Canada ITSG-33 - IT Security Risk Management A2-3.4.1: 3.4.1 Define business needs for security

The project defines the system's business needs for security, the stakeholders' protection requirements in business terms derived from laws, regulations, policies, directives, standards, contracts and objectives, starting from those in the domain profile, confirming their applicability and adding any missing ones, with a business analyst and a departmental or security architect.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 2: ISSIP requirements analysis and design phases – Canada ITSG-33 - IT Security Risk Management

A2-3.4.2 3.4.2 Tailor security controls
A2-3.4.3 3.4.3 Assess security control tailoring
A2-3.4.4 3.4.4 Approve system security controls
A2-3.5.1 3.5.1 Incorporate system security controls in the high-level design
A2-3.5.2 3.5.2 Assess the high-level design
A2-3.5.3 3.5.3 Approve the high-level design
A2-3.6.1 3.6.1 Incorporate security mechanisms in the detailed design
A2-3.6.2 3.6.2 Assess the detailed design

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls