Canada ITSG-33 - IT Security Risk Management

Annex 2: Operations, maintenance, disposal and external capabilities – Canada ITSG-33 - IT Security Risk Management

Canada ITSG-33 - IT Security Risk Management A2-5.3: 5.3 Final sign-off of system retirement

What does A2-5.3 require?

The authorizer approves the system's retirement after reviewing the disposal statement of assessment, forwards the sign-off to the IT security function for archiving, and informs the business owners who relied on the system.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Annex 2: Operations, maintenance, disposal and external capabilities – Canada ITSG-33 - IT Security Risk Management

A2-4.1 4.1 Maintain secure operations
A2-4.2 4.2 Monitor and assess security
A2-4.3 4.3 Maintain authorization at the system level
A2-5.1 5.1 Securely dispose of IT assets
A2-5.2 5.2 Assess disposal results
A2-6 6 Specify and verify security requirements for external capabilities and mandated IT services

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Canada ITSG-33 - IT Security Risk Management controls