Canada ITSG-33 - IT Security Risk Management
Annex 1: Departmental IT security risk management activities – Canada ITSG-33 - IT Security Risk Management

Canada ITSG-33 - IT Security Risk Management A1-4.2.5: 4.2.5 Conduct a departmental IT security threat assessment

The department conducts an organisation-wide IT security threat assessment, ideally by a multidisciplinary team with the security officer's office and lead GC security agencies, covering key business activities, their security categories, IT-related threats of relevance and general exposures such as a site prone to earthquakes, with strategic options. Threats judged out of scope (for cost, complexity or impact on functionality) are recorded with the decision and justification. The output, a departmental threat assessment report, guides control selection and is reused by IT projects; domain-specific threat reports may refine it.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in Annex 1: Departmental IT security risk management activities – Canada ITSG-33 - IT Security Risk Management

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Canada ITSG-33 - IT Security Risk Management controls