Canada ITSG-33 - IT Security Risk Management A2-3.5.3: 3.5.3 Approve the high-level design

For large projects or critical systems, the project obtains the authorizer's approval to proceed to detailed design, reviewing the TRA decisions to reduce or add controls with the authorizer and security officials and the revised controls with security officials.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 2: ISSIP requirements analysis and design phases – Canada ITSG-33 - IT Security Risk Management

A2-3.4.1 3.4.1 Define business needs for security
A2-3.4.2 3.4.2 Tailor security controls
A2-3.4.3 3.4.3 Assess security control tailoring
A2-3.4.4 3.4.4 Approve system security controls
A2-3.5.1 3.5.1 Incorporate system security controls in the high-level design
A2-3.5.2 3.5.2 Assess the high-level design
A2-3.6.1 3.6.1 Incorporate security mechanisms in the detailed design
A2-3.6.2 3.6.2 Assess the detailed design

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls