Canada ITSG-33 - IT Security Risk Management A1-4.2.7.1: 4.2.7.1 Define business domains

The department groups its business activities into business domains characterised by their security categories and relevant threats, since domains with different protection needs need different profiles. Each domain definition records the business objectives, processes and information assets, the domain's security category, the relevant threat environment, and the level of risk the business community accepts when relying on information systems.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 1: Departmental IT security risk management activities – Canada ITSG-33 - IT Security Risk Management

A1-4.2.1 4.2.1 Define the scope of the IT security risk management activities
A1-4.2.2 4.2.2 Identify business needs for security
A1-4.2.3 4.2.3 Categorize the security of departmental business activities
A1-4.2.4 4.2.4 Define the departmental IT security threat and risk assessment methodology
A1-4.2.5 4.2.5 Conduct a departmental IT security threat assessment
A1-4.2.6 4.2.6 Specify security control objectives
A1-4.2.7.2 4.2.7.2 Define IT security approaches
A1-4.2.7.3 4.2.7.3 Develop departmental security control profiles

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls