Canada ITSG-33 - IT Security Risk Management A2-3.6.1: 3.6.1 Incorporate security mechanisms in the detailed design

The project assigns security mechanisms of sufficient strength to detailed design elements to satisfy the controls at their specified robustness, supported by TRA activities and guidance such as ITSG-31 on authentication; any change to controls or robustness updates the system controls and the assurance requirements, whose knock-on cost must be considered.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 2: ISSIP requirements analysis and design phases – Canada ITSG-33 - IT Security Risk Management

A2-3.4.1 3.4.1 Define business needs for security
A2-3.4.2 3.4.2 Tailor security controls
A2-3.4.3 3.4.3 Assess security control tailoring
A2-3.4.4 3.4.4 Approve system security controls
A2-3.5.1 3.5.1 Incorporate system security controls in the high-level design
A2-3.5.2 3.5.2 Assess the high-level design
A2-3.5.3 3.5.3 Approve the high-level design
A2-3.6.2 3.6.2 Assess the detailed design

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls