Canada ITSG-33 - IT Security Risk Management A2-3.7.4: 3.7.4 Assess security solution development

The security assessor confirms that development testing, operational security procedures and installation procedures meet the assurance requirements and issues a statement of assessment.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 2: ISSIP development, integration, testing and installation phases – Canada ITSG-33 - IT Security Risk Management

A2-3.7.1 3.7.1 Establish a secure development environment
A2-3.7.2 3.7.2 Assess the secure development environment
A2-3.7.3 3.7.3 Specify, develop and test security solutions
A2-3.8.1 3.8.1 Install security in the testing environment
A2-3.8.2 3.8.2 Conduct integration security testing
A2-3.8.3 3.8.3 Assess integration security testing
A2-3.8.4 3.8.4 Approve production installation
A2-3.9.1 3.9.1 Install and verify security in the production environment

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls