Difference between revisions of "GC Enterprise Architecture/Standards/Security and Privacy Architecture"

From wiki
Jump to navigation Jump to search
m (Use template header/footer)
 
(5 intermediate revisions by 3 users not shown)
Line 1: Line 1:
<!-- NAV -->
+
{{OCIO_GCEA_Header}}
{| class="FCK__ShowTableBorders" style="border-right: 0px; border-top: 0px; border-left: 0px; border-bottom: 0px; background-color: #3C6D9E" width="100%" align="center"
 
|-
 
|-
 
| style="border-right: white 1px ridge; padding-right: 0px; padding-left: 0px; padding-bottom: 2px; padding-top: 2px; text-align: center; font-family: (Cooper black); font-size: 13pt" width="6%" | '''[[GC_Enterprise_Architecture|<span style="color: snow">'''Home'''</span>]]'''
 
 
 
| style="border-right: white 1px ridge; padding-right: 0px; padding-left: 0px; padding-bottom: 2px; padding-top: 2px; text-align: center; font-family: (Cooper black); font-size: 13pt" width="11%" | '''[[Government_of_Canada_Architectural_Standards|<span style="color: Snow">'''EA standards'''</span>]]'''
 
 
 
| style="border-right: white 1px ridge; padding-right: 0px; padding-left: 0px; padding-bottom: 2px; padding-top: 2px; text-align: center; font-family: (Cooper black); font-size: 13pt" width="13%" | '''[[Past_Endorsed_Architectural_Decisions|<span style="color: Snow">'''EARB Endorsements'''</span>]] '''
 
 
 
| style="border-right: white 1px ridge; padding-right: 0px; padding-left: 0px; padding-bottom: 2px; padding-top: 2px; text-align: center; font-family: (Cooper black); font-size: 13pt" width="11%" | '''[[Enterprise_Architecture_Artifacts|<span style="color: Snow">'''EA Artifacts'''</span>]] '''
 
 
 
| style="border-right: white 1px ridge; padding-right: 0px; padding-left: 0px; padding-bottom: 2px; padding-top: 2px; text-align: center; font-family: (Cooper black); font-size: 13pt" width="12%" | '''[[Architecture_Discussions|<span style="color: Snow">'''Working Groups'''</span>]] '''
 
 
 
| style="border-right: white 1px ridge; padding-right: 0px; padding-left: 0px; padding-bottom: 2px; padding-top: 2px; text-align: center; font-family: (Cooper black); font-size: 13pt" width="11%" | '''[[GC EARB|<span style="color: Snow">'''GC EARB'''</span>]] '''
 
 
 
| style="border-right: white 1px ridge; padding-right: 0px; padding-left: 0px; padding-bottom: 2px; padding-top: 2px; text-align: center; font-family: (Cooper black); font-size: 13pt" width="9%" | '''[[Monitoring_Architectural_Implementation|<span style="color: Snow">'''Other References'''</span>]] '''
 
 
 
|}
 
 
 
<!-- NAV end -->
 
  
 
<i>{{Translation to follow}}</i>
 
<i>{{Translation to follow}}</i>
Line 47: Line 27:
  
 
==Design for Security and Privacy==
 
==Design for Security and Privacy==
* Implement security across all architectural layers
+
<br>
* Categorize data properly to determine appropriate safeguards
+
<b>* Implement security across all architectural layers </b>
* Perform a privacy impact assessment (PIA) when personal information is involved
+
 
* Balance user and business needs with proportionate security measures
+
  For Protected A Data, it can reside outside of Canada, provided the country is listed in the approved list and follow the requirements below: <br>
 +
    - The Supplier must certify that the delivery and provisioning of Services under this contract must be from a country within the North Atlantic Treaty Organization (NATO) (https://www.nato.int/cps/en/natohq/nato_countries.htm), the European Union (EU) (https://europa.eu/european-union/about-eu/countries_en); or from a country with which Canada has an international bilateral industrial security instrument. <br>
 +
    - The Contract Security Program (CSP) has international bilateral industrial security instruments with the countries listed on the following PSPC website: http://www.tpsgc-pwgsc.gc.ca/esc-src/international-eng.html and as updated from time to time.
 +
 
 +
<b>* Categorize data properly to determine appropriate safeguards</b>
 +
 
 +
For various possible cloud connection type and the associated security profile for each connection type, please refer to the presentation from Cyber Security, can be found from the GC Collab link below:
 +
https://gccollab.ca/file/group/1896382/all#
 +
 
 +
It contains possible network flow for each scenario and how security can be implemented.
 +
 
 +
<br>
 +
 
 +
<b>* Perform a privacy impact assessment (PIA) when personal information is involved</b>
 +
 
 +
<b>* Balance user and business needs with proportionate security measures</b>
 +
 
 +
{{OCIO_GCEA_Footer}}

Latest revision as of 15:31, 24 July 2020


<<Application Architecture

Enterprise Architecture Standard main page>>


5. Security & Privacy Architecture


This is a definition for GC Security and Privacy Enterprise Architecture

Design for Security and Privacy


* Implement security across all architectural layers

 For Protected A Data, it can reside outside of Canada, provided the country is listed in the approved list and follow the requirements below: 
- The Supplier must certify that the delivery and provisioning of Services under this contract must be from a country within the North Atlantic Treaty Organization (NATO) (https://www.nato.int/cps/en/natohq/nato_countries.htm), the European Union (EU) (https://europa.eu/european-union/about-eu/countries_en); or from a country with which Canada has an international bilateral industrial security instrument.
- The Contract Security Program (CSP) has international bilateral industrial security instruments with the countries listed on the following PSPC website: http://www.tpsgc-pwgsc.gc.ca/esc-src/international-eng.html and as updated from time to time.

* Categorize data properly to determine appropriate safeguards

For various possible cloud connection type and the associated security profile for each connection type, please refer to the presentation from Cyber Security, can be found from the GC Collab link below: https://gccollab.ca/file/group/1896382/all#

It contains possible network flow for each scenario and how security can be implemented.


* Perform a privacy impact assessment (PIA) when personal information is involved

* Balance user and business needs with proportionate security measures