Canada ITSG-33 - IT Security Risk Management A1-4.2.3: 4.2.3 Categorize the security of departmental business activities

The department determines the security category of each business activity, the highest expected injury from IT-related compromise for confidentiality, integrity and availability, following section 6: identify the business processes and related information assets; assess the injuries from compromise to national and non-national interests and their level on the five-level scale (very low to very high), considering aggregation, inference and interdependency; set the category at the high-water mark unless analysis justifies more; and prepare a security categorization report giving, for each process and information asset, a description, the expected injuries, their levels and the rationale, marked for example (Protected B, Medium integrity, Medium availability).