Canada ITSG-33 - IT Security Risk Management
Annex 2: ISSIP stakeholder engagement, concept and planning phases – Canada ITSG-33 - IT Security Risk Management

Canada ITSG-33 - IT Security Risk Management A2-3.2.2: 3.2.2 Determine the information system security category

The project sets the system's security category, normally inheriting the category of the business activities it supports as documented in the validated profiles and, where several apply, their high-water mark for confidentiality, integrity and availability. Choosing a different category by another method (for example to reduce cost) needs the authorizer's approval and acceptance of the risk. The output is the system security categorization report.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in Annex 2: ISSIP stakeholder engagement, concept and planning phases – Canada ITSG-33 - IT Security Risk Management

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Canada ITSG-33 - IT Security Risk Management controls