Canada ITSG-33 - IT Security Risk Management A2-3.2.3: 3.2.3 Identify initial security assurance requirements

The project identifies the initial security assurance requirements, normally from the profile; otherwise it takes the highest injury level from the system category, the highest threat category from the threat reports, the corresponding robustness level (section 7), the matching security assurance level, and the related requirements from section 8. This yields the most stringent level, adjusted later in design for cost-effectiveness.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 2: ISSIP stakeholder engagement, concept and planning phases – Canada ITSG-33 - IT Security Risk Management

A2-2.3 2.3 Establish the authorization conditions before the project starts
A2-3.1.1 3.1.1 Identify and engage security stakeholders
A2-3.2.1 3.2.1 Select applicable domain security control profiles and threat assessment reports
A2-3.2.2 3.2.2 Determine the information system security category
A2-3.2.4 3.2.4 Approve initial security assurance requirements
A2-3.3.1 3.3.1 Integrate ISSIP activities in the project plan
A2-3.3.2 3.3.2 Approve the project plan

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls