to compromise.