TheArtOfService
Back to Frameworks

Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

Self-Assess
Canada (Government of Canada and critical infrastructure; Canadian Centre for Cyber Security)
vITSP.10.033, first release, effective 31 March 2026; medium-impact profile ITSP.10.033-01 effective 1 April 2026
20 domains
307 controls

The Canadian Centre for Cyber Security's 2026 security and privacy control catalogue, ITSP.10.033, which replaced the ITSG-33 Annex 3A catalogue on 31 March 2026: NIST SP 800-53 Rev. 5 adapted to Canadian law and policy, with Privacy Act controls and Canada-specific controls such as sovereignty and jurisdiction risk assessment, each control marked with its status in the ITSP.10.033-01 medium (Protected B) profile. Built from the catalogue's own base statements.

Verified

Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue is a compliance framework from Canada (Government of Canada and critical infrastructure; Canadian Centre for Cyber Security) with 20 domains and 307 controls. The largest domains are SC: System and communications protection – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue (50 controls), PM: Program management – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue (32 controls), PE: Physical and environmental protection – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue (24 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (20)

AC: Access control – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

23 controls
Controls in the AC: Access control – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 23 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-01AC-01 Access control policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-02AC-02 Account management
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-03AC-03 Access enforcement
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-04AC-04 Information flow enforcement
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-05AC-05 Separation of duties
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-06AC-06 Least privilege
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-07AC-07 Unsuccessful logon attempts
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-08AC-08 System use notification
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-09AC-09 Previous logon notification
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-10AC-10 Concurrent session control
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-11AC-11 Device lock
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-12AC-12 Session termination
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-14AC-14 Permitted actions without identification or authentication
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-16AC-16 Security and privacy attributes
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-17AC-17 Remote access
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-18AC-18 Wireless access
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-19AC-19 Access control for mobile devices
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-20AC-20 Use of external systems
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-21AC-21 Information sharing
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-22AC-22 Publicly accessible content
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-23AC-23 Data mining protection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-24AC-24 Access control decisions
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AC-25AC-25 Reference monitor

AT: Awareness and training – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

5 controls
Controls in the AT: Awareness and training – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 5 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AT-01AT-01 Awareness and training policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AT-02AT-02 Literacy training and awareness
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AT-03AT-03 Role-based training
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AT-04AT-04 Training records
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AT-06AT-06 Training feedback

AU: Audit and accountability – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

15 controls
Controls in the AU: Audit and accountability – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 15 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-01AU-01 Audit and accountability policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-02AU-02 Event logging
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-03AU-03 Content of audit records
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-04AU-04 Audit log storage capacity
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-05AU-05 Response to audit logging process failures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-06AU-06 Audit record review, analysis, and reporting
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-07AU-07 Audit record reduction and report generation
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-08AU-08 Time stamps
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-09AU-09 Protection of audit information
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-10AU-10 Non-repudiation
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-11AU-11 Audit record retention
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-12AU-12 Audit record generation
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-13AU-13 Monitoring for information disclosure
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-14AU-14 Session audit
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::AU-16AU-16 Cross-organizational audit logging

CA: Assessment, authorization, and monitoring – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

8 controls
Controls in the CA: Assessment, authorization, and monitoring – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 8 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CA-01CA-01 Assessment, authorization and monitoring policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CA-02CA-02 Control assessments
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CA-03CA-03 Information exchange
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CA-05CA-05 Plan of action and milestones
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CA-06CA-06 Authorization
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CA-07CA-07 Continuous monitoring
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CA-08CA-08 Penetration testing
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CA-09CA-09 Internal system connections

CM: Configuration management – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

14 controls
Controls in the CM: Configuration management – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 14 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-01CM-01 Configuration management policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-02CM-02 Baseline configuration
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-03CM-03 Configuration change control
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-04CM-04 Impact analyses
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-05CM-05 Access restrictions for change
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-06CM-06 Configuration Settings
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-07CM-07 Least functionality
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-08CM-08 System component inventory
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-09CM-09 Configuration management plan
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-10CM-10 Software use restrictions
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-11CM-11 User-installed software
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-12CM-12 Information location
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-13CM-13 Data action mapping
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CM-14CM-14 Signed components

CP: Contingency planning – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

12 controls
Controls in the CP: Contingency planning – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 12 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CP-01CP-01 Contingency planning policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CP-02CP-02 Contingency plan
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CP-03CP-03 Contingency training
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CP-04CP-04 Contingency plan testing
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CP-06CP-06 Alternate storage site
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CP-07CP-07 Alternate processing site
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CP-08CP-08 Telecommunications services
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CP-09CP-09 System backup
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CP-10CP-10 System recovery and reconstitution
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CP-11CP-11 Alternate communications protocols
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CP-12CP-12 Safe mode
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::CP-13CP-13 Alternative security mechanisms

IA: Identification and authentication – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

13 controls
Controls in the IA: Identification and authentication – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 13 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-01IA-01 Identification and authentication policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-02IA-02 Identification and authentication (organizational users)
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-03IA-03 Device identification and authentication
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-04IA-04 Identifier management
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-05IA-05 Authenticator management
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-06IA-06 Authentication feedback
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-07IA-07 Cryptographic module authentication
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-08IA-08 Identification and authentication (non -organizational users)
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-09IA-09 Service identification and authentication
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-10IA-10 Adaptive authentication
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-11IA-11 Re-authentication
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-12IA-12 Identity proofing
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IA-13IA-13 Identity providers and authorization servers

IR: Incident response – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

9 controls
Controls in the IR: Incident response – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 9 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IR-01IR-01 Incident response policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IR-02IR-02 Incident response training
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IR-03IR-03 Incident response testing
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IR-04IR-04 Incident handling
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IR-05IR-05 Incident monitoring
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IR-06IR-06 Incident reporting
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IR-07IR-07 Incident response assistance
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IR-08IR-08 Incident response plan
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::IR-09IR-09 Information spillage response

MA: Maintenance – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

7 controls
Controls in the MA: Maintenance – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 7 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MA-01MA-01 Maintenance policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MA-02MA-02 Controlled maintenance
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MA-03MA-03 Maintenance tools
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MA-04MA-04 Non-local maintenance
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MA-05MA-05 Maintenance personnel
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MA-06MA-06 Timely maintenance
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MA-07MA-07 Field maintenance

MP: Media protection – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

8 controls
Controls in the MP: Media protection – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 8 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MP-01MP-01 Media protection policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MP-02MP-02 Media access
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MP-03MP-03 Media marking
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MP-04MP-04 Media storage
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MP-05MP-05 Media transport
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MP-06MP-06 Media sanitization
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MP-07MP-07 Media use
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::MP-08MP-08 Media downgrading

PE: Physical and environmental protection – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

24 controls
Controls in the PE: Physical and environmental protection – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 24 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-01PE-01 Physical and environmental protection policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-02PE-02 Physical access authorizations
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-03PE-03 Physical access control
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-04PE-04 Access control for transmission
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-05PE-05 Access control for output devices
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-06PE-06 Monitoring physical access
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-08PE-08 Visitor access records
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-09PE-09 Power equipment and cabling
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-10PE-10 Emergency shutoff
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-11PE-11 Emergency power
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-12PE-12 Emergency lighting
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-13PE-13 Fire protection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-14PE-14 Environmental controls
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-15PE-15 Water damage protection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-16PE-16 Delivery and removal
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-17PE-17 Alternate work site
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-18PE-18 Location of system components
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-19PE-19 Information leakage
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-20PE-20 Asset monitoring and tracking
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-21PE-21 Electromagnetic pulse protection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-22PE-22 Component marking
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-23PE-23 Facility location
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-400PE-400 Remote and telework environments
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PE-401PE-401 Security operations centre

PL: Planning – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

8 controls
Controls in the PL: Planning – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 8 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PL-01PL-01 Planning policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PL-02PL-02 System security and privacy plans
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PL-04PL-04 Rules of behaviour
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PL-07PL-07 Concept of operations
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PL-08PL-08 Security and privacy architecture
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PL-09PL-09 Central management
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PL-10PL-10 Baseline selection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PL-11PL-11 Baseline tailoring

PM: Program management – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

32 controls
Controls in the PM: Program management – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 32 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-01PM-01 Information security program plan
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-02PM-02 Information security program leadership role
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-03PM-03 Information security and privacy resources
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-04PM-04 Plan of action and milestones process
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-05PM-05 System and program inventory
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-06PM-06 Measures of performance
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-07PM-07 Enterprise architecture
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-08PM-08 Critical infrastructure plan
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-09PM-09 Risk management strategy
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-10PM-10 Authorization process
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-11PM-11 Mission and business process definition
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-12PM-12 Insider threat program
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-13PM-13 Security and privacy workforce
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-14PM-14 Testing, training, and monitoring
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-15PM-15 Security and privacy groups and associations
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-16PM-16 Threat awareness program
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-17PM-17 Protecting controlled information on outsourced external systems
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-18PM-18 Privacy program plan
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-19PM-19 Privacy program leadership role
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-20PM-20 Communication of key privacy services
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-21PM-21 Maintain a record of disclosures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-22PM-22 Personal information quality management
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-23PM-23 Data governance committee
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-24PM-24 Data integrity board
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-25PM-25 Minimization of personal information used in testing, training, and research
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-26PM-26 Complaint management
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-27PM-27 Privacy reporting
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-28PM-28 Risk framing
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-29PM-29 Risk management program leadership roles
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-30PM-30 Supply chain risk management strategy
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-31PM-31 Continuous monitoring strategy
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PM-32PM-32 Purposing

PS: Personnel security – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

9 controls
Controls in the PS: Personnel security – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 9 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PS-01PS-01 Personnel security policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PS-02PS-02 Position security analysis
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PS-03PS-03 Personnel screening
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PS-04PS-04 Personnel termination
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PS-05PS-05 Personnel transfer
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PS-06PS-06 Access agreements
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PS-07PS-07 External personnel security
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PS-08PS-08 Personnel sanctions
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PS-09PS-09 Position descriptions

PT: Personal information handling and transparency – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

8 controls
Controls in the PT: Personal information handling and transparency – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 8 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PT-01PT-01 Personal information handling and transparency policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PT-02PT-02 Authority to collect and use personal information
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PT-03PT-03 Personal information handling uses and disclosures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PT-04PT-04 Consent
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PT-05PT-05 Privacy notice
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PT-06PT-06 Personal information banks
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PT-07PT-07 Particularly sensitive personal information
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::PT-08PT-08 Data matching requirements

RA: Risk assessment – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

9 controls
Controls in the RA: Risk assessment – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 9 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::RA-01RA-01 Risk assessment policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::RA-02RA-02 Security categorization
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::RA-03RA-03 Risk assessment
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::RA-05RA-05 Vulnerability monitoring and scanning
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::RA-06RA-06 Technical surveillance countermeasures survey
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::RA-07RA-07 Risk response
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::RA-08RA-08 Privacy impact assessments
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::RA-09RA-09 Criticality analysis
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::RA-10RA-10 Threat hunting

SA: System and services acquisition – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

18 controls
Controls in the SA: System and services acquisition – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 18 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-01SA-01 System and services acquisition policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-02SA-02 Allocation of resources
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-03SA-03 System development lifecycle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-04SA-04 Acquisition process
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-05SA-05 System documentation
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-08SA-08 Security and privacy engineering principles
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-09SA-09 External system services
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-10SA-10 Developer configuration management
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-11SA-11 Developer testing and evaluation
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-15SA-15 Development process, standards, and tools
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-16SA-16 Developer-provided training
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-17SA-17 Developer security and privacy architecture and design
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-20SA-20 Customized development of critical components
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-21SA-21 Developer screening
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-22SA-22 Unsupported system components
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-23SA-23 Specialization
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-24SA-24 Design for cyber resiliency
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SA-400SA-400 Sovereignty and jurisdiction

SC: System and communications protection – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

50 controls
Controls in the SC: System and communications protection – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 50 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-01SC-01 System and communications protection policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-02SC-02 Separation of system and user functionality
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-03SC-03 Security function isolation
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-04SC-04 Information in shared system resources
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-05SC-05 Denial-of-service protection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-06SC-06 Resource availability
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-07SC-07 Boundary protection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-08SC-08 Transmission confidentiality and integrity
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-10SC-10 Network disconnect
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-11SC-11 Trusted path
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-12SC-12 Cryptographic key establishment and management
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-13SC-13 Cryptographic protection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-15SC-15 Collaborative computing devices and applications
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-16SC-16 Transmission of security and privacy attributes
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-17SC-17 Public key infrastructure certificates
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-18SC-18 Mobile code
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-19SC-19 Voice over Internet Protocol
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-20SC-20 Secure name/address resolution service (authoritative source)
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-21SC-21 Secure name/address resolution service (recursive or caching resolver)
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-22SC-22 Architecture and provisioning for name/address resolution service
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-23SC-23 Session authenticity
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-24SC-24 Fail in known state
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-25SC-25 Thin nodes
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-26SC-26 Decoys
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-27SC-27 Platform-independent applications
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-28SC-28 Protection of information at rest
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-29SC-29 Heterogeneity
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-30SC-30 Concealment and misdirection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-31SC-31 Covert channel analysis
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-32SC-32 System partitioning
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-34SC-34 Non-modifiable executable programs
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-35SC-35 External malicious code identification
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-36SC-36 Distributed processing and storage
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-37SC-37 Out-of-band channels
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-38SC-38 Operations security
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-39SC-39 Process isolation
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-40SC-40 Wireless link protection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-400SC-400 Entity source authentication
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-401SC-401 Unclassified telecommunications in secure facilities
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-41SC-41 Port and input/output device access
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-42SC-42 Sensor capability and data
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-43SC-43 Usage restrictions
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-44SC-44 Detonation chambers
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-45SC-45 System time synchronization
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-46SC-46 Cross-domain policy enforcement
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-47SC-47 Alternate communications paths
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-48SC-48 Sensor relocation
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-49SC-49 Hardware-enforced separation and policy enforcement
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-50SC-50 Software-enforced separation and policy enforcement
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SC-51SC-51 Hardware-based protection

SI: System and information integrity – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

23 controls
Controls in the SI: System and information integrity – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 23 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-01SI-01 System and information integrity policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-02SI-02 Flaw remediation
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-03SI-03 Malicious code protection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-04SI-04 System monitoring
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-05SI-05 Security alerts, advisories, and directives
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-06SI-06 Security and privacy function verification
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-07SI-07 Software, firmware, and information integrity
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-08SI-08 Spam protection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-10SI-10 Information input validation
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-11SI-11 Error handling
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-12SI-12 Information management and retention
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-13SI-13 Predictable failure prevention
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-14SI-14 Non-persistence
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-15SI-15 Information output filtering
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-16SI-16 Memory protection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-17SI-17 Fail-safe procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-18SI-18 Personal information quality operations
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-19SI-19 De-identification
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-20SI-20 Tainting
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-21SI-21 Information refresh
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-22SI-22 Information diversity
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-23SI-23 Information fragmentation
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SI-400SI-400 Dedicated administration workstation

SR: Supply chain risk management – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue

12 controls
Controls in the SR: Supply chain risk management – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue domain of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue — 12 controls
CodeTitle
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-01SR-01 Supply chain risk management policy and procedures
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-02SR-02 Supply chain risk management plan
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-03SR-03 Supply chain controls and processes
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-04SR-04 Provenance
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-05SR-05 Acquisition strategies, tools, and methods
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-06SR-06 Supplier assessments and reviews
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-07SR-07 Supply chain operations security
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-08SR-08 Notification agreements
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-09SR-09 Tamper resistance and detection
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-10SR-10 Inspection of systems or components
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-11SR-11 Component authenticity
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::SR-12SR-12 Component disposal

What is Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue and who does it apply to?

Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue is a compliance framework from Canada (Government of Canada and critical infrastructure; Canadian Centre for Cyber Security) with 20 domains and 307 controls. The Canadian Centre for Cyber Security's 2026 security and privacy control catalogue, ITSP.10.033, which replaced the ITSG-33 Annex 3A catalogue on 31 March 2026: NIST SP 800-53 Rev. 5 adapted to Canadian law and policy, with Privacy Act controls and Canada-specific controls such as sovereignty and jurisdiction risk assessment, each control marked with its status in the ITSP.10.033-01 medium (Protected B) profile. Built from the catalogue's own base statements. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue actually require?

Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue has 307 controls organised across 20 domains. The largest domains are SC: System and communications protection – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue (50 controls), PM: Program management – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue (32 controls), PE: Physical and environmental protection – Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue (24 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue do I already cover?

Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue?

Start your Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 307 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 705 frameworks.

Get Started Free →

Free forever — no credit card required