Canada ITSG-33 - IT Security Risk Management A2-3.4.3: 3.4.3 Assess security control tailoring

The security assessor, helped by the practitioner, confirms that the business needs and the control tailoring meet the engineering tasks and documentation content of the assurance requirements and issues a statement of assessment. Assessors should take part throughout, raise issues early, inform the authorizer of any unresolvable issue with its impact, and record unresolved issues with justification and risk results.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 2: ISSIP requirements analysis and design phases – Canada ITSG-33 - IT Security Risk Management

A2-3.4.1 3.4.1 Define business needs for security
A2-3.4.2 3.4.2 Tailor security controls
A2-3.4.4 3.4.4 Approve system security controls
A2-3.5.1 3.5.1 Incorporate system security controls in the high-level design
A2-3.5.2 3.5.2 Assess the high-level design
A2-3.5.3 3.5.3 Approve the high-level design
A2-3.6.1 3.6.1 Incorporate security mechanisms in the detailed design
A2-3.6.2 3.6.2 Assess the detailed design

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls