Canada ITSG-33 - IT Security Risk Management A2-3.3.2: 3.3.2 Approve the project plan

The project obtains the authorizer's approval to proceed according to the plan with its ISSIP activities; later changes to planned security activities may raise cost, delay the schedule, reduce assurance and increase residual risk.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 2: ISSIP stakeholder engagement, concept and planning phases – Canada ITSG-33 - IT Security Risk Management

A2-2.3 2.3 Establish the authorization conditions before the project starts
A2-3.1.1 3.1.1 Identify and engage security stakeholders
A2-3.2.1 3.2.1 Select applicable domain security control profiles and threat assessment reports
A2-3.2.2 3.2.2 Determine the information system security category
A2-3.2.3 3.2.3 Identify initial security assurance requirements
A2-3.2.4 3.2.4 Approve initial security assurance requirements
A2-3.3.1 3.3.1 Integrate ISSIP activities in the project plan

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls