Standard on Security Screening

Security screening requirements are determined by the duties to be performed and by the sensitivity of information, assets or facilities to be accessed, and in accordance with the Position Analysis tool and guidance issued by the Secretariat.

Standard screening is conducted for all duties or positions in the federal government and for other individuals with whom there is a need to share or provide access to sensitive or classified information, assets or facilities, when responsibilities do not relate to security and intelligence functions.

Enhanced screening is conducted in limited and specific circumstances, and in accordance with the following criteria:

• When duties or positions involve, or directly support, security and intelligence (S&I) functions, including access to sensitive law enforcement or intelligence-related operational information, (i.e., sources or methodologies);
• When duties or positions involve direct joint operational activity with S&I departments or agencies;
• When duties or positions involve the provision of services to S&I departments or agencies which include management of, or access to, an aggregate of S&I information; or
• When duties or positions, and related access to sensitive information, create a high risk that an individual may be influenced by criminal or ideologically motivated persons or organizations.

There are three levels of security screening: reliability status, Secret security clearance, and Top Secret security clearance. Whenever the terms "status" or "clearance" are used, they encompass both standard and enhanced screening, unless otherwise specified.

The following table describes the standard and enhanced security screening activities.

The criteria for determining the security screening requirements of positions are established in accordance with guidance issued by the Treasury Board of Canada Secretariat. Security screening requirements are based on criteria that reflect the following:

1. The duties to be performed;
2. The sensitivity of the information, assets or facilities to be accessed;
3. The level of authority or control exercised by the position; and
4. The degree of injury that could result from compromise of sensitive government information, assets or facilities to be accessed.

The following tables summarize how these criteria apply to each security status or clearance level and list the associated access permissions that may be granted.

In all cases, access to information, assets, facilities or information technology (IT) systems is determined and provided based on a need-to-know or need-to-access. Knowledge and access can vary even among individuals who work in the same department or program area or who perform the same duties.

A security clearance alone does not permit access to compartmented information. Access to compartmented information requires authorization in accordance with the standards set by the control system owner for each control system to which access is required. These standards include a briefing and signed acknowledgement by the individual of their responsibility to protect compartmented information from unauthorized exposure. Once an individual is given access they must handle the compartmented information according to the standards set by the control system owner.

Site Access screening is conducted when there is a need for other individuals, who are not employees, to have access to restricted or protected areas or facilities. Site Access screening does not provide for access to sensitive government information.

Security screening for site access must be demonstrably proportionate to the perceived risk and appropriate to the situation. In some circumstances, it may be a preferable option to escort workers rather than to conduct security screening when the risk is low or access is required on a "one-off" basis. On the other hand, security screening in itself may not necessarily eliminate the need to escort workers when the possibility to cause injury is high.

There are two types of site access screening: site access status and site access clearance. Site access status is conducted when reliability is the primary concern. Site access clearance may be conducted when loyalty to Canada is the primary concern.

Site Access Status

5 year background information

• Verification of identity
• Law enforcement inquiry (criminal record check)

Site Access Clearance

5 year background information

• Verification of identity
• Law enforcement inquiry (criminal record check)
• Security Assessment (CSIS)

Additional inquiries, verifications or assessments may be conducted as defined by the Position Analysis Tool and can include: personal and professional references, security interview, law enforcement record check (LERC), and/or polygraph examination.

Validity period
Up to 10 years.
Security screening may be updated more frequently when employment has lapsed for 12 months or more.

Criteria for Determining Type of Site Access Screening

The criteria for determining the type of site access screening is established in accordance with guidance issued by the Treasury Board of Canada Secretariat. Security screening requirements are based on criteria that reflect the following:

1. The nature of department or program operations;
2. Whether the individual will be escorted or unescorted;
3. Whether the individual requires access to the exterior or interior of a facility;
4. Whether the primary security concerns relate to reliability or loyalty; and
5. The possibility of the individual overviewing or overhearing sensitive conversations.

The following table identifies the screening activities and update cycles for each type of security screening. In general, security screening activities conducted for initial screening should not be redone unless they were not done or were improperly done originally.

Site Access screening can be valid for up to ten years from the date of issue. However, since Site Access screening is conducted for other individuals who may not be engaged with the federal government on an on-going basis, practices related to reactivation and expiry described in Appendix F will apply in respect of security screening verifications, inquiries and assessment which may be repeated when the person has not been engaged or inactive for a period of 12 months or more. The following table identifies the screening activities and update cycles for site access screening and the associated security screening activities

Site Access Status

5 year background information

• Verification of identity
• Law enforcement inquiry (criminal record check)

Site Access Clearance

5 year background information

• Verification of identity
• Law enforcement inquiry (criminal record check)
• Security Assessment (CSIS)

Additional inquiries, verifications or assessments may be conducted as defined by the Position Analysis Tool and can include: personal and professional references, security interview, law enforcement record check (LERC), and/or polygraph examination.

Validity period
Up to 10 years.
Security screening may be updated more frequently when employment has lapsed for 12 months or more.

The following table describes the purpose and practices associated with each security screening activity and how they serve to assess an individual's reliability or loyalty to Canada, as applicable.

The models in the preceding pages identify the security screening activities associated with each status or clearance for both initial screening and for updates. Certain security screening activities may also be conducted when the duties or position warrant additional security screening as defined by the Position Analysis Tool or for cause when information is uncovered or reported about an individual that may call into question his or her reliability or loyalty to Canada.

In general, security screening activities associated with reliability status are conducted in a particular order to ensure that the basic elements of honesty and trustworthiness are established before more in-depth verifications, inquiries or assessments are undertaken. Once basic reliability is substantiated, some security screening activities may be conducted in parallel.

The collection, use, disclosure, retention and disposal of personal information for the purpose of security screening is carried out in accordance with the Privacy Actand associated policies, directives, standards and guidelines.

The description, purpose and consistent uses of that information are contained in the relevant Standard Personal Information Banks found in Info Source. Info Source provides information about the functions, programs, activities and related information holdings of government institutions subject to the Access to Information Act and the Privacy Act; and provides government employees (current and former) and other individuals with relevant information to help them access personal information about themselves held by government institutions subject to the Privacy Act and to exercise their rights under the Privacy Act.

Personal information for the purpose of security screening is collected from individuals using forms and tools issued and/or approved by the Treasury Board of Canada Secretariat (TBS). Security screening forms are designed to collect relevant, verifiable information about an individual and, when appropriate to the type of screening, information about the individual's spouse, co-habitants and family members.

Individuals may also be required to provide other personal information to support the security screening process. That information may include vital events credentials (e.g., birth certificate, passport), biometrics (e.g., digital photographs, fingerprints), or letters of reference or referral (see the section titled "Out-of-Country Checks" in Appendix D).

All forms produced to automate the collection, disclosure and handling of personal information for security screening must be designed to collect only the specific elements or categories of information required for the screening, as defined in the TBS-issued forms.

Requirements pertaining to the collection, use, disclosure, retention and disposal of information, as defined in Standard Personal Information Bank PSU 917 (Personnel Security Screening) apply equally to automated repositories, as do other procedures outlined in this Standard and in other Treasury Board policies, directives, standards and guidelines.

Before any system to collect, process and manage personal information is put into operation, a risk assessment and a privacy impact assessment must be conducted, and security and privacy concerns must be mitigated to ensure that personal information is protected in accordance with the Privacy Actand related policy instruments.

Personal information created, collected, used, disclosed and retained for the purpose of security screening is defined in Standard Personal Information Bank PSU 917 (Personnel Security Screening).

Personal information of contractors collected, used, disclosed and retained for the purpose of security screening is defined in Public Works and Government Services Canada's PCU 015 (Industry Personnel Clearance and Reliability Records).

Departments and agencies that maintain institution-specific personal information banks must ensure that they are kept up to date to reflect, at a minimum, the purpose, uses, disclosure, retention and disposal of information defined in PSU 917 (Personnel Security Screening).

To facilitate cross-referencing, the following Standard Personal Information Banks are also authorized to contain a copy of the Security Screening Certificate and Briefing Form:

1. Employee Personnel Record (PSE 901);
2. Governor in Council Appointments (PSU 918);
3. Members of Boards, Committees and Councils (PSU 919);
4. Identification and Building-Pass Cards (PSE 917); and
5. Security Incidents (PSU 939).

In order for security screening to be conducted, individuals must provide their consent. By consenting, they authorize the indirect collection and the disclosure of information for security screening purposes. Until consent is obtained, information cannot be collected, used or disclosed.

Consent must be obtained for all initial security screenings, and it remains valid for updates or reviews of status or clearance for as long as an individual remains an employee or under contract or assignment to the Crown, or until the individual formally withdraws consent.

Although consent remains valid for the duration of employment, as a matter of prudence, individuals should be given the opportunity to confirm or withdraw their consent each time they complete forms for the purpose of security screening. If the security screening requirements have changed since the last time the individual's consent was obtained, consent must be confirmed to ensure that the person understands the security screening activities being consented to.

Only applicants who have reached the age of 18 can provide consent. When security screening is being conducted for an individual who has not yet reached the age of 18, the consent of a parent or guardian is required.

When an individual persistently delays, refuses to provide, or withdraws, in full or in part, consent or willingness to provide supporting documentation (e.g., vital events credentials, biometrics) for an initial security screening, screening activities are to cease and the person is to be informed that:

1. Security screening cannot continue without his or her consent or the required documentation or information;
2. Failure to provide consent or the required documentation or information will result in his or her no longer being considered for appointment, employment, contract or assignment; and
3. The security screening action will be administratively cancelled until the required documentation or information is obtained. (Note: Administrative cancellation of security screening is not recorded as a denial or revocation of status or clearance.)

When an individual's security status or clearance is being updated or upgraded and the person refuses to provide consent or the required information, the person's existing security status or clearance must be suspended and reviewed for cause, and the human resources unit should be consulted.

Consequences to individuals for not providing consent or for failing to provide information can include administrative cancellation of their security status or clearance. This administrative cancellation will result in the individual no longer meeting the condition of employment and could result in termination of employment or cancellation of a contract.

Personal information collected in security screening forms must be disclosed to security screening service providers both in government (e.g., the Canadian Security Intelligence Service (CSIS) and the Royal Canadian Mounted Police (RCMP)) and outside government (e.g., credit bureaus) in order for the verifications, inquiries and assessments required for security screening to be conducted.

These verifications, inquiries and assessments can include the validation of personal information against operational records, data banks, data holdings, and intelligence sources for the purpose of assessing an individual's reliability and/or loyalty.

Personal information, combined with the decision to grant, grant with a security waiver, deny, revoke or suspend a security status or clearance, may also be used to create a security profile for the purpose of managing Government of Canada credentials required to access information, assets and facilities (e.g., building passes and digital certificates). The relevant personal information banks need to reflect the purposes, uses and disclosure of information and be kept up to date.

Personal information created, collected, used, disclosed, retained and disposed of for the purpose of security screening will be safeguarded in accordance with government standards for the protection of personal information, as well as the Directive on Privacy Practices. The level of categorization, and thereby protection, depends primarily on the sensitivity of the reports produced by CSIS or the RCMP.

Access to, disclosure and handling of personal security screening information is to be monitored, documented, and limited to those who have a need to access it and who have a valid security status or clearance, using appropriate administrative, technical and physical security controls.

Files will be created for each individual who undergoes security screening. These files contain relevant personal information, actions taken and decisions rendered in relation to the individual's security screening. Security screening service providers may also maintain records for audit purposes and for use when conducting security screening for updates or upgrades.

Staff responsible for maintaining security screening files must take all reasonable steps to ensure that personal information is accurate, up-to-date and appropriately protected. Security screening files are to be updated whenever a change is reported in an individual's personal circumstances (e.g., a criminal conviction, personal bankruptcy), and whenever there is a change in an individual's security status or clearance (e.g., update, upgrade, administrative cancellation). Any decisions made with respect to these actions, as well as the rationale for the decisions, must be recorded. All information related to criminal offences for which the individual received a suspension must be removed from the file.

The following information is to be recorded, maintained and updated as necessary:

1. Completed original copies of security screening forms and questionnaires;
2. Relevant results of all security screening verifications, inquiries and assessments;
3. Analysis of results and any advice or recommendations to support decision-making;
4. Decisions to grant, grant with a security waiver, deny, revoke, suspend pending investigation, or administratively cancel a security status or clearance; and
5. Relevant information related to any waiver, temporary access, review for cause, or investigation, and any ensuing decisions.

When an individual changes department or agency, permanently or temporarily, or when a contractor moves between contracts, the individual's security file will be made available or transferred, in the case of a permanent move, to the receiving departmental security officer (DSO) or delegated official, upon request and in a timely manner. With the following exceptions, the contents of the file should not be removed or withheld from the receiving department:

1. When the file contains a classified CSIS security assessment, the sending department or agency must remove the assessment from file, return it to CSIS, and advise the DSO or delegated official of the receiving department of the existence of the assessment who will obtain an updated assessment from CSIS before rendering a decision; and
2. When the file contains a record of discharge under section 730 of the Criminal Code, it is not to be disclosed to any person or transferred to another department or agency, nor shall the existence of the record or the fact of the discharge be disclosed without prior approval of the Minister of Public Safety if:
   • More than one year has elapsed since the individual was discharged absolutely; or
   • More than three years have elapsed since the individual was discharged on the conditions prescribed in a probation order.

Any other adverse information must be revalidated with the appropriate security screening service provider before a decision is rendered to ensure that the information is still relevant. As appropriate, updated information required for the security status or clearance should be obtained and evaluated by the receiving department or agency before a decision is made to accept the transfer.

A few departments or agencies may have authority to conduct inquiries against data sources they maintain. For example, the Canada Revenue Agency (CRA), as a separate employer, may query its internal intelligence sources to assess an individual's suitability for employment with it. The results of these types of department-specific checks cannot be included in an individual's security screening file or shared with another department, including security screening service providers.

Security screening files contained in Personal Information Bank PSU 917 (Personnel Security Screening) are retained for at least two years following an individual's departure from the federal public service to ensure that the individual has a reasonable opportunity to obtain access to the information in his or her file. CSIS may retain records of assessments and associated information relating to the file for longer because of Security Intelligence Review Committee requirements or because of national security requirements.

When a request for access to the information has been received, the information will not be destroyed until such time as the individual has had the opportunity to exercise all of his or her rights under the Privacy Actor theAccess to Information Act.

Security screening files of individuals who have been denied or revoked a security status or clearance will be retained for at least 10 years following their departure from the federal public service before being destroyed to help ensure that these individuals are not engaged by a department or agency without regard to the denial or revocation.

Security screening files of individuals who have left the employment of the federal public service are not transferred to the departmental Personnel Records Centre or to any Federal Records Centre of Library and Archives Canada.

Decisions about an individual's security status or clearance are based on information gathered during the security screening process.

The information that is gathered is analyzed to ensure that it is pertinent to the decision being made, that it is derived from one or more authoritative sources that report the same facts, and that it is attributable to the individual who is being assessed.

Decision making involves evaluating the sensitivity of the position and the work environment in which the duties will be performed; evaluating the risks associated with making the appointment or issuing a contract, or with giving the individual access to sensitive information, assets, or facilities; and a judgment of whether such risks are acceptable. The decision must be based on an adequate amount of verifiable information to ensure that it is fair, objective and defensible. The final decision is the responsibility of the deputy head or delegated official.

A negative decision may be rendered when information is uncovered that raises a reasonable doubt as to an individual's reliability or loyalty to Canada. A negative decision means that an individual cannot be issued an unconditional offer of employment, appointed to a position, assigned duties, or awarded a contract. When consideration is being given to rendering a negative decision, individuals must be informed, provided with reasons for the decision (unless the information is not to be disclosed under the Privacy Act or other applicable legislation) and given an opportunity to respond to the information.

All information considered in rendering a decision, along with any follow-up action and the decision itself, must be recorded in the individual's security screening file. Decisions made to grant, deny, revoke, suspend or administratively cancel a clearance or a site access clearance must be communicated to the Canadian Security Intelligence Service (CSIS) so that it can update its systems accordingly.

In arriving at a security screening decision, officials are expected to provide a fair and objective evaluation that respects the rights of the individual.

Adverse information concerning an individual is assessed with respect to the following:

• Its nature and seriousness;
• How recent it is;
• The surrounding circumstances, including frequency of the incident(s), the individual's willingness to participate, the individual's maturity at the time of the incident(s), the degree of rehabilitation since the incident(s), the potential for pressure, coercion, exploitation or duress; and
• Its implications for the individual's reliability and whether the individual has been open about the information and has resolved, or appears likely to resolve, the concerns to which it gives rise.

When considering the significance of personal circumstances or behaviour that could lead to vulnerability, officials will not allow their own personal and cultural bias to affect their judgment. An individual's personal circumstances or behaviour are only of security significance if they cause vulnerability to pressure or improper influence, or if they could cause the individual to commit a security breach.

Individuals will be notified when a security status or clearance has been granted.

When consideration is being given to denying or revoking a security status or clearance, individuals must be informed in writing and be provided with reasons, unless the information is not to be disclosed under the Privacy Act or other applicable legislation. They must also be given an opportunity to validate or refute adverse information.

The following sections summarize the most typical concerns encountered in security screening, matters to be taken into consideration when rendering a decision, and required action.

Normally, when identity or biographical information cannot be verified despite reasonable, genuine and demonstrable effort, a decision cannot be made and the security status or clearance must be denied and the individual advised of his or her rights of redress.

The verification of biographical information typically covers the number of years of background information required by the specific level of security status or clearance. The inability to verify the required number of years of background information, however, must not be considered as an absolute reason not to grant a security status or clearance. Efforts must be made to avoid systematically applying, or appearing to do so, the requirement for the specified number of years of background information. A degree of latitude should be provided when considering the period of coverage that can be obtained.

Before rendering a decision to deny a security status or clearance:

1. Reasonable and genuine efforts must be made to obtain the necessary information and be shown to have failed;
2. In the absence of some but not all of the required years of background information, efforts must be made to consider reasonable alternative forms of information about the individual from substitute sources, such as additional references, and/or a security interview to give the individual an opportunity to explain the circumstances and to correct or provide additional information; and
3. A determination must be made that such alternative measures cannot mitigate the risk associated with granting the individual the required security status or clearance.

For security screening to be meaningful and accurate, individuals must have lived in Canada for a sufficient period of time to enable appropriate inquiries, verifications and assessments to be conducted. Although a lack of sufficient Canadian residency in and of itself is not necessarily a barrier to the granting of a security status or clearance, decision makers will need to consider what checks can be carried out and the information available upon which to make a decision. Depending on the status or clearance required, this may range from 5 to 10 years.

Individuals who have lived outside of Canada for longer than six months in a row within the time period required by the security status or clearance will be required to account for their activities during that time, unless the time spent abroad was related to their employment or assignment with a Government of Canada department or agency or with the Canadian Armed Forces. Such accounting could include the following:

1. Letters of reference or referral from foreign embassies and missions in Canada;
2. Canadian embassies or missions in the country in which the individual resided;
3. Information from counterpart security screening organizations in countries with which Canada has entered into bilateral arrangements for the exchange of security screening information;
4. Letters or police clearance certificates from law enforcement agencies in the country in which the individual resided; and
5. Credit summaries from established foreign financial institutions or letters of reference from foreign educational institutions or universities.

Activities accounted for in these ways will be assessed in consideration of the adequacy and reliability of the originating country's record-keeping systems.

Police clearance certificates are different in each country and may also be known by other names, including good conduct certificates and judicial record extracts. The certificates should provide a summary of an individual's criminal record or a declaration of the absence of any criminal record.

If an individual has resided, or currently resides, outside of Canada, information on how to obtain a police clearance certificate can be found on the Citizenship and Immigration Canada's web site.

If an individual has resided, or currently resides, in the United States, the individual may be required to obtain a police clearance certificate from the state police.

The existence of a criminal record can, but may not be, sufficient grounds to deny or revoke a security status or clearance. A criminal record is to be considered in light of matters such as the type of criminal activity, the duties to be performed, the nature and frequency of the offence, and the passage of time.

All information relating to criminal record must be verified. For example, an individual might not report having one, but might have one; an individual might report having one, but the information reported about it might differ from the information reported by the RCMP. A criminal offence for which a suspension has been granted must not be inquired about.

An individual convicted of any of the offences listed in subsection 750(3) of the Criminal Codecannot be granted a security status or clearance unless an order of restoration is granted to that person by the Governor in Council.

Adverse information can, but may not be, sufficient grounds to deny or revoke a security status or clearance. When uncovered, such information is to be used as the basis for further investigation, including a security interview.

When adverse information reflects a recent or recurring pattern of questionable judgment that may negatively affect the performance of duties or that may lead to an inability or unwillingness to safeguard sensitive information, assets or facilities, a review for cause of the security status or clearance previously granted to the individual must be conducted.

When adverse information is uncovered that provides reasonable grounds to suspect that the individual may pose a serious threat to others, or may be involved in fraud or other criminal conduct, the information may be disclosed to law enforcement authorities (e.g., police of jurisdiction).

Adverse information obtained pursuant to a CSIS security assessment is the primary determinant of whether a security clearance or site access clearance can be granted. If there are reasonable grounds to believe that either of the following conditions applies, the security clearance or site access clearance may be denied, revoked, or suspended pending further investigation, as appropriate:

a) In the case of loyalty, the individual has engaged, is engaged, may engage, or may be induced to engage in activities that constitute a threat to the security of Canada as that term is defined in the Canadian Security Intelligence Service Act; or

b) In the case of reliability as it relates to loyalty, because of personal beliefs, features of character, association with persons or groups considered a security threat, or family or other close ties to persons living in countries that pose a security risk to Canada, the individual has acted, is acting, may act or may be induced to act in a way that constitutes a threat to the security of Canada; or the individual has disclosed, may disclose, may be induced to disclose, or may cause to be disclosed in an unauthorized way, sensitive information.

If adverse information is uncovered related to the reliability or loyalty of an individual who is undergoing or who has undergone security screening, it must be reported to the DSO or to the designated security official of client departments and agencies so that appropriate action can be taken to review for cause, deny, or revoke, as appropriate, a security clearance or site access clearance.

A security interview, in addition to being a standard component of enhanced security screening, can also be used as a means to resolve doubt or to address adverse information that is uncovered during security screening. A security interview provides an opportunity for the screening official and the individual to discuss any matters of concern and gives the individual the opportunity to explain the situation before a decision is rendered.

Individuals are to be provided with a statement summarizing the information available to enable them to be reasonably informed of the adverse or missing information, without disclosing any information that could injure national security or endanger the safety of any person, or that would be exemptible under the Privacy Act sections 18, 19, 20 and 21, and subsections 22(1) to 22(3).

When adverse information is uncovered as a result of a law enforcement inquiry conducted by the Royal Canadian Mounted Police (RCMP) or police agency of jurisdiction, or a security assessment conducted by CSIS, the investigative body must be consulted to discuss parameters surrounding the disclosure of that information to the individual before the interview.

Deputy heads are accountable for rendering decisions to deny, revoke, or suspend pending an investigation, a security clearance or site access clearance. Deputy heads may formally delegate authority for the following decisions:

• Decisions to grant or grant with a security waiver, a security status or clearance;
• Decisions to deny or revoke  a security status; and
• Decisions to suspend pending an investigation a security status or a security clearance.

Decisions to deny, suspend or revoke a security clearance cannot be delegated.

The results of security screening must support decisions regarding an individual's reliability, loyalty, and reliability as it relates to loyalty.

All decisions must be made on the basis of the quality, quantity, relevance and credibility of information and intelligence; an evaluation of any risks attached to making the appointment or assignment; and a judgment of whether such risks are acceptable in light of the nature and sensitivity of information to be accessed, the duties to be performed, and the operations of the department or agency.

In determining reliability, the question to be answered is whether the individual can be trusted to safeguard information, assets and facilities, and be relied upon not to abuse the trust that might be accorded and to perform the assigned duties in a manner that will reflect positively on and not pose a security risk to the Government of Canada. In other words, is there reasonable cause to believe that the individual may steal or misuse valuables, exploit assets and information, fail to safeguard information and assets entrusted to him or her, or exhibit behaviour that would reflect negatively on his or her reliability.

In determining loyalty, the question to be answered is whether there is reasonable cause to believe that the individual has engaged, is engaged, or may engage, in activities that constitute a threat to the security of Canada as defined in the Canadian Security Intelligence Service Act and whether he or she has disclosed, may disclose or may be induced to disclose, or may cause to be disclosed in an unauthorized way, sensitive information.

Decision making must be supported by an assessment from the official or organization responsible for conducting the security screening. Information must not be withheld from a deputy head, DSO or delegated official responsible for rendering a decision, unless prohibited by law, such as under the Privacy Act, the Criminal Records Act or other applicable legislation.

When no adverse information is uncovered, or when any doubt as to whether the individual can be trusted to safeguard information, assets or facilities is resolved, the individual can be granted the required security status or clearance.

Individuals are notified of the decision to grant a security status or clearance through a formal process of conducting a security briefing to inform them of the decision and of their personal security responsibilities. Individuals are required to acknowledge their security responsibilities and a record of the decision and acknowledgement must be kept on their security screening file.

When a security clearance is granted, CSIS must be informed of the decision.

Situations may arise when there is an urgent or compelling need to temporarily provide an individual with access to sensitive information, assets or facilities that is beyond what their current security status or clearance allows them to access. In such cases, after assessing the risks associated with doing so, departments or agencies may decide to provide the individual temporary access to information, assets or facilities.

The granting of temporary access does not allow, under any circumstances, access to compartmented information or to information for which access is restricted in accordance with international agreements or special caveats. If such access is required, the associated security screening prerequisites and other requirements must first be complied with (e.g. access to a SIGINT compartment requires a Top Secret clearance and indoctrination in accordance with criteria established by the Communications Security Establishment Canada).

When temporary access is granted, departments and agencies must ensure that that access is controlled and that the individual receives a formal and detailed security briefing on his or her security responsibilities. These responsibilities must be formally documented; must specify the duration of the access; and must be attested to by the individual, the DSO or delegated official, and the custodian of the information to be accessed. The individual must be debriefed following the removal of temporary access and reminded of the continuing responsibility to maintain the confidentiality of the sensitive information to which he or she has had access. The briefing and debriefing must be conducted by the DSO or delegated official, and a copy of the signed agreement must be placed on the individual's security screening file.

Temporary access to classified information for urgent or compelling needs must be limited to less than four months. It is not to be used as a substitute for conducting the required security screening activities for the individual's status or clearance to be upgraded. Measures should be taken to initiate the upgrade process if it is expected that access may be required for longer than four months.

When determining their security screening requirements, departments and agencies should take measures to plan for short periods of absence (e.g., vacations, sick leave, training) to ensure that several individuals in each work unit are security screened to the highest level required based on duties and need to access sensitive information, and to ensure continuity of operations.

If unforeseen circumstances arise and it would not be financially or operationally practical to process a security screening at the higher level, consideration should be given to relying on an individual in another area of the department or agency who has the required security clearance to access to the sensitive information for the purpose of indicating whether immediate action is required, or for taking action, as appropriate. In respect of the need-to-know principle, these individuals must also be briefed and debriefed as described above.

In limited circumstances, when security concerns are encountered during the course of security-screening individuals a department or agency has a demonstrated need to engage to perform duties that cannot be performed by others, a decision may be made to grant a security status or clearance subject to a security waiver.

A security waiver formally details restrictions attached to the granting of a security status or clearance that limit an individual's access to what is essential to perform the assigned duties. The waiver may include additional monitoring or reporting requirements to provide added assurance of an individual's ongoing reliability and/or loyalty to Canada.

A security waiver is not a substitute for the requirement to security-screen individuals at the level required by the position, and the decision to grant a security status or clearance with a waiver can only be made once the individual has undergone security screening.

Conditions specified in a security waiver may include, but are not limited to the following:

1. The department or agency may not allow non-Canadian citizens access to "Canadian eyes only" information unless it includes the person's country of citizenship (see "Foreign Nationals" below);
2. Subject to the provisions of any information-sharing agreements, the department or agency will not grant access to classified information from a foreign government without the written agreement of that foreign government;
3. The department or agency will not grant access to classified information from other departments or agencies without consultation with those departments or agencies;
4. The security status or clearance granted to the individual is not transferable to any other duty or position in the department or agency or to any other department or agency;
5. The department or agency will limit access to sensitive information to that required to perform the specific duty; and
6. Any other condition necessary to minimize the risk to the security of the department, agency or government as a whole.

Individuals are notified of the decision to grant a security status or clearance with a waiver through a formal process of conducting a security briefing. During that briefing, the individual is informed of the decision and of his or her security responsibilities, and signs the security waiver. Individuals are required to acknowledge their security responsibilities and a record of the decision and acknowledgement must be kept in their security screening file. The department or agency is to reassess the security waiver every year, at a minimum.

Foreign nationals who have not been granted a Government of Canada security clearance but who hold a valid security clearance granted by their national government may be eligible to access Canadian government security classified information and assets when their security clearance is recognized by the Canadian government in accordance with a formal arrangement. Such formal arrangements may include a national-level bilateral instrument or a bilateral instrument between individual Canadian and foreign government departments or agencies. The instrument must include provisions for the mutual recognition of security status or clearance and the handling and storage of security classified information and assets.

Departments and agencies must confirm with the security screening service provider whether a bilateral instrument is in effect.

Subject to the provisions of any information-sharing arrangements, a foreign national is not to access information from a third-party foreign government without the written agreement of that foreign government.

A review for cause is a reassessment of an individual's eligibility to hold a security status or clearance previously granted. It is a formal process that is initiated when new information is uncovered or reported about an individual that may call into question their reliability and/or loyalty to Canada. A review for cause requires that an investigation and security interview be conducted (see below). When required, security screening may also be redone.

The review for cause of a security status or clearance and any subsequent decision does not constitute a form of disciplinary action. Rather, it is an administrative action that could result in the termination of an individual's employment, contract or assignment because a security status or clearance is a condition of employment, assignment or contract.

A review for cause may be conducted in parallel to a disciplinary action. In such situations, consultation with departmental or agency human resources management unit is paramount.

When an individual's security status or clearance is not reviewed as a result of actions or inactions that are subject to disciplinary measures, the individual remains eligible to hold a security status or clearance. A disciplinary decision is not to be recorded on the security file unless it relates to a security concern.

A security status or clearance may be suspended pending an investigation of a suspected security breach when the presence of the employee at work poses a security risk or could undermine or impede the investigation. The decision to suspend a security status or clearance is not a determination that the individual is guilty or innocent, but rather that the presence of the individual in the department or agency represents a reasonably serious and immediate security risk to individuals, the department or agency, or the government as a whole. The individual will be suspended without pay.

The onus is on the department or agency to satisfy the existence of a security risk significant enough to warrant the temporary suspension of an individual's security status or clearance. The simple fact that a criminal charge has been laid may not be sufficient to meet that onus.

Before rendering a decision to suspend a security status or clearance pending an investigation, the DSO or the delegated official must first consult with the human resources management unit to ensure that the employer's labour relations obligations are considered and addressed. The employee should be informed in writing of the action to be taken, including the following:

1. The decision to suspend the security status or clearance pending an investigation;
2. The reasons the security status or clearance is being suspended;
3. Any mitigating circumstances and contributing factors that were taken into consideration in reaching this decision; and
4. The manner and time frame in which the suspension will be administered.

A fair and objective investigation must be conducted as expeditiously as possible. Access to information, assets or facilities must be prohibited, pending the completion of the investigation. The department or agency must show that it investigated the suspected security breach to the best of its abilities in a genuine attempt to assess the security risk of reinstating the individual. Departments and agencies must also consider, objectively, the possibility of reinstatement within a reasonable period of time following suspension in light of new facts or circumstances that may come to light during the course of the suspension. These matters, again, must be evaluated in consideration of the existence of a reasonable security risk to the legitimate interest of the department or agency or government as a whole.

Investigations into an alleged security breach must be conducted as soon as possible after the relevant incident. Investigations must be conducted fairly and objectively, and should consider and provide the following:

1. Background information leading up to the relevant security incident or alleged misconduct;
2. Input from the witness or witnesses;
3. The employee's response to the allegation(s);
4. An analysis of the facts; and
5. The conclusion as to whether security has been breached.

In accordance with the principles of procedural fairness, employees should be informed of the alleged security breach and should be given an opportunity to respond. This opportunity is usually provided in the form of an interview, which normally takes place in private.

Individuals are to be notified of concerns leading up to a denial or revocation and are to be given an opportunity to respond to those concerns before a final decision is rendered.

When there is reasonable doubt as to an individual's reliability or loyalty to Canada, or whether the person can be trusted to safeguard sensitive information, assets or facilities, security status or clearance may be denied. A decision to deny a security status or clearance is made at the time the security screening is processed or when an upgrade is performed. In all cases, individuals must be informed in writing of the decision and of their rights of review or redress. They must also be prohibited from accessing sensitive information and assets.

A revocation is an administrative decision to withdraw, following an update or a review for cause, the security status or clearance previously granted to an individual. A decision to revoke a security status or clearance may result in termination of employment or cancellation of a contract. The authority of the deputy head to revoke a security clearance cannot be delegated.

When a revocation is being considered for an employee, the DSO or delegated official is to consult the departmental or agency human resources management unit. When a revocation is being considered for a contractor, the contracting authority must be informed before the contractor is informed. If the individual concerned is on contract, the contract must be terminated. If the individual is an employee of a private organization or firm, the person can be replaced by another employee of that organization or firm who has a valid security status or clearance, otherwise the contract is to be terminated.

In all cases, individuals must be informed in writing of the decision and of their rights of review or redress. They must also be prohibited from accessing sensitive information and assets.

When a decision is made to deny or revoke an individual's security status or clearance, the DSO or delegated official, as appropriate, shall send, within 10 days after the decision is made, a written notice informing the individual of the decision. This notice will also include the reasons for the decision and the information on which the decision is based. The individual must be informed of his or her rights to redress. The letter may not involve full disclosure of information where issues of national security are involved or where such disclosure is not subject to disclosure under federal legislation.

When the decision to deny or revoke relates to a security clearance, the notification must come from the deputy head of the department or agency where the individual is employed.

Any dispute between the DSO or delegated official and the human resources management unit as to the appropriate action to be taken must be resolved before any action to deny or revoke a security status or clearance is taken.

Departments and agencies can consult the Treasury Board of Canada Secretariat and their department or agency's legal services unit about these matters and about the process of notification.

When a security clearance is denied or revoked, CSIS must also be informed of the decision.

When a review for cause is conducted or when a decision is being considered to deny or revoke a security status or clearance, departments and agencies must, while ensuring that the interests of government are protected, ensure that decisions are made using a fair procedure, and that actions and decisions are appropriate to the situation. Departments and agencies must be able to demonstrate and provide evidence that:

1. A fair and objective evaluation was conducted that respected the rights of the individual;
2. The individual was given an opportunity to explain potentially adverse information prior to rendering a decision;
3. The individual was briefed and given written reasons for the decision, unless the information is not to be disclosed under the Privacy Act or for reasons of national security; and
4. The individual was informed in writing of his or her right to redress and review.

Any action or inaction that results in an individual not being granted a security status or clearance will negatively impact the individual and may have serious consequences, up to and including termination of employment or termination of a contract. Individuals who choose to have a decision reviewed may do so through the appropriate channels and must be informed in writing of the redress or review mechanisms available to them.

Employees who want to challenge a decision to deny, suspend or revoke a status may do so through the applicable grievance procedures or file a complaint with the Canadian Human Rights Commission if they believe that the decision was based on one or more prohibited grounds, as listed in the Canadian Human Rights Act.

Individuals from outside the public service, such as applicants and contractors, may complain to the Canadian Human Rights Commission or file an application for judicial review with the Federal Court, according to the specifics of each case.

The Canadian Security Intelligence Service Actestablishes the Security Intelligence Review Committee (SIRC) as the formal review body in cases concerning denial of a security clearance. Pursuant to Section 42 of the Canadian Security Intelligence Service Act, this right of review is available to outside candidates, employees and those contracting with the government who are denied a security clearance by a deputy head that results in:

1. An individual being denied employment, or being dismissed, demoted or transferred or being denied a promotion by reason only of a denial or a security clearance; or
2. An individual being denied a contract to provide goods or services to the Government of Canada by reason only of a denial of a security clearance.

When a deputy head disagrees with a SIRC recommendation to grant or reinstate a security clearance, the Office of the National Security Advisor, Privy Council Office (PCO), must be consulted before a final decision is made. The Chairperson of SIRC must also be informed in writing of the final decision taken by a deputy head in such cases.

Any individual who is denied a security clearance may also file a complaint with the Canadian Human Rights Commission if the individual believes that the decision was based on one or more prohibited grounds, as listed in the Canadian Human Rights Act. If a minister advises the Commission that the basis of the denial relates to the security of Canada, the Commission may either dismiss the complaint or refer the matter to SIRC for investigation before proceeding.

The decision about an individual's eligibility for a security status or clearance that follows the initial security screening process reflects the person's eligibility at a specific point in time. That eligibility can change over time.

Aftercare practices are aimed at providing confidence in an individual's continued reliability and loyalty. Aftercare comprises formal, planned security briefings; security awareness; updates and upgrades; and the reporting of changes in circumstances, unusual contact or incidents. It also involves ongoing monitoring by departmental security officers (DSOs), delegated officials and managers of an individual's continued suitability to hold a security status or clearance.

These practices are essential to help build a culture of security, where individuals understand and implement security policies and practices to safeguard information, assets and facilities and to help ensure that security is not compromised, either negligently or unknowingly.

A security briefing is the last step of security screening and the first step of aftercare.

During a security briefing, individuals are informed of their security responsibilities under the Policy on Government Security and of the access permissions attached to their screening level. Security briefings provide an opportunity for people to ask questions and to develop a better understanding of these responsibilities. A security briefing formalizes the granting of the security status or clearance, as well as the individual's acceptance of and agreement to abide by the security responsibilities.

Security briefings are conducted at various times: before an individual takes up his or her duties, when required based on the update cycle, and whenever a change occurs in screening level.

The standard security briefing covers general security requirements common to all individuals. Some departments and agencies may conduct briefings tailored to their operating and risk environment. Such briefings may provide specific details related to the protection of information, assets and facilities in the context of special duties, notably those related to security and intelligence.

Security awareness is the practice of regularly reminding individuals of their security responsibilities and advising them of emerging issues and concerns.

Security awareness provides individuals with the knowledge and tools necessary to protect information, assets and facilities. Topics addressed through security awareness typically include the following:

1. Workplace security, including building access, the requirement to display security badges, and practices related to monitoring work-related behaviour through access controls;
2. Physical and information-technology security practices related to the proper handling, marking, transport, transmittal, storage and destruction of sensitive information or assets;
3. Emerging security concerns, including security threats from malware, phishing, or social engineering;
4. Minimizing risks inherent in working with sensitive information away from the official workplace (e.g., telework, mobile computing, travel);
5. Methods of coercion and strategies for collecting sensitive government information, and requirements to report security incidents and unusual contacts or contacts with foreign officials;
6. Obligations to report significant changes in personal circumstances that may warrant a review of the status or clearance granted; and
7. Consequences of failure to properly protect information, of circumventing security measures and of security breaches.

The purpose of an update is to reassess individuals' reliability and/or loyalty taking into account changes in their personal circumstances since the time they were last granted a security status or clearance. An update focuses on determining whether changes in personal circumstances pose a potential security risk in light of the duties being performed, and therefore affect eligibility to hold a security status or clearance. The established update cycles do not preclude an update from being done more frequently for cause.

When an update becomes six months overdue because an individual persistently delays providing the personal information necessary to conduct the security screening, consideration will be given to administratively cancelling the individual's security status or clearance until such time as he or she provides the required information. Administrative cancellation of an individual's security status or clearance means that the person no longer meets a condition of employment and could result in termination of employment or cancellation of a contract.

The purpose of an upgrade is to change the status or clearance to a higher level. Until the security screening activity required for the upgrade is completed and the higher level of security screening is officially granted, individuals cannot be provided access to higher levels of sensitive information, assets and facilities.

Temporary access may be granted when there is a need to access sensitive information at a higher level than what an individual's current security status or clearance permits (see Appendix D for details). Temporary access, however, is not to be used as a replacement for conducting an upgrade when the duties to be performed require it.

The need to maintain a culture of security must be balanced with the need for people to trust that they are in a safe environment to do their work, and with individuals' legitimate expectation of privacy. Reporting changes in behaviour and security concerns must never be used as a way to increase personal power, to criticize an individual's work, or to cause embarrassment resulting from actions or thoughts. Departments and agencies must respect individuals' right to privacy, but must continue to assess their behaviour to identify changes or suspicious patterns that could give rise to security concerns.

Departments and agencies must ensure that individuals understand the reporting requirements detailed in the security screening certificate and briefing form, as well as any additional reporting requirements that may be established in departmental or agency procedures. This includes how to report changes or concerns and to whom they should be reported.

Managers, who are in contact with employees and contractors daily, are among the first people likely to recognize changes in behaviour. They are required to report these changes to the DSO or the delegated official.

Managers and employees should be trained so that they understand what they should be looking for and to ensure that they are vigilant. Unusual behaviour that may be cause for concern and should be reported to the DSO or delegated official include, but are not limited to, the following:

1. Drug or alcohol misuse;
2. Sudden or marked changes in financial situation or expenditures (e.g., bankruptcy, unexpected wealth);
3. Expressions of support for extremist views, actions or incidents, particularly when violence is advocated;
4. Unexplained hostile behaviour or communication;
5. Unexplained frequent absences;
6. Indications of fraudulent activity;
7. Disregard for safeguarding sensitive information or assets (e.g., violations, breaches of security); or
8. Persistent or unusual interest in or attempts to gain access to sensitive information, assets or facilities to which an individual has no work-related need to access.

All individuals are required to report information related to a change in personal circumstances that may affect the security status or clearance they have been granted. Reporting requirements are detailed in the Security Screening Certificate and Briefing Form. At a minimum, individuals are required to report the following:

1. Change in criminal record status (criminal conviction, suspension of a criminal record, other judicial prohibitions);
2. Involvement with law enforcement (e.g., suspect in a criminal investigation, arrest); and
3. Association with criminals; and
4. Significant change in financial situation (e.g., bankruptcy, unexpected wealth).

Individuals who work in S&I organizations may be required to report additional changes in their personal or legal status, including a change in marital status.

Persistent or unusual contact from another individual, or attempts by another individual to obtain access to sensitive information, assets or a facility without proper authorization must be documented and investigated. Such targeting can occur at all levels and ranks of a department or agency.

Most attempts to collect sensitive information or intelligence are subtle and often appear innocuous. The following situations are to be reported:

1. Unusual or persistent contact or any attempt by an unfamiliar individual to access information, assets or facilities;
2. Planned or unplanned contact with embassy or foreign government officials, foreign officials or foreign nationals in Canada or outside Canada, when such contact is outside of regular duties; and
3. Actual or potential security incidents or concerns.

A security status may be reactivated within 2 years, and a security clearance may be reactivated within 12 months without the need to redo security screening when the following conditions apply:

1. An individual has terminated employment or taken a leave of absence with the government and subsequently returned, and there is no adverse information or a security waiver on file; or
2. Private sector individuals have terminated a government contract and subsequently entered into a new contract or require access to sensitive government information during a pre-contractual phase for the purpose of bidding.

In all cases, individuals will be required to account for their activities during the period of absence, as well as for the circumstances surrounding their departure. A security status or clearance will not be reactivated for any reason if the circumstances surrounding the departure involved a review for cause, a revocation or a suspension pending an investigation, or if the departure related to discipline for other reasons.

Once an individual's reactivation period has elapsed, and if there has been no activity on the file, the security status or clearance will expire. If the person wants to reintegrate into the federal government or participate in a government contract he or she will have to undergo an initial security screening process to meet the condition of employment or condition of a contract.

When the security status or clearance required by the receiving department is at the same or lesser level as the one previously granted to an individual, the security status or clearance may be accepted by the receiving department or agency at par and should only be redone in the following situations:

1. The results are more than five years old;
2. There is evidence to suggest that the security screening was not previously done in accordance with this Standard;
3. There is a security waiver attached to the status or clearance;
4. Results of law enforcement inquiries or security assessments have been removed from the file; or
5. There is adverse information on file that may represent a security risk to the receiving department or agency.

When enhanced screening is required, security screening will be reviewed accordingly, and additional inquiries, verification or assessments may be conducted in accordance with the requirements of the status or clearance.

In all other cases, the security screening will be redone to ensure that the receiving department bases its decision on current and relevant security screening. DSOs or delegated officials must ensure that they obtain and review an incoming individual's security file before formally granting the required security status or clearance.

Upon termination of employment, engagement or assignment, all individuals will receive a formal debriefing to remind them of their continuing responsibilities to maintain the confidentiality of the sensitive information to which they have had access. All authorities and access permissions are to be reclaimed, including identification and access badges, and physical and logical access keys. DSOs or delegated officials, in consultation with departmental human resource advisors, must develop procedures and ensure that debriefings and reclamations are scheduled and conducted as a component of the overall separation process. The Security Screening Certificate and Briefing Form will be used to record that termination procedures have been completed.