This is a DRAFT COPY of the proposed updates to the GC EA standards
Changes from the previous version are marked as underlined and new additions are marked as italic and underlined
The GC Enterprise Architecture standard is part of the Directive on Management of Information Technology. It is listed as Appendix C - Mandatory Procedures for Enterprise Architecture Assessment in the Directive.
To view more detailed info on each point listed below, you can click on the top title for each of the Architecture layer, OR any of the blue link below.
|
1. Business Architecture
Fulfill the Government of Canada stakeholder's needs
- Clearly identify internal and external stakeholders and their needs for each business service including user centric design
- Include policy requirement applying to specific stakeholder groups, such as accessibilities, gender based+ analysis, and official languages in the creation of the service
- Model end-to-end business service delivery to provide quality, maximize effectiveness and optimize efficiencies across all channels (e.g lean process)
Architect to be Outcome Driven and Strategically Aligned to the Department and to the Government of Canada
- Identify which departmental/GC business services, outcomes and strategies will be addressed
- Establish metrics for identified business outcomes throughout the lifecycle of an investment
- Translate business outcomes and strategy into business capability implications in the GC Business Capability Model to establish a common vocabulary between business, development, and operation
Promote Horizontal Enablement of the Enterprise
- Identify opportunities to horizontally enabled business services and provide cohesive experience to stakeholders
- Reuse common business capabilities and processes from across government and private sector
- Publish in the open reusable common business capabilities and processes (in the Open Government portal) for others to develop cohesive horizontal enterprise services
|
|
2. Information Architecture
Data Collection
- Ensure data is collected responsibly and in a manner that maximizes use, reuse and availability of data
- Align to existing enterprise and international standards, or where none exist, develop standards in the open with key subject matter experts and consultation with Enterprise Data Community of Practice
- When collecting personal data or information, ensure that your practices are responsible and align with enterprise data ethics standards as well as relevant policy and legislation. The Policy Direction to Modernize the Government of Canada’s Sex and Gender Information Practices is an example of relevant policy that can inform considerations of gender diversity and inclusion.
- Ensure data is collected only if it cannot be obtained through data-sharing
- Ensure that data collection methodology yields high quality data in alignment with enterprise data standards
- Engage with key stakeholders within the federal government, as well as provincial, territorial and other levels of government, including indigenous people
- Adopt a needs-based approach to data collection and review existing data assets prior to collecting or acquiring new data
- Ensure access and quality provisions are in place for data collected or acquired through third-party contracting services
Ensure that Data is Managed Responsibly and in a manner that Maximize Use, Reuse and Availability of Data
- Align with enterprise and departmental policies and standards on data architecture and governance
- Enable discoverability, accessibility, resiliency and availability of the departmental data assets
- Asses, control and monitor data quality in alignment with enterprise data standards
- Define and establish clear roles, responsibilities and accountabilities for data management
- Where possible, use automation to support the management of data
- Identify and document the lineage of the departmental data assets
- Regularly assess the value of the departmental data assets and undertake retention and disposition as per existing schedules
- Only handle data which is essential to your service. Do not store all data that you capture unless absolutely necessary
- Ensure data is stored in a secure manner in accordance with CSE approved cryptographic algorithms and protocols and legislation such as the Privacy Act
- Manage departmental data in a way that enables interoperability, not only within the department, but also at the enterprise level
- Ensure that data is used in an Ethical and Secure manner
- Ensure that combined data does not risk identification or re-identification of sensitive or personal information
- Ensure the data is fit for the use it is employed for in accordance with data quality guidelines
- Inform decisions by the appropriate data and information
Data Sharing
- Data should be shared openly by default as per the Directive on Open Government
- If data cannot be shared, explicitly state the laws and/or regulations preventing its sharing
- Ensure that any data you share adheres to existing enterprise and international standards, including on quality or fitness for purpose
- Encourage data sharing and collaboration
- Ensure that data received from external parties is profiled and validated prior to its use.
- Enable internal and external sharing of data and information as appropriate
|
|
3. Application Architecture
Use Open Source Solutions hosted in the Cloud
- Select existing solutions that can be reused over custom built
- Contribute all improvements back to the communities
- Register Open Source software to the Open Resource Exchange
Use SaaS hosted in the Cloud
- Choose SaaS that are extendable
- Align with SaaS capabilities; extend as Open Source modules
- Configuration over customization
Design for Interoperability
- Design systems to be highly modular, loosely coupled and aligned to Business Capability Model 2.0
- Use micro services scoped to a single purpose and API-led connectivity
- Expose functionality as services, make services available through APIs and make the APIs discoverable
Use DevOps / Continuous Integration to ensure maintainability and AB Testing
- Work with multidisciplinary teams
- Ensure testing and QA is completed
- Work in the open; Release source code developed via GC website and GC services
|
|
4. Technology Architecture
Use Cloud first
- Adopt the Use of the GC Accelerators to ensure proper Security and Access Controls - Azure, AWS
- Enforce this order of preference: Software as a Service (SaaS) first, then Platform as a Service (PaaS), and lastly Infrastructure as a Service (IaaS)
- Enforce this order of preference: Public cloud first, then Hybrid cloud, then Private cloud, and lastly non-cloud (on-premises) solutions
- Design for cloud mobility and develop an exit strategy to avoid vendor lock-in
Design for Performance, Availability, and Scalability
- Design for resiliency
- Ensure response times meet user needs, and critical services are highly available
- Support zero-downtime deployments for planned and unplanned maintenance
- Use distributed architectures, assume failure will happen, handle errors gracefully, and monitor performance and behaviour actively
- Run applications in containers to enable rapid deployment and scaling
- Establish architectures that supports new technology insertion with minimal disruption to existing programs and services
- Control Technical Diversity - design systems based on modern technologies and platforms already in use.
|
|
5. Security Architecture and Privacy
Build Security into the Full System Life Cycle, Across All Architectural Layers
- Identify and classify risks associated to the service’s business objectives, goals, and strategy
- Design security measures according to business and user needs, risks identified, and security categorization of the information and assets; integrate security across all architectural layers (BIAT).
- Maintain focus on users’ ease of use through selection of context-appropriate controls
- Apply an information-centric approach to reduce resources’ exposure to threats, and minimize the opportunity for compromise.
- Protect data while in transit, in use and at rest using appropriate encryption and protocols. Ensure effective disposition of data per retention schedules, following service sunset.
- Design systems that: are not susceptible to common security vulnerabilities; are resilient and can be rebuilt quickly in the event of compromise; and fail secure if the system encounters an error or crashes.
- Reduce human intervention and maximize automation of security tasks and processes.
- Integrate and automate security testing to validate code and address vulnerabilities prior to deployments
Ensure Secure Access to Systems and Services
- Identify and authenticate users and devices to an appropriate level of assurance before granting access to information and services.
- Separate and compartmentalize user responsibilities and privileges; assign the least set of privileges necessary to complete the job.
- Constrain service interfaces to authorized entities (users and devices), with clearly defined roles, and only expose the interfaces necessary to operate the service
- Make use of modern credential guidance, and use GC-approved multi-factor authentication where required to stop unauthorized access.
Maintain Secure Operations
- Integrate SA&A activities into security architecture lifecycle processes, to ensure reference artefacts remain relevant and valid.
- Continuously monitor system events and performance in order to detect, prevent, and respond to attacks.
- Design processes to operate services securely, and establish processes and mechanisms to respond effectively to security events.
- Collect transaction logs at infrastructure and application levels to support automated root-cause analysis and performance tuning.
- Include an audit function in information systems. Use a trusted time source and protect audit logs from manipulation.
- Establish processes to monitor security advisories, and apply security-related patches and updates. Apply appropriate risk-based mitigations when patches can’t be applied.
Privacy by Design
- Perform a privacy impact assessment (PIA) to support risk mitigation activities when personal information is involved
- Implement security measures to assure the protection of personal information
- Take into consideration the 7 Foundational Privacy Design Principles when designing services.
|
