Canada ITSG-33 - IT Security Risk Management A1-4.2.1: 4.2.1 Define the scope of the IT security risk management activities

The department defines the scope of its IT security risk management activities: the programs, services and business activities needing protection, the major IT assets (applications, systems, data centres, networks, data) and where they are, and the core technologies in use. The scope states what is inside and what is excluded and why, and identifies external dependencies such as services from external providers.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 1: Departmental IT security risk management activities – Canada ITSG-33 - IT Security Risk Management

A1-4.2.2 4.2.2 Identify business needs for security
A1-4.2.3 4.2.3 Categorize the security of departmental business activities
A1-4.2.4 4.2.4 Define the departmental IT security threat and risk assessment methodology
A1-4.2.5 4.2.5 Conduct a departmental IT security threat assessment
A1-4.2.6 4.2.6 Specify security control objectives
A1-4.2.7.1 4.2.7.1 Define business domains
A1-4.2.7.2 4.2.7.2 Define IT security approaches
A1-4.2.7.3 4.2.7.3 Develop departmental security control profiles

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls