Canada ITSG-33 - IT Security Risk Management

Annex 2: Operations, maintenance, disposal and external capabilities – Canada ITSG-33 - IT Security Risk Management

Canada ITSG-33 - IT Security Risk Management A2-4.3: 4.3 Maintain authorization at the system level

What does A2-4.3 require?

Operations groups support departmental authorization maintenance by keeping detailed written records of security maintenance, administration, monitoring and assessment, and documenting security-relevant environment changes, incidents and remedial actions.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 2: Operations, maintenance, disposal and external capabilities – Canada ITSG-33 - IT Security Risk Management

A2-4.1 4.1 Maintain secure operations
A2-4.2 4.2 Monitor and assess security
A2-5.1 5.1 Securely dispose of IT assets
A2-5.2 5.2 Assess disposal results
A2-5.3 5.3 Final sign-off of system retirement
A2-6 6 Specify and verify security requirements for external capabilities and mandated IT services

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls