CCCS ITSG-33

ITSG-33, "IT Security Risk Management: A Lifecycle Approach", is the Canadian Centre for Cyber Security's (part of the Communications Security Establishment) guidance for how Government of Canada departments manage IT security risk.

It is Canada's counterpart to the NIST risk management series: Annex 1 describes departmental-level activities (defining security control profiles, roles, and continuous monitoring), Annex 2 describes the information system security implementation process across a project lifecycle, Annex 3A is the security control catalog (derived from NIST SP 800-53 and grouped into management, operational, and technical families), and Annexes 4 and 5 give security control profiles for common protected-B, medium-integrity, medium-availability environments and glossary material.

Departments use it to satisfy the Treasury Board Policy on Government Security and Directive on Security Management, and CCCS's cloud security guidance uses the ITSG-33 profiles to assess cloud service providers for government use.

ITSG-33 does not create a certificate. Systems are authorized by departmental officials after a security assessment, and cloud providers receive a CCCS assessment against the relevant profile that departments rely on.

In writing, a department or supplier needs a security categorization (statement of sensitivity), a selected control profile with tailoring rationale, a system security plan or equivalent describing each control's implementation, assessment evidence, a plan for residual risks, and continuous monitoring reports.