Canada ITSG-33 - IT Security Risk Management

Annex 2: ISSIP requirements analysis and design phases – Canada ITSG-33 - IT Security Risk Management

Canada ITSG-33 - IT Security Risk Management A2-3.6.3: 3.6.3 Approve the detailed design and development

What does A2-3.6.3 require?

The project obtains the authorizer's approval to develop the system from the detailed design, ideally before committing to a development environment and team, after reviewing the TRA decisions and mechanism choices, the final system controls and all changes to the assurance requirements.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 2: ISSIP requirements analysis and design phases – Canada ITSG-33 - IT Security Risk Management

A2-3.4.1 3.4.1 Define business needs for security
A2-3.4.2 3.4.2 Tailor security controls
A2-3.4.3 3.4.3 Assess security control tailoring
A2-3.4.4 3.4.4 Approve system security controls
A2-3.5.1 3.5.1 Incorporate system security controls in the high-level design
A2-3.5.2 3.5.2 Assess the high-level design
A2-3.5.3 3.5.3 Approve the high-level design
A2-3.6.1 3.6.1 Incorporate security mechanisms in the detailed design

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls