Canada ITSG-33 - IT Security Risk Management
Annex 1: Departmental IT security risk management activities – Canada ITSG-33 - IT Security Risk Management

Canada ITSG-33 - IT Security Risk Management A1-4.2.6: 4.2.6 Specify security control objectives

The department specifies standardised security control objectives, mapped to the business needs for security, that guide the selection and tailoring of controls, drawing on the objectives in the TBS directive and sources such as ISO 27001 Annex A, and defines metrics (for example from ISO 27004) to measure control performance. Inputs are the scope, the business needs for security, the organisation-wide threat assessment and any enterprise security architecture artefacts. The output is the list of departmental security control objectives.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in Annex 1: Departmental IT security risk management activities – Canada ITSG-33 - IT Security Risk Management

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Canada ITSG-33 - IT Security Risk Management controls