Canada ITSG-33 - IT Security Risk Management A2-3.5.2: 3.5.2 Assess the high-level design

The security assessor confirms that the high-level design and the TRA work meet the engineering tasks and documentation content of the assurance requirements and issues a statement of assessment.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 2: ISSIP requirements analysis and design phases – Canada ITSG-33 - IT Security Risk Management

A2-3.4.1 3.4.1 Define business needs for security
A2-3.4.2 3.4.2 Tailor security controls
A2-3.4.3 3.4.3 Assess security control tailoring
A2-3.4.4 3.4.4 Approve system security controls
A2-3.5.1 3.5.1 Incorporate system security controls in the high-level design
A2-3.5.3 3.5.3 Approve the high-level design
A2-3.6.1 3.6.1 Incorporate security mechanisms in the detailed design
A2-3.6.2 3.6.2 Assess the detailed design

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls