GC Security Assessments - Repository
Purpose
This site hosts an inventory of completed security assessment reports.
As per the Policy on Government Security, departments and agencies must perform security assessment and authorization of their information systems or services before approving them for operation. In the context of cloud, this responsibility extends to any additional security controls being implemented to satisfy departmental requirements. Consideration of the departmental risk profile and the department’s culture, mission and business objectives, and the threats that pertain to the departmental business activities, will help determine the proportionate security measures needed to ensure the adequate protection of GC information.
Understanding the overall effectiveness of security controls is essential in determining and managing the residual risks under which a cloud-based service will be operating. Prioritizing security at the beginning of a project life cycle and building security in cloud-based services from the outset are also effective ways to streamline security assessment and ensure successful authorization.
Departments that are seeking to consume cloud services can leverage the results of GC-assessed CSPs to support risk-based decisions. It is expected that departments review these assessments, with consideration of the scope and security outlined in the report, and in conjunction with the security assessments performed for security controls that departments are responsible for implementing.
Completed Security Assessments
Last updated - 7 March 2021
The following table provides an inventory of completed security assessments.
