Canada ITSG-33 - IT Security Risk Management
Annex 1: Departmental IT security risk management activities – Canada ITSG-33 - IT Security Risk Management

Canada ITSG-33 - IT Security Risk Management A1-4.2.7.2: 4.2.7.2 Define IT security approaches

The department defines the IT security approaches that will steer control selection and security design, consistent with its security philosophy and priorities, using the business needs, security categories, threat assessment, control objectives and recognised principles (such as ITSG-38, ITSG-22, NIST SP 800-27 and 800-14). Examples are holistic versus piecemeal design, defence in depth, perimeter versus endpoint protection, security modes of operation, multi-tier incident handling (prevent, detect, analyse, respond, recover), zoned tiered architectures, common security services, securing data versus infrastructure, usability versus strictness, and fail-closed versus fail-open.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in Annex 1: Departmental IT security risk management activities – Canada ITSG-33 - IT Security Risk Management

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Canada ITSG-33 - IT Security Risk Management controls