Canada ITSG-33 - IT Security Risk Management A2-2.3: 2.3 Establish the authorization conditions before the project starts

Before an IT project starts the project manager obtains, from the departmental security plan or the designated authorizer, the minimum conditions for obtaining and keeping authorization to operate, and records them in the project charter or plan signed by the authorizer, the sponsor, the project manager and relevant stakeholders such as the operational authority. Examples are the mandated profile, ISSIP tailoring in the plan, delivery of outputs for assessment, an agreed authorization package, an operations plan with security provisions and the acceptable residual risk level.