Line 1: |
Line 1: |
| {{OCIO_GCEA_Header}} | | {{OCIO_GCEA_Header}} |
| | | |
− | <i><big> This is a <b><u>DRAFT COPY</u></b> of the proposed GC EA Playbook. It is a work IN PROGRESS, and has not undergone any review. </big></i> | + | <i><big>This is a <b><u>DRAFT COPY</u></b> of the proposed GC EA Playbook. It is outdated, a work IN PROGRESS, and has not undergone any review. </big></i> |
− | <br>
| |
− | | |
− | <h2> INTRODUCTION - How to use the Playbook</h2><br>
| |
− | | |
− | This EA Playbook is intended to serve as best practices for GC Architects in developing or managing their enterprise architecture within their department. It contains the thought process behind why the GC EA Assessment Framework is created the way they are, why select topics were chosen over others and how its content will impact how a project/program is assessed. <br>
| |
− | | |
| | | |
| + | <h2> INTRODUCTION – How to use the Playbook</h2><br>This EA Playbook is intended to serve as best practices for GC Architects in developing or managing their enterprise architecture within their department. It contains the thought process behind why the GC EA Assessment Framework is created the way they are, why select topics were chosen over others and how its content will impact how a project/program is assessed. <br> |
| The scope of the EA Playbook focuses on the assessment piece, which is looking for evidence on where the project/program sits in the overall GC Target Architecture (currently in draft) and how it aligns to the GC direction. It also complements the [https://docs.google.com/document/d/19ZCSC32ZRXm_A4eC1OdA5dcXvJMEuwqt2RKteGeaUE0/edit# Service & Digital Target Enterprise Architecture Whitepaper] (currently in draft) that will be published soon. <br> | | The scope of the EA Playbook focuses on the assessment piece, which is looking for evidence on where the project/program sits in the overall GC Target Architecture (currently in draft) and how it aligns to the GC direction. It also complements the [https://docs.google.com/document/d/19ZCSC32ZRXm_A4eC1OdA5dcXvJMEuwqt2RKteGeaUE0/edit# Service & Digital Target Enterprise Architecture Whitepaper] (currently in draft) that will be published soon. <br> |
− |
| |
− |
| |
| The Playbook is organized into chapters as per the B-I-A-T-S+P architecture layers called Plays. We recommend that users: | | The Playbook is organized into chapters as per the B-I-A-T-S+P architecture layers called Plays. We recommend that users: |
| | | |
Line 17: |
Line 10: |
| | | |
| 2. Take an iterative approach to implementing the "Plays"<br> | | 2. Take an iterative approach to implementing the "Plays"<br> |
− |
| |
− |
| |
| In this playbook, we are introducing various external links and external examples as another source of reference to help with the understanding of each of the concepts introduced in the EA Assessment Framework as well as providing best practices. | | In this playbook, we are introducing various external links and external examples as another source of reference to help with the understanding of each of the concepts introduced in the EA Assessment Framework as well as providing best practices. |
| | | |
| This Playbook is a living document, intended to evolve over time as Enterprise Architects in the GC community grow and mature. The Playbook also evolves as new solutions are introduced to the GC Enterprise Architecture landscape. Thus, your feedback would be greatly appreciated.<br> | | This Playbook is a living document, intended to evolve over time as Enterprise Architects in the GC community grow and mature. The Playbook also evolves as new solutions are introduced to the GC Enterprise Architecture landscape. Thus, your feedback would be greatly appreciated.<br> |
| + | Please send any comments or suggestion for future updates to [[gccollab:groups/profile/1896301/enenterprise-architecture-community-of-practicefrcommunitu00e9-de-pratique-de-architecture-integru00e9e|| GC EA CoP Collab Site]] |
| | | |
| + | <h2> The Plays </h2> <span style="font-size: 1.5em;">Where to start </span> |
| | | |
− | Please send any comments or suggestion for future updates to [https://gccollab.ca/groups/profile/1896301/enenterprise-architecture-community-of-practicefrcommunitu00e9-de-pratique-de-architecture-integru00e9e | GC EA CoP Collab Site]
| + | When department has an idea, a problem or an issue that needs to be addressed, the <b>main</b> question that needs to be answered is that "<b><u>Is it worth it</u></b>?". |
| | | |
| + | To answer this question, department has to:<br><br> |
| + | 1. <b>Identify the end goal</b> (i.e. benefits, business outcomes, alignment to strategy/mandate) |
| + | *what is it that the department wants to achieve at the end? |
| + | *what problem is the department trying to solve? |
| + | *what are the benefits being realized? |
| + | *what are the measurable business outcomes? |
| | | |
− | <h2> The Plays </h2> <br> | + | 2. <b>Figuring out options</b> – if we use this solution: |
| + | *how would it affect the outcome? |
| + | *how would it affect the existing process? |
| + | *how would it affect the other existing systems in the ecosystem? |
| | | |
− | <h3><span style="font-size: 1.5em;"> Where to start </span></h3> <br> | + | 3. <b>Determine the best approach</b> |
| + | *would it be the best approach / solution that will fit departmental needs / strategy / mandate? |
| + | *would the approach / solution align with the GC Direction? |
| + | *how would the new solution fit in the whole IT landscape within the department and the GC? |
| | | |
− | When department has an idea, a problem or an issue that needs to be addressed, the <b>main</b> question that needs to be answered is that "<b><u>Is it worth it</b>?".
| + | 4. Finally: <b>Does the outcome outweigh the expenses, aka <I>IS IT WORTH IT</I>?</b> |
− | | |
− | To answer this question, department has to:<br>
| |
− | 1. <b>Identify the end goal</b>
| |
− | * what is it that the department wants to achieve at the end ?
| |
− | * what problem is the department trying to solve ?
| |
− | * how would the new solution fit in the whole IT landscape within the department and the GC ?
| |
− | | |
− | 2. <b>Determine options</b> - if we use this solution:
| |
− | * how would it affect the outcome ?
| |
− | * how would it affect the existing process ?
| |
− | * how would it affect the other existing systems in the ecosystem ?
| |
− | * would it be the best solution that will fit departmental needs as well as align with the GC Direction ?
| |
| <br> | | <br> |
| | | |
− | All these questions need to be considered through the architecture layers of B-I-A-T-S+P (Business - Information - Application - Technology - Security + Privacy). | + | All these questions need to be considered through the various lenses of architecture layers <b>B-I-A-T-S+P (Business - Information - Application - Technology - Security + Privacy)</b>. |
| | | |
− | <br><br> | + | <h2><span style="font-size: 1.5em;">Business Architecture</span></h2> <br>Business Architecture is where an organization identifies the various services that it needs to provide externally, as well as the various functions it owns or needs to own internally to support their services to the public. In the context of GC Enterprise Business Architecture, this is where the Government of Canada identifies the various departments, the services they provide to Canadians and the functions they own. <br><br><b><u>Fulfill the Government of Canada stakeholder needs</u></b> |
− | | |
− | <h3><span style="font-size: 1.5em;"> 1. Business Architecture</span></h3> <br>
| |
− | | |
− | Business Architecture is where an organization identifies the various services that it needs to provide externally, as well as the various functions it owns or needs to own internally to support their services to the public. In the context of GC Enterprise Business Architecture, this is where the Government of Canada identifies the various departments, the services they provide to Canadians and the functions they owns. <br><br> | |
− | | |
− | <h4><b><u>Fulfill the Government of Canada stakeholder needs</b></h4>
| |
− | <br>
| |
| | | |
| As the provider of service to Canadians, it is important for the GC to understand its stakeholders well. The stakeholders in this case may be its users, its partners (if any), its suppliers (if any), its program or project manager, its developer, etc. | | As the provider of service to Canadians, it is important for the GC to understand its stakeholders well. The stakeholders in this case may be its users, its partners (if any), its suppliers (if any), its program or project manager, its developer, etc. |
| | | |
− | Once a department identify all its stakeholders, it needs to map them into their roles and responsibilities as well as identify their requirements. From there, department will need to figure out how to make it easier for the stakeholder to use the business service, which means department needs to really drill down on the user interface design of their service. This is what digital is all about, ie. to make it easy for users to consume the GC service. | + | Once a department identifies all of its stakeholders, it needs to map them into their roles and responsibilities as well as identify their requirements. From there, the department will need to figure out how to make it easier for the stakeholder to use the business service, which means the department needs to really drill down on the user interface design of their service. This is what digital is all about, i.e. to make it easy for users to consume the GC service. |
| | | |
| While configuring a service, departments should also take into account the policy requirements, including accessibilities, gender based+ analysis and official languages. | | While configuring a service, departments should also take into account the policy requirements, including accessibilities, gender based+ analysis and official languages. |
| | | |
− | Once the stakeholders are identified, the roles and responsibilities are mapped, and the stakeholder needs are identified and translated into a business service, the department can then model a complete quality end-to-end business service that provides the best digital experience to its users while also maximizing its effectiveness and optimize efficiencies.<br><br> | + | Once the stakeholders are identified, the roles and responsibilities are mapped, and the stakeholder needs are identified and translated into a business service, the department can then model a complete quality end-to-end business service that provides the best digital experience to its users while also maximizing its effectiveness and optimizing efficiencies.<br> |
| | | |
− | * <b><I>Clearly identify internal and external stakeholders and their needs for each business service including user centric design </b> | + | *<b><I>Clearly identify internal and external stakeholders and their needs for each business service including user centric design </I></b> |
− | To understand their stakeholders, it is recommended for program & project manager to conduct stakeholder analysis and create stakeholder mapping for each service being delivered. Users of a business service can be the Canadian general public (in terms of service the department provides), employees (if the service also applicable to the departmental employees, or if the employees is the one implementing the service), or others. Partners of a business service can be other departments or organizations that consume the departmental service, provide data to the department, or those who are building the system/program with the department. Suppliers of a business service can be the SaaS companies who provide the department with service, vendors, SSC, etc. <br><br> | + | To understand their stakeholders, it is recommended for program & project managers to conduct stakeholder analysis and create stakeholder mapping for each service being delivered. Users of a business service can be the Canadian general public (in terms of service the department provides), employees (if the service also applicable to the departmental employees, or if the employees is the one implementing the service), or others. Partners of a business service can be other departments or organizations that consume the departmental service, provide data to the department, or those who are building the system/program with the department. Suppliers of a business service can be the SaaS companies who provide the department with service, vendors, SSC, etc. <br> |
| | | |
− | There are various sites where department can visit to understand and use stakeholder analysis and stakeholder mapping. The following are examples of sites that department can use to obtain further on stakeholder analysis or mapping: | + | There are various sites where departments can visit to understand and use stakeholder analysis and stakeholder mapping. The following are examples of sites that departments can use to obtain further on stakeholder analysis or mapping: |
− | * [https://www.groupmap.com/map-templates/stakeholder-analysis/index.html GroupMap Stakeholder analysis] | + | *[https://www.groupmap.com/map-templates/stakeholder-analysis/index.html GroupMap Stakeholder analysis] |
− | * [https://www.pmi.org/learning/library/stakeholder-analysis-pivotal-practice-projects-8905 PMI Stakeholder Analysis]<br> | + | *[https://www.pmi.org/learning/library/stakeholder-analysis-pivotal-practice-projects-8905 PMI Stakeholder Analysis]<br> |
| | | |
| <!-- COLUMN STARTS: --> | | <!-- COLUMN STARTS: --> |
Line 78: |
Line 64: |
| | | |
| |- valign="top" | | |- valign="top" |
− | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | | + | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | |
| [[Image: Stakeholder_analysis.jpg | 500px | center]] | | [[Image: Stakeholder_analysis.jpg | 500px | center]] |
| <div style="font-size:1.0em; text-align:center;"> source: PMI</div> | | <div style="font-size:1.0em; text-align:center;"> source: PMI</div> |
Line 84: |
Line 70: |
| | | |
| <!-- COLUMN 2 STARTS: --> | | <!-- COLUMN 2 STARTS: --> |
− | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | | + | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | |
| [[Image: Stakeholders_power_interest_grid.png| 500px | center]]<br> | | [[Image: Stakeholders_power_interest_grid.png| 500px | center]]<br> |
| <div style="font-size:1.0em; text-align:center;"> source: citoolkit</div> | | <div style="font-size:1.0em; text-align:center;"> source: citoolkit</div> |
| <!-- COLUMN 2 ENDS: --> | | <!-- COLUMN 2 ENDS: --> |
− | <!-- TABLE ENDS --> |} | + | <!-- TABLE ENDS -->|} |
| <!-- COLUMN ENDS: --> | | <!-- COLUMN ENDS: --> |
| | | |
− | <br><br>
| + | Once the stakeholders have been clearly identified, the department would need to do some research into what their needs are. Remember, some stakeholders may not know what their needs are, or they may not be able to articulate their needs. Thus, it would be the responsibilities of a project or program manager to conduct needs-based analysis. This may sound like a lot of work, however, it is a very important step to be carried out as it will provide an understanding of what kind of service is actually required, how effective the current service is, how to improve the delivery of the service so that it will be more useful / more effective. To do this correctly the departments need feedback from the right stakeholders to create a good design that is easy to use and works well. This method is called user-centric design.<br> |
| | | |
− | Once the stakeholders have been clearly identified, we would need to do some research into what their needs are. Remember, some stakeholders may not know what their needs are, or they may not be able to articulate their needs are. Thus, it would be the responsibilities of a project or program manager to conduct needs based analysis. This may sounds like a lot of work, and it may be is, however, it is a very important step to be carried out as it will provide an understanding of what kind of service is actually required, how effective the current service is, how to improve the delivery of the service so that it will be more useful - more effective. To do this correctly we need feedback from the right stakeholders to create a good design that is easy to use and works well. This method is called user centric design.<br><br>
| + | * <b><I>Include policy requirement applying to specific stakeholder groups, such as accessibilities, gender based+ analysis, and official languages in the creation of the service </I></b> |
| | | |
− | * <b><I>Include policy requirement applying to specific stakeholder groups, such as accessibilities, gender based+ analysis, and official languages in the creation of the service </b>
| + | In identifying the stakeholder, the department needs to ensure that it is being inclusive and includes all stakeholder groups. Things to consider when designing a business service are accessibilities, official languages and gender based+ analysis to ensure the business service created will be comprehensive to all stakeholder groups. They are important to be considered as these stakeholders have specific requirements that need to be met as well.<br> |
| | | |
− | In identifying the stakeholder, department needs to ensure that it is being inclusive and includes all stakeholder groups. Things to consider when designing a business service are accessibilities, official languages and gender based+ analysis to ensure the business service created will be comprehensive to all stakeholder groups. They are important to be considered as these stakeholders have specific requirements that need to be met as well.<br><br>
| + | For further information on Gender Base+ Policy, please refer to [https://www.canada.ca/en/treasury-board-secretariat/corporate/reports/summary-modernizing-info-sex-gender.html Policy Direction to Modernize the GC Sex and Gender Info Practices] <br> |
− | | |
− | For further information on Gender Base+ Policy, please refer to [https://www.canada.ca/en/treasury-board-secretariat/corporate/reports/summary-modernizing-info-sex-gender.html Policy Direction to Modernize the GC Sex and Gender Info Practices] <br><br> | |
| | | |
| <!-- COLUMN STARTS: --> | | <!-- COLUMN STARTS: --> |
Line 107: |
Line 91: |
| | | |
| |- valign="top" | | |- valign="top" |
− | | width="33.3%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | | + | | width="33.3%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | |
| [[Image: Stakeholder_Onion_Diagram.png | 300px | center]] <br> | | [[Image: Stakeholder_Onion_Diagram.png | 300px | center]] <br> |
| <div style="font-size:1.0em; text-align:center;"> source: edrawsoft</div> | | <div style="font-size:1.0em; text-align:center;"> source: edrawsoft</div> |
Line 113: |
Line 97: |
| | | |
| <!-- COLUMN 2 STARTS: --> | | <!-- COLUMN 2 STARTS: --> |
− | | width="33.3%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | | + | | width="33.3%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | |
| <br><br>[[Image: Disability_and_web_accessibility_-_ebsco.png| 300px | center]] <br> | | <br><br>[[Image: Disability_and_web_accessibility_-_ebsco.png| 300px | center]] <br> |
| <div style="font-size:1.0em; text-align:center;"> source: ebsco</div> | | <div style="font-size:1.0em; text-align:center;"> source: ebsco</div> |
Line 119: |
Line 103: |
| | | |
| <!-- COLUMN 3 STARTS: --> | | <!-- COLUMN 3 STARTS: --> |
− | | width="33.3%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | | + | | width="33.3%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | |
| <br><br>[[Image: Gender-based_analysis_plus_cfc-swc.png| 200px | center]] <br> | | <br><br>[[Image: Gender-based_analysis_plus_cfc-swc.png| 200px | center]] <br> |
| <div style="font-size:1.0em; text-align:center;"> source: csc-swc</div> | | <div style="font-size:1.0em; text-align:center;"> source: csc-swc</div> |
| <!-- COLUMN 3 ENDS: --> | | <!-- COLUMN 3 ENDS: --> |
| | | |
− | <!-- TABLE ENDS --> |} | + | <!-- TABLE ENDS -->|} |
| <!-- COLUMN ENDS: --> | | <!-- COLUMN ENDS: --> |
− | <br><br>
| |
| | | |
− | * <b><I>Model end-to-end business service delivery to provide quality, maximize effectiveness and optimize efficiencies across all channels (e.g lean process)</b> | + | *<b><I>Model end-to-end business service delivery to provide quality, maximize effectiveness and optimize efficiencies across all channels (e.g. lean process)</I></b> |
| | | |
− | Modeling business service delivery end-to-end will provide better digital experience to the stakeholders. It will also help provide better understanding of what components are required to create a service, what various channels which a service can be delivered, as well as individual areas that can be improved to maximize effectiveness and optimize efficiencies of the overall service. Modeling end-to-end business service delivery will expand the horizon and knowledge of the implementer of the business service and will ensure each part of the service delivery and its impact to the service are considered. <br><br> | + | Modeling business service delivery end-to-end will provide better digital experience to the stakeholders. It will also help provide better understanding of what components are required to create a service, the various channels with which a service can be delivered, as well as individual areas that can be improved to maximize effectiveness and optimize efficiencies of the overall service. Modeling end-to-end business service delivery will expand the horizon and knowledge of the implementer of the business service and will ensure each part of the service delivery and its impact to the service are considered. <br> |
| | | |
| <!-- COLUMN 1 STARTS: --> | | <!-- COLUMN 1 STARTS: --> |
Line 136: |
Line 119: |
| | | |
| |- valign="top" | | |- valign="top" |
− | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | | + | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | |
| [[Image: P06_Stakeholder-analysis-workflow.jpg | 1200px | center]] | | [[Image: P06_Stakeholder-analysis-workflow.jpg | 1200px | center]] |
| <div style="font-size:1.0em; text-align:center;"> source: Leaderonomics | | <div style="font-size:1.0em; text-align:center;"> source: Leaderonomics |
| </div> | | </div> |
| <!-- COLUMN 1 ENDS: --> | | <!-- COLUMN 1 ENDS: --> |
− | <!-- TABLE ENDS --> |} | + | <!-- TABLE ENDS -->|} |
| <!-- COLUMN ENDS: --> | | <!-- COLUMN ENDS: --> |
− | <br><br>
| |
| | | |
− | <h4><b><u>Architect to be Outcome Driven and Strategically Aligned to the Department and to the Government of Canada</b></h4> | + | <h4><b><u>Architect to be Outcome Driven and Strategically Aligned to the Department and to the Government of Canada</u></b></h4> |
| | | |
− | The whole notion of creating a program or project is to support departmental mandate. Thus, it needs to be clear what mandate a program or project is supporting, how the outcome of the program or project supports the mandate and measure how effective it is in supporting the mandate. The mandate can be broken down into Strategic Outcomes. A project or program may indirectly support a mandate, however, the derivative outcome it produces may still be able to be tied into one of the strategic outcomes which support departmental mandate. Everything needs to be tied in to the mandate, or one of the strategic outcomes, and everything needs to be measurable. If a department is not sure how a program or project is supporting its mandate or its strategic outcome, or how it can be measured, then perhaps the program or project may not be required to begin with. | + | The whole notion of creating a program or project is to support the departmental mandate. Thus, it needs to be clear what mandate a program or project is supporting, how the outcome of the program or project supports the mandate and measure how effective it is in supporting the mandate. The mandate can be broken down into Strategic Outcomes. A project or program may indirectly support a mandate, however, the derivative outcome it produces may still be able to be tied into one of the strategic outcomes which support the mandate. Everything needs to be tied into the mandate, or one of the strategic outcomes, and everything needs to be measurable. If a department is not sure how a program or project is supporting its mandate or its strategic outcome, or how it can be measured, then perhaps the program or project may not be required to begin with. |
| | | |
− | A system or solution that is the end result of a program or project also needs to strategically align to the direction of the Government of Canada. For example, if we know at the end the GC will be going to the cloud, then program or project needs to at least have a plan in place on how to migrate it to the cloud whenever its ready. Another example, if we know at the end the GC will be using NextGen, then all HR related interim functionality need to plan for transitioning to use NextGen when it becomes available. <br><br> | + | A system or solution that is the end result of a program or project also needs to strategically align to the direction of the Government of Canada. For example, if we know at the end the GC will be going to the cloud, then the program or project needs to at least have a plan in place on how to migrate it to the cloud whenever its ready. Another example, if we know at the end the GC will be using NextGen, then all HR-related interim functionality needs to plan for transitioning to use NextGen when it becomes available.<br> |
| | | |
| <!-- COLUMN STARTS: --> | | <!-- COLUMN STARTS: --> |
Line 157: |
Line 139: |
| | | |
| |- valign="top" | | |- valign="top" |
− | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | | + | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | |
| [[Image: Whole_Government_Framework.jpg| 500px | center]] | | [[Image: Whole_Government_Framework.jpg| 500px | center]] |
| <div style="font-size:1.0em; text-align:center;"> source: GC </div> | | <div style="font-size:1.0em; text-align:center;"> source: GC </div> |
Line 163: |
Line 145: |
| | | |
| <!-- COLUMN 2 STARTS: --> | | <!-- COLUMN 2 STARTS: --> |
− | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | | + | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | |
| [[Image: ISED_GC_Strategy_alignment.jpg| 500px | center]] | | [[Image: ISED_GC_Strategy_alignment.jpg| 500px | center]] |
| <div style="font-size:1.0em; text-align:center;"> source: ISED </div> | | <div style="font-size:1.0em; text-align:center;"> source: ISED </div> |
| <!-- COLUMN 2 ENDS: --> | | <!-- COLUMN 2 ENDS: --> |
− | <!-- TABLE ENDS --> |} | + | <!-- TABLE ENDS -->|} |
| <!-- COLUMN ENDS: --> | | <!-- COLUMN ENDS: --> |
− | <br><br>
| |
| | | |
− | * <b><I>Identify which departmental/GC business services, outcomes and strategies will be addressed </b> | + | *<b><I>Identify which departmental/GC business services, outcomes and strategies will be addressed </I></b> |
| | | |
− | In order to ensure a program or project supports departmental mandate, it is important to identify which services, outcomes or strategies will be addressed at the conclusion of the program or project. This will ensure the program or project has a vision of what it is trying to accomplish in relation to the departmental mandate. Thus, whenever the program or project needs to do a small deviation from its original short-term goal, it will have a limit on how much it can deviate before it is no longer provide an outcome that is aligned to the departmental mandate or GC direction. <br><br> | + | In order to ensure a program or project supports the departmental mandate, it is important to identify which services, outcomes or strategies will be addressed at the conclusion of the program or project. This will ensure the program or project has a vision of what it is trying to accomplish in relation to the departmental mandate. Thus, whenever the program or project needs to do a small deviation from its original short-term goal, it will have a limit on how much it can deviate before it is no longer providing an outcome that is aligned to the departmental mandate or GC direction. <br> |
| | | |
− | * <b><I>Establish metrics for identified business outcomes throughout the lifecycle of an investment</b> | + | *<b><I>Establish metrics for identified business outcomes throughout the lifecycle of an investment</I></b> |
| | | |
− | Another important aspect to ensure alignment to departmental mandate is establishing the metrics for the identified business outcomes. This will ensure department have a way to identify its efficiencies or effectiveness in delivering the business services. As technology progresses, the outcomes that was once achieved by the program or project may become invalid or insufficient to support the departmental mandate or GC Direction. At this time, it would be prudent to re-visit the effectiveness of the program or project and explore possibility of leveraging other existing service created by other department or creating a new project or program. <br><br> | + | Another important aspect to ensure alignment to departmental mandate is establishing the metrics for the identified business outcomes. This will ensure that the department has a way to identify its efficiencies or effectiveness in delivering the business services. As technology progresses, the outcomes that were once achieved by the program or project may become invalid or insufficient to support the departmental mandate or GC Direction. At this time, it would be prudent to re-visit the effectiveness of the program or project and explore the possibility of leveraging other existing services created by other departments or creating a new project or program. <br> |
| | | |
− | * <b><I>Translate business outcomes and strategy into business capability implications in the GC Business Capability Model to establish a common vocabulary between business, development, and operation</b> | + | *<b><I>Translate business outcomes and strategy into business capability implications in the GC Business Capability Model to establish a common vocabulary between business, development, and operation</I></b> |
| | | |
− | One benefit of translating business outcomes and strategy into business capabilities is to provide a common ground between business community and IT community. Once a common ground is reached, it would be easier to communicate what can be achieved, and how much tolerance can a program or project deviates from its short-term goal. <br><br> | + | One benefit of translating business outcomes and strategy into business capabilities is to provide a common ground between business community and IT community. Once a common ground is reached, it would be easier to communicate what can be achieved, and how much tolerance a program or project can deviate from its short-term goal. <br> |
| | | |
− | <h4><b><u> Promote Horizontal Enablement of the Enterprise</b></h4> | + | <h4><b><u>Promote Horizontal Enablement of the Enterprise</u></b></h4> |
| | | |
| By having a common business capability terminology, it becomes easier to figure out if one solution is essentially a duplicate of another solution. It also becomes easier to find out if a department has obtained a solution to enable a business capability, and thus, the same solution may be leveraged to solve similar problem in another department. This horizontal enablement across departments would support reduction in IT spending through achieving economy of scale in procuring the same licenses. It would also support better collaboration between departments and easier data exchange. | | By having a common business capability terminology, it becomes easier to figure out if one solution is essentially a duplicate of another solution. It also becomes easier to find out if a department has obtained a solution to enable a business capability, and thus, the same solution may be leveraged to solve similar problem in another department. This horizontal enablement across departments would support reduction in IT spending through achieving economy of scale in procuring the same licenses. It would also support better collaboration between departments and easier data exchange. |
| | | |
| + | *<b><I>Identify opportunities to horizontally-enabled business services and provide cohesive experience to stakeholders</I></b> |
| | | |
− | * <b><I>Identify opportunities to horizontally enabled business services and provide cohesive experience to stakeholders</b> | + | * <b><I>Reuse common business capabilities and processes from across government and private sector</I></b> |
| | | |
| + | *<b><I>Publish in the open reusable common business capabilities and processes (in the Open Government portal) for others to develop cohesive horizontal enterprise services</I></b> |
| | | |
| + | <h2><span style="font-size: 1.5em;">Information Architecture</span></h2> |
| | | |
− | * <b><I>Reuse common business capabilities and processes from across government and private sector</b>
| + | <!-- COLUMN 1 ENDS: --> |
| + | <!-- COLUMN 2 STARTS: --> |
| | | |
| + | <h4><b><u>Collect data to address the needs of the stakeholders</u></b></h4> |
| + | *'''Assess data requirements based on stakeholder needs''' |
| + | **Prior to collecting new data, an assessment of existing data assets (e.g. in a data inventory, database, internal data catalog, or other repository) and how they might address stakeholder needs is recommended. |
| + | **Data requirements are informational gaps identified in the process of responding a stakeholder need. If it is not met, a data requirement may pose a barrier to informed decision-making, operational needs, or the delivery of a service to a citizen or business. |
| + | **A stakeholder in this context is an internal or external client or provider involved in a policy, program, or service that originates in the Government of Canada. |
| + | ** It will not always be clear whether a data asset meets the need of a stakeholder. A clear understanding and articulation of the business problem (e.g. purpose, objectives or expected outcomes, outputs, etc.) will facilitate this exercise. |
| + | *'''Collect only the minimum set of data needed to support a policy, program and service''' |
| + | **This procedure can be summarized as 'collect with a purpose'. Rather than determining your data needs ''post-hoc'' – following data collection, that is – it is recommended that data needs are specified in the process of designing the data collection methodology. |
| + | ** The 'minimum set of data' will vary by data type and business problem. For example, it may be easier to identify the minimum 'threshold' at which collected data will be sufficient to support the administration or delivery of a service. But in a foreign policy context, that threshold may not be clear: what is the minimum set of data needed to support the elaboration of Canada's Feminist International Assistance Policy? In such contexts, the only feasible approach may be to identify what is necessary (as opposed to what is sufficient) to meet the stakeholder need. |
| + | ** In a program context, data needs may be derived from Performance Information Profiles (PIPs), which include key performance indicators (KPIs) which help program managers assess progress towards targets and broader objectives. |
| + | *'''Reuse existing data assets and only acquire new data if required''' |
| + | ** Following the assessment of existing data assets recommended under the first step, evaluate the reusability of the data deemed relevant to address the stakeholder need. This involves assessing basic aspects of its quality in light of that need. For example, a dataset that may have been timely in the context of its initial usage may be outdated in the new context. |
| + | **In addition to quality, privacy and security are important considerations to take into account when evaluating the reusability of a data asset. Not all data is reusable. The reuse of personal information, for example, is restricted under the requirements of the ''Privacy Act''. Further, in some cases, the reuse of data may pose security risks to an organization or to the Government of Canada at large. A risk assessment based on criteria informed by the current policy and legislative environment is recommended to mitigate the risks of data reuse. |
| + | *'''Ensure data collected, including from third party sources, are of high quality''' |
| + | **Unless data collected (whether by a federal organization or through a third party) or generated meets basic standards of quality, it is not fit for purpose. |
| + | **There are various governmental and international approaches to assessing the quality of data. Common dimensions or aspects of quality include relevance, timeliness, consistency, reliability, interpretability, and usability. Specific considerations may be warranted for certain types of data (e.g. geospatial data). The development of a departmental data quality framework to help assess and control the quality of data is recommended. An enterprise-level framework for the Government of Canada, which all federal organizations will be able to adopt, is currently under development. |
| + | ** A routine process for profiling newly collected or generated data could help maintain the overall quality of data assets. Quality management and assurance, however, is an activity that applies throughout the lifecycle of data – from the point it is collected or generated to that at which it is disposed. Ensuring that data quality is regularly assessed and maintained is among the key responsibilities of a data steward. |
| | | |
− | * <b><I>Publish in the open reusable common business capabilities and processes (in the Open Government portal) for others to develop cohesive horizontal enterprise services</b>
| + | <h4><b><u>Manage data strategically and responsibly</u></b></h4> |
| + | ''Section under development'' (ESP/Bitar) |
| | | |
| + | <h4><b><u>Use and share data openly in an ethical and secure manner</u></b></h4>''Section under development'' (ESP/Bitar) |
| | | |
− | <h3><span style="font-size: 1.5em;">2. Information Architecture</span></h3><!-- COLUMN 1 ENDS: --> | + | <h2><span style="font-size: 1.5em;">Application Architecture</span></h2> |
− | <!-- COLUMN 2 STARTS: --><h4><b><u>Collect data to address the needs of the stakeholders</u></b></h4>
| |
− | * '''Assess data requirements based on stakeholder needs'''
| |
− | ** Prior to collecting new data, an assessment of existing data assets (e.g. in a data inventory, database, internal data catalog, or other repository) and how they might address stakeholder needs is recommended.
| |
− | ** Data requirements are informational gaps identified in the process of responding a stakeholder need. If it is not met, a data requirement may pose a barrier to informed decision-making, operational needs, or the delivery of a service to a citizen or business.
| |
− | ** A stakeholder in this context is an internal or external client or provider involved in a policy, program, or service that originates in the Government of Canada.
| |
− | ** It will not always be clear whether a data asset meets the need of a stakeholder. A clear understanding and articulation of the business problem (e.g. purpose, objectives or expected outcomes, outputs, etc.) will facilitate this exercise.
| |
− | * '''Collect only the minimum set of data needed to support a policy, program and service'''
| |
− | ** This procedure can be summarized as 'collect with a purpose'. Rather than determining your data needs ''post-hoc'' - following data collection, that is - it is recommended that data needs are specified in the process of designing the data collection methodology.
| |
− | ** The 'minimum set of data' will vary by data type and business problem. For example, it may be easier to identify the minimum 'threshold' at which collected data will be sufficient to support the administration or delivery of a service. But in a foreign policy context, that threshold may not be clear: what is the minimum set of data needed to support the elaboration of Canada's Feminist International Assistance Policy? In such contexts, the only feasible approach may be to identify what is necessary (as opposed to what is sufficient) to meet the stakeholder need.
| |
− | ** In a program context, data needs may be derived from Performance Information Profiles (PIPs), which include performance indicators (KPIs) which help program managers assess progress towards targets and broader objectives.
| |
− | * '''Reuse existing data assets and only acquire new data if required'''
| |
− | ** Following the assessment of existing data assets recommended under the first procedure, evaluate the reusability of the data deemed relevant to address the stakeholder need. This involves assessing basic aspects of its quality in light of that need. For example, a dataset that may have been timely in the context of its initial usage may be outdated in the new context.
| |
− | ** In addition to quality, privacy and security are important considerations to take into account when evaluating the resuability of a data asset. Not all data is reusable. The reuse of personal information, for example, is restricted under the requirements of the ''Privacy Act''. Further, in some cases, the reuse of data may pose security risks to an organization or to the Government of Canada at large. A risk assessment based on criteria informed by the current policy and legislative environment is recommended to mitigate the risks of data reuse.
| |
− | * '''Ensure data collected, including from third party sources, are of high quality'''
| |
− | ** Unless data collected (whether by a federal organization or through a third party) or generated meets basic standards of quality, it is not fit for purpose.
| |
− | ** There are various governmental and international approaches to assessing the quality of data. Common dimensions or aspects of quality include relevance, timeliness, consistency, reliability, interpretability, and usability. Specific considerations may be warranted for certain types of data (e.g. geospatial data). The development of a departmental data quality framework to help assess and control the quality of data is recommended. An enterprise-level framework for the Government of Canada, which all federal organizations will be able to adopt, is currently under development.
| |
− | ** A routine process for profiling newly collected or generated data could help maintain the overall quality of data assets. Quality management and assurance, however, is an activity that applies throughout the lifecycle of data - from the point it is collected or generated to that at which it is disposed. Ensuring that data quality is regularly assessed and maintained is among the key responsibilities of a data steward.
| |
− | <h4><b><u>Manage data strategically and responsibly</u></b></h4>''Section under development'' (ESP/Bitar)<h4><b><u>Use and share data openly in an ethical and secure manner</u></b></h4>''Section under development'' (ESP/Bitar)<h3><span style="font-size: 1.5em;">3. Application Architecture</span></h3> <br><br>
| |
| | | |
− | Application Architecture consists of understanding and designing the various applications within a department, how they tie in to the business service supporting the departmental mandate, where they are located in the architecture landscape of the department as well as the GC, how they interact with each other and with their users, the zoning requirements, etc. Application Architecture focuses less on internal mechanics and specific programming and more on overall design on how data is consumed and created by the system. It views the interactions between applications, databases, middleware to ensure scalability, reliability, availability and manageability. <br><br> | + | Application Architecture consists of understanding and designing the various applications within a department, how they tie in to the business service supporting the departmental mandate, where they are located in the architecture landscape of the department as well as the GC, how they interact with each other and with their users, the zoning requirements, etc. Application Architecture focuses less on internal mechanics and specific programming and more on overall design on how data is consumed and created by the system. It views the interactions between applications, databases, middleware to ensure scalability, reliability, availability and manageability. <br> |
| | | |
− | <h4><b><u>Use Open Source Solutions hosted in Public Cloud</b></h4><br> | + | <h4><b><u>Use Open Source Solutions hosted in Public Cloud</u></b></h4> |
| | | |
− | While Open Source Solution (OSS) is not a silver bullet, several common misconceptions are used as arguments against Open Source software: A misconception with security is that with the code out of the eyes of the public that it prevents successful attacks and lowers liability, however in reality Security Best practices state that 'System security should not depend on the secrecy of the implementation or its components', and as Open Source development relies and hardening (or improving the security) of code it is often equal or more secure then proprietary solutions. | + | While an Open Source Solution (OSS) is not a silver bullet, several common misconceptions are used as arguments against Open Source software: a misconception with security is that with the code out of the eyes of the public that it prevents successful attacks and lowers liability, however in reality Security Best practices state that 'System security should not depend on the secrecy of the implementation or its components', and as Open Source development relies and hardening (or improving the security) of code it is often equal to or more secure than proprietary solutions. |
− | A misconception with support is that a support contract or license some how ensures that the proprietary system will receive improvements and patches, but in reality there is no obligation for a vendor to do so, while Open Source software survives by having a vibrant and helpful support community. Average resolution of issues are solved faster then in proprietary software by the very nature of crowd sourcing reducing the barrier of communication with a single entity or individual. <br><br> | + | A misconception with support is that a support contract or license somehow ensures that the proprietary system will receive improvements and patches, but in reality there is no obligation for a vendor to do so, while Open Source software survives by having a vibrant and helpful support community. Average resolution of issues are solved faster than in proprietary software by the very nature of crowd sourcing reducing the barrier of communication with a single entity or individual. <br> |
| | | |
− | For more info on Open Source, go to the GC webpage on [https://www.canada.ca/en/government/system/digital-government/open-source-software.html Open Source Software]. <br><br> | + | For more info on Open Source, go to the GC webpage on [https://www.canada.ca/en/government/system/digital-government/open-source-software.html Open Source Software]. <br> |
| | | |
− | *<b><I> Select existing solutions that can be reused over custom built</b> | + | *<b><I> Select existing solutions that can be reused over custom built</I></b> |
| | | |
− | It is important to reduce the duplication of effort that has occurred due to segmented mandates, and increase collaboration and sharing across Departments and Agencies. Crown Corporations, Provincial and Municipal Governments as well as the Public at large who can benefit from new and innovative products and services based off of creations from the Government.<br><br> | + | It is important to reduce the duplication of effort that has occurred due to segmented mandates, and increase collaboration and sharing across Departments and Agencies. Crown Corporations, Provincial and Municipal Governments as well as the Public at large who can benefit from new and innovative products and services based off of creations from the Government.<br> |
| | | |
− | *<b><I> Contribute all improvements back to the communities</b> | + | *<b><I> Contribute all improvements back to the communities</I></b> |
| | | |
− | Major benefits can occur not just from publishing the Software, but in developing Guidance the quality of software increases, while publishing Lessons Learned, White Papers and any other technical documentation can assist others in the future by providing templates and baselines. | + | Major benefits can occur not just from publishing the Software, but in developing guidance the quality of software increases, while publishing lessons learned, white papers and any other technical documentation can assist others in the future by providing templates and baselines. |
| | | |
| For assistance in how to do this, you can view the [https://www.canada.ca/en/government/system/digital-government/open-source-software/guide-for-publishing-open-source-code.html TBS Guidance on Open Source Publishing]. | | For assistance in how to do this, you can view the [https://www.canada.ca/en/government/system/digital-government/open-source-software/guide-for-publishing-open-source-code.html TBS Guidance on Open Source Publishing]. |
| | | |
− | Setting up shared teams for common problems where Developers from multiple departments can produce better solutions. Virtual Teams using open tools can enable rapid development in absence of collocation.<br><br> | + | Setting up shared teams for common problems where developers from multiple departments can produce better solutions. Virtual teams using open tools can enable rapid development in absence of collocation.<br> |
| | | |
− | *<b><I> Register Open Source software to the [https://canada-ca.github.io/ore-ero/en/index.html Open Resource Exchange]</b> | + | *<b><I> Register Open Source software to the [https://canada-ca.github.io/ore-ero/en/index.html Open Resource Exchange]</I></b> |
| | | |
− | Scientific Innovation can occur from exposing Data to interested members of the activists, researchers, students and the public at large. | + | Scientific Innovation can occur from exposing data to interested members of the activists, researchers, students and the public at large. |
− | Define Metadata for your application early in both English and French to support your release to [https://open.canada.ca/en/open-data| Open Data]. | + | Define Metadata for your application early in both English and French to support your release to [https://open.canada.ca/en/open-data| Open Data]. |
| Development following the Government of Canada Standards on APIs can allow rapid uptake into Open Data feeds. | | Development following the Government of Canada Standards on APIs can allow rapid uptake into Open Data feeds. |
| | | |
− | <br> | + | <h4><b><u>Use Software as a Service (SaaS) hosted in Public Cloud</u></b></h4> |
| + | *<b><I>Choose SaaS that best fit for purpose based on alignment with SaaS capabilities </I></b> |
| + | *<b><I>Choose a SaaS solution that is extendable </I></b> |
| + | *<b><I>Configure SaaS and if customization is necessary extend as Open Source modules</I></b> |
| + | <h4><b><u>Design for [https://www.gcpedia.gc.ca/wiki/En/GCinterop Interoperability]</u></b></h4> |
| | | |
− | <h4><b><u>Use Software as a Service (SaaS) hosted in Public Cloud</b></h4>
| + | As the GC is transitioning to new technology and as more departments start to work together, interoperability becomes a key important factor in ensuring stability and continuity of a program. Self-discipline must be instilled to always publish and maintain APIs so that other systems or other departments can make use of and leverage the work that is already done without duplication of work and re-inventing the wheel. It can also maintain precious data flow that has been previously obtained from legacy systems. |
− | * <b><I>Choose SaaS that best fit for purpose based on alignment with SaaS capabilities </b><br>
| |
− | * <b><I>Choose a SaaS solution that is extendable </b><br>
| |
− | * <b><I>Configure SaaS and if customization is necessary extend as Open Source modules </b><br>
| |
− | <br>
| |
| | | |
− | <h4><b><u>Design for [https://www.gcpedia.gc.ca/wiki/En/GCinterop Interoperability]</b></h4>
| + | The most important use of interoperability is it provides the ability to communicate between one system to another without the need of manual intervention. It doesn't matter if one system is built with one platform, eg. UNIX/LINUX, and the other system is built with another platform, eg. Windows, "OR" if one system is legacy, e.g. mainframe, and the other is an innovative product, e.g. machine learning. With interoperability, these different systems can communicate with one another, thereby enabling efficiency and/or effectiveness of a solution. Interoperability can also enable easier communication between one department to another, thereby creating better collaboration and automation exchange of data.<br> |
− | | |
− | As the GC is transitioning to new technology and as more departments start to work together, interoperability becomes a key important factor in ensuring stability and continuity of a program. Self-discipline must be instilled to always publish and maintain API so that other systems or other departments can make use and leverage the work that is already done without duplication of work and re-inventing the wheel. It can also maintain precious data flow that has previously obtained from legacy system.
| |
− | | |
− | The most important use of interoperability is it provides the ability to communicate between one system to another without the need of manual intervention. It doesn't matter if one system is built with one platform, eg. UNIX/LINUX, and the other system is built with another platform, eg. Windows, "OR" if one system is legacy, eg. Mainframe, and the other is an innovative product, eg. machine learning. With interoperability, these different systems can communicate with one another, thereby enabling efficiency and/or effectiveness of a solution. Interoperability can also enable easier communication between one department to another, thereby creating better collaboration and automation exchange of data.<br><br> | |
− | | |
− | * <b><I>Design systems as highly modular and loosely coupled services</b><br>
| |
| | | |
| + | *<b><I>Design systems as highly modular and loosely coupled services</I></b> |
| A good system design starts from building a small simple independent function. Focus on smallest unit of purpose, and develop a single function. The small single function can then become a building block for a larger more complicated function, and be combined with other simple functions to finally create a service. Having a simple independent function also means that it be reused to create another complicated function. Thus, it is very important to build a function that is small and simple enough to make it highly modular. | | A good system design starts from building a small simple independent function. Focus on smallest unit of purpose, and develop a single function. The small single function can then become a building block for a larger more complicated function, and be combined with other simple functions to finally create a service. Having a simple independent function also means that it be reused to create another complicated function. Thus, it is very important to build a function that is small and simple enough to make it highly modular. |
| | | |
− | When creating a container, ensure each container contain a single application and build the smallest image possible. It is also important to ensure containers are properly versioned and tagged to be able to easily manage them. | + | When creating a container, ensure that each container encompasses a single application and builds the smallest image possible. It is also important to ensure containers are properly versioned and tagged to be able to easily manage them. |
| | | |
| When one is at the point of starting to create multiple services, it is important to make sure the services are loosely coupled. This way, even the services can also be re-used, either by other projects, programs or even other departments. | | When one is at the point of starting to create multiple services, it is important to make sure the services are loosely coupled. This way, even the services can also be re-used, either by other projects, programs or even other departments. |
− | <br><br>
| + | <br> |
| | | |
− | * <b><I>Expose services through APIs </b> | + | *<b><I>Expose services through APIs </I></b> |
| | | |
− | Do not hide services under assumptions that someone would not find value in a service - often innovation can be bred from exposed services beyond it's original plan. | + | Do not hide services under assumptions that someone would not find value in a service – often innovation can be bred from exposed services beyond it's original plan. |
− | Follow the 'eat your own dogfood' mantra - in that all functionality should be a service that you consume. | + | Follow the 'eat your own dogfood' mantra – in that all functionality should be a service that you consume. |
− | Ensure that services are accessible via common methodologies, and follow the Government of Canada Standards on APIs. | + | Ensure that services are accessible via common methodologies and follow the Government of Canada Standards on APIs. |
− | <br><br>
| + | <br> |
| | | |
− | * <b><I>Make the APIs discoverable to the appropriate stakeholders</b> | + | *<b><I>Make the APIs discoverable to the appropriate stakeholders</I></b> |
| | | |
− | When a system have an API that is discoverable, it opens up its window to the world of endless possibilities, collaboration and better outcomes for the whole GC. One way to make an API discoverable is by publishing it to the [https://api.canada.ca/en/homepage#all-apis API Store] and the future DxP (Digital Exchange Platform). | + | When a system has an API that is discoverable, it opens up its window to the world of endless possibilities, collaboration and better outcomes for the whole GC. One way to make an API discoverable is by publishing it to the [https://api.canada.ca/en/homepage#all-apis API Store] and the future DxP (Digital Exchange Platform). |
− | <br><br>
| + | <br> |
| | | |
− | <h4><b><u>Follow [https://www.devsecops.org/blog/2015/2/15/what-is-devsecops DevSecOps] Principles</b></h4> | + | <h4><b><u>Follow [https://www.devsecops.org/blog/2015/2/15/what-is-devsecops DevSecOps] Principles</u></b></h4> |
| The purpose and intent of DevSecOps is to build on the mindset that "everyone is responsible for security" with the goal of safely distributing security decisions at speed and scale to those who hold the highest level of context without sacrificing the safety required. | | The purpose and intent of DevSecOps is to build on the mindset that "everyone is responsible for security" with the goal of safely distributing security decisions at speed and scale to those who hold the highest level of context without sacrificing the safety required. |
− | <br><br>
| + | <br> |
| | | |
| <!-- COLUMN 1 STARTS: --> | | <!-- COLUMN 1 STARTS: --> |
Line 288: |
Line 269: |
| | | |
| |- valign="top" | | |- valign="top" |
− | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | | + | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | |
− | [[Image: DevSecOps_Best_Practices_-_DZone.jpg | 500px | left]] <br><br> | + | [[Image: DevSecOps_Best_Practices_-_DZone.jpg | left|alt=]] <br><br> |
| <div style="font-size:1.0em; text-align:centre;"> source: Dzone</div> | | <div style="font-size:1.0em; text-align:centre;"> source: Dzone</div> |
| <!-- COLUMN 1 ENDS: --> | | <!-- COLUMN 1 ENDS: --> |
− | <!-- COLUMN 2 STARTS: --> | + | <!-- COLUMN 2 STARTS: --> |
− | | width="50.0%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" |
| |
| <!-- COLUMN 2 ENDS: --> | | <!-- COLUMN 2 ENDS: --> |
− | <!-- TABLE ENDS --> |} | + | <!-- TABLE ENDS -->|} |
| <!-- COLUMN ENDS: --> | | <!-- COLUMN ENDS: --> |
− | <br><br>
| |
| | | |
| + | *<b><I>Use continuous integration and continuous deployments (CI/CD)</I></b> |
| + | *<b><I>Ensure automated testing occurs for security and functionality </I></b> |
| + | *<b><I>Include your stakeholders as part of DevSecOps process</I></b> |
| | | |
− | * <b><I>Use continuous integration and continuous deployments (CI/CD)</b>
| + | <h2><span style="font-size: 1.5em;">Technology Architecture</span></h2> |
− | * <b><I>Ensure automated testing occurs for security and functionality </b>
| |
− | * <b><I>Include your stakeholders as part of DevSecOps process</b>
| |
− | | |
− | | |
− | <h3><span style="font-size: 1.5em;">4. Technology Architecture</span></h3> <br><br>
| |
| | | |
| <h4><b>Use Cloud first</b></h4> | | <h4><b>Use Cloud first</b></h4> |
− | * Adopt the Use of the GC Accelerators to ensure proper Security and Access Controls | + | *Adopt the use of the GC Accelerators to ensure proper security and access controls |
− | * Enforce this order of preference: Software as a Service (SaaS) first, then Platform as a Service (PaaS), and lastly Infrastructure as a Service (IaaS) | + | *Enforce this order of preference: Software as a Service (SaaS) first, then Platform as a Service (PaaS), and lastly Infrastructure as a Service (IaaS) |
− | * Fulfill Cloud Services through SSC Cloud Brokering Services | + | *Fulfill Cloud Services through SSC Cloud Brokering Services |
| * Enforce this order of preference: Public cloud first, then Hybrid cloud, then Private cloud, and lastly non-cloud (on-premises) solutions | | * Enforce this order of preference: Public cloud first, then Hybrid cloud, then Private cloud, and lastly non-cloud (on-premises) solutions |
− | * Design for cloud mobility and develop an exit strategy to avoid vendor lock-in | + | *Design for cloud mobility and develop an exit strategy to avoid vendor lock-in |
− | <br>
| |
| | | |
| <h4><b>Design for Performance, Availability, and Scalability</b></h4> | | <h4><b>Design for Performance, Availability, and Scalability</b></h4> |
− | * Ensure response times meet user needs, and critical services are highly available | + | *Ensure response times meet user needs, and critical services are highly available |
− | * Support zero-downtime deployments for planned and unplanned maintenance | + | *Support zero-downtime deployments for planned and unplanned maintenance |
| * Use distributed architectures, assume failure will happen, handle errors gracefully, and monitor <u><I>performance and behaviour </I></u> actively | | * Use distributed architectures, assume failure will happen, handle errors gracefully, and monitor <u><I>performance and behaviour </I></u> actively |
− | * Establish architectures that supports new technology insertion with minimal disruption to existing programs and services | + | *Establish architectures that supports new technology insertion with minimal disruption to existing programs and services |
− | * Control Technical Diversity - design systems based on modern technologies and platforms already in use | + | *Control Technical Diversity – design systems based on modern technologies and platforms already in use |
| | | |
| + | <h2><span style="font-size: 1.5em;">Security Architecture</span></h2>Input from Cyber, Sept 23, 2020 |
| | | |
− | <h3><span style="font-size: 1.5em;">5. Security and Privacy Architecture</span></h3> <br><br>
| + | ===Overview of the GC Enterprise Security Architecture (ESA) Program=== |
| + | The GC ESA program is a government-wide initiative to provide a standardized approach to developing IT security architecture, ensuring that basic security blocks are implemented across the enterprise as the infrastructure is being renewed. The image on the right shows how the GC ESA program supports the direction the GC is taking with regards to GC IT security. |
| | | |
− | <h4><b>Build Security into the Full System Life Cycle, Across All Architectural Layers</b></h4>
| + | The GC ESA program aims to: |
− | * Identify and classify risks associated to the service’s business objectives, goals, and strategy | + | *Ensure more cost-effective, interoperable, resilient and secure IT solutions in support of GC enterprise objectives; |
− | * Design security measures according to business and user needs, risks identified, and security categorization of the information and assets; integrate security across all architectural layers (BIAT) | + | *Maintain availability of GC systems and services while complying with relevant GC legislation and policy instruments; |
− | ** Maintain focus on users’ ease of use through selection of context-appropriate controls | + | *Adopt an architecture methodology and approach to ensure common understanding, alignment, and reduce duplication of effort amongst interdepartmental stakeholders; |
− | ** Apply an information-centric approach to reduce resources’ exposure to threats, and minimize the opportunity for compromise. | + | *Ensure security of information, IT infrastructure and applications with the implementation of consistent security controls which reduces total cost of ownership; and |
− | ** Protect data while in transit, in use and at rest using appropriate encryption and protocols. Ensure effective disposition of data per retention schedules, following service sunset.
| + | *Keep risk at acceptable levels. |
| + | The GC ESA program will serve as a guide to departments and agencies in planning, implementing, and operating their information systems by offering the necessary framework, tools, and templates to design, evaluate, and build an IT security architecture tailored to their organization, in accordance with Communications Security Establishment’s (CSE) [https://cyber.gc.ca/en/guidance/it-security-risk-management-lifecycle-approach-itsg-33 ITSG-33 – IT Security Risk Management: A Lifecycle Approach] and other security industry best practices in the area of architecture, risk management and compliance. |
| | | |
− | * Design systems to not be susceptible to common security vulnerabilities; resilient and can be rebuilt quickly in the event of compromise; and fail secure if the system encounters an error or crashes | + | More information can be found here: |
− | * Reduce human intervention and maximize automation of security tasks and processes | + | *[https://www.gcpedia.gc.ca/wiki/Government_of_Canada_Enterprise_Security_Architecture_(ESA)_Program; Government of Canada Enterprise Security Architecture (ESA) Program and here:] |
− | ** Integrate and automate security testing to validate code and address vulnerabilities prior to deployments | + | *[https://www.gcpedia.gc.ca/gcwiki/images/a/ac/GC_ESA_Description_Document_%28ESADD%29_-_Main_Body.pdf GC ESA Description Document Main Body -- Synopsis] |
− | <br>
| + | Additional ESA initiatives can be found by clicking on the embedded link for: |
| + | *GC Cloud Reference Architecture; |
| + | *[https://www.gcpedia.gc.ca/gcwiki/images/8/86/GC_Zero_Trust_Reference_Architecture.pdf DRAFT GC Zero Trust Security Reference Architecture;] |
| + | *[https://www.gcpedia.gc.ca/wiki/ESA_Initiatives Many other ESA Initiatives] |
| | | |
− | <h4><b>Ensure Secure Access to Systems and Services</b></h4>
| + | ===GC Identity, Credential and Access Management (ICAM) === |
− | * Identify and authenticate individuals, processes and/or devices to an appropriate level of assurance before granting access to information and services
| + | Overview of the GC ICAM Program |
− | * Separate and compartmentalize user responsibilities and privileges; assign the least set of privileges necessary to complete the job
| |
− | * Constrain service interfaces to authorized entities (users and devices), with clearly defined roles, and only expose the interfaces necessary to operate the service
| |
− | * Make use of modern password guidance, and use GC-approved multi-factor authentication where required to stop unauthorized access
| |
− | (prioritize length over complexity, eliminating expiry, and blacklisting common passwords)
| |
− | <br><br>
| |
| | | |
− | <h4><b>Maintain Secure Operations</b></h4>
| + | The Government of Canada is working towards a digital identity ecosystem for the country that will be used by all levels of government and the private sector to deliver services and issue digital identities to citizens. This means Canadians will be able to seamlessly access services anytime, anywhere and on any device. |
− | * Integrate aggregate outputs from security assessment and authorization activities into security architecture lifecycle processes, to ensure reference artefacts remain relevant and valid
| |
− | * Continuously monitor system events and performance in order to detect, prevent, and respond to attacks
| |
− | * Design processes to operate and manage services securely, and establish processes and mechanisms to respond effectively to security events
| |
− | ** Collect transaction logs at infrastructure and application levels to support automated root-cause analysis and performance tuning
| |
− | ** Include an audit function in information systems. Use a trusted time source and protect audit logs from manipulation
| |
− | * Establish processes to monitor security advisories, and apply security-related patches and updates to reduce exposure to vulnerabilities. Apply appropriate risk-based mitigations when patches can’t be applied
| |
− | <br>
| |
| | | |
− | <h4><b> Privacy by Design </b></h4>
| + | Included in that work are three important initiatives: |
− | * Perform a privacy impact assessment (PIA) to support risk mitigation activities when personal information is involved
| + | *[https://www.gcpedia.gc.ca/wiki/GCpass_-_the_GC_Internal_Centralized_Authentication_Service_(ICAS) GCPass] |
− | * Perform [https://www.canada.ca/en/government/system/digital-government/modern-emerging-technologies/responsible-use-ai/algorithmic-impact-assessment.html Algorithmic Impact Assessment (AIA)] to support risk mitigation activities when deploying an automated decision system | + | *Sign-in-Canada; and |
− | * Implement security measures to assure the protection of personal information
| + | *[https://github.com/canada-ca/PCTF-CCP Pan-Canadian Trust Framework] |
− | * Take into consideration the <b>[https://www.ryerson.ca/pbdce/certification/seven-foundational-principles-of-privacy-by-design/ 7 Foundational Privacy Design Principles] </b> when designing services
| + | <br>[https://gcdocs.tbs-sct.gc.ca/gcdocs/llisapi.dll?func=ll.gettz&OTDS&NextURL=https%3A%2F%2Fgcdocs%2Etbs%2Dsct%2Egc%2Eca%2Fgcdocs%2Fllisapi%2Edll%3Ffunc%3Dll%26objaction%3Doverview%26objid%3D34328350 GC Digital Identity ICAM Reference Architecture] |
| | | |
− | <!-- FOOTER -->{| width="100%" cellpadding="10" | + | [https://www.tbs-sct.gc.ca/pol/doc-eng.aspx?id=30678§ion=html Guideline on Identity Assurance]<br><!-- FOOTER --> |
| + | {| width="100%" cellpadding="10" |
| | | |
| |- valign="top" | | |- valign="top" |
− | | style="color:#3C6D9E;" | | + | | style="color:#3C6D9E;" | |
| <!-- COLUMN STARTS: --> | | <!-- COLUMN STARTS: --> |
| <div style="font-size: 1.8em; text-align:center;">Need help? Contact us.</div> | | <div style="font-size: 1.8em; text-align:center;">Need help? Contact us.</div> |
− |
| |
− |
| |
| | | |
| <!-- COLUMN 1 STARTS: --> | | <!-- COLUMN 1 STARTS: --> |
Line 373: |
Line 342: |
| | | |
| |- valign="top" | | |- valign="top" |
− | | width="33.3%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | | + | | width="33.3%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | |
| [[Image: Envelope_icon_blue.png |100px | center]] | | [[Image: Envelope_icon_blue.png |100px | center]] |
| <div style="font-size:1.5em; text-align:center; color:white;">{{em|ZZCIOBDP@tbs-sct.gc.ca}}</div> | | <div style="font-size:1.5em; text-align:center; color:white;">{{em|ZZCIOBDP@tbs-sct.gc.ca}}</div> |
Line 379: |
Line 348: |
| | | |
| <!-- COLUMN 2 STARTS: --> | | <!-- COLUMN 2 STARTS: --> |
− | | width="33.3%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | | + | | width="33.3%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | |
| [[Image: gccollab_icon_blue.png |100px | center]] | | [[Image: gccollab_icon_blue.png |100px | center]] |
− | <div style="font-size:1.5em; text-align:center;">[https://gccollab.ca/groups/profile/1896301/enenterprise-architecture-community-of-practicefrcommunitu00e9-de-pratique-de-architecture-integru00e9e GC EA CoP Collab]</div> | + | <div style="font-size:1.5em; text-align:center;">[[gccollab:groups/profile/1896301/enenterprise-architecture-community-of-practicefrcommunitu00e9-de-pratique-de-architecture-integru00e9e|GC EA CoP Collab]]</div> |
| <!-- COLUMN 2 ENDS: --> | | <!-- COLUMN 2 ENDS: --> |
| | | |
| <!-- COLUMN 3 STARTS: --> | | <!-- COLUMN 3 STARTS: --> |
− | | width="33.3%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | | + | | width="33.3%" style="border: 1px solid lightgray; background-color:#fff; color:#409DE2;" | |
| [[Image: gcconnex_icon_blue.png |100px | center]] | | [[Image: gcconnex_icon_blue.png |100px | center]] |
| <div style="font-size:1.5em; text-align:center;">[https://gcconnex.gc.ca/groups/profile/7322003/gc-ea-working-group?language=en GC EA Connex]</div> | | <div style="font-size:1.5em; text-align:center;">[https://gcconnex.gc.ca/groups/profile/7322003/gc-ea-working-group?language=en GC EA Connex]</div> |
| <!-- COLUMN 3 ENDS: --> | | <!-- COLUMN 3 ENDS: --> |
− | <!-- TABLE ENDS --> |} | + | <!-- TABLE ENDS -->|} |
| | | |
| <!-- COLUMN ENDS: --> | | <!-- COLUMN ENDS: --> |
− | <!-- TABLE ENDS --> |} | + | <!-- TABLE ENDS -->|} |
| <!-- end --> | | <!-- end --> |