Policy

---

---

Policy Instruments

The Treasury Board Secretariat (TBS) had developed a set of policy instruments that provide the necessary policy guidance to enable smooth cloud adoption across the Government of Canada.

Strategic Plan

• Digital Operations Strategic Plan: 2018-2022
• Government of Canada Strategic Plan for Information Management and Information Technology 2017-2021
• Government of Canada Cloud Adoption Strategy: 2018 update

Policy and Directive

• Policy on Service and Digital
• Directive on Service and Digital
• Policy on Management of Information Technology
• Policy Framework for Information and Technology
• Policy on Information Management
• Directive on Automated Decision-Making

Standards and Guidelines

• Digital Standards
• Standards on Application Programming Interfaces (APIs)
• Government of Canada right cloud selection guidance
• Government of Canada cloud security risk management approach and procedures
• Government of Canada Security Control Profile for Cloud-based GC Services
• Government of Canada White Paper: Data Sovereignty and Public Cloud
• Security and identity management guidance - Directives, standards, guidelines and publications related to security
• Secure use of cloud services - How to put in place secure cloud solutions.
• Recommended controls for cloud-based services - How to secure, manage, and use cloud services.
• Using electronic signatures- Guidance on using electronic signatures in support of the GC’s day-to-day business activities.
• Secure electronic signature regulations - Getting a valid electronic signature.
• Public key infrastructure - Guideline on creating public keys for secure identity management
• Password management guidance - How government services should manage user passwords
• Privacy Impact Assessment Summaries - Privacy Impact Assessments (PIAs)
• Choosing the right cloud service - Find out which cloud deployment model is right for your organization.
• Data residency requirements - Understand the Government of Canada’s requirements for the storage of data within Canada.
• Secure use of cloud services - How to put in place secure cloud solutions.
• Risk-management for cloud-based services - Protect cloud services by ensuring that the proper security controls are in place.
• Data sovereignty in cloud environments - Assessing the risks of foreign governments accessing Canadian data in the cloud.

Cloud Security Initiative

Overview

Cloud computing has introduced a fundamental shift in the way IT services are delivered and the Government of Canada (GC) will position itself to use this alternative service delivery model. Cloud adoption will ensure that the GC can continue to sustain IT service excellence during a period of increased demand by Canadians for online services and timely access to accurate information. This developing shift will affect how we procure, secure, and work with IT systems that support GC and departmental programs and services. Under the cloud computing paradigm, the GC will depend on vendors for many aspects of security and privacy, and in doing so, will confer a level of trust onto the cloud service provider (CSP). To establish this trust, the GC requires an IT security risk management approach and procedures that are adapted to cloud computing. For more information about the Cloud Security Initiative, please read the GC Cloud Security Risk Management Approach and Procedures document and the Cloud Adoption Strategy.
For more information on the GC Cloud Security Initiative consult https://www.gcpedia.gc.ca/wiki/Cloud_Security_Initiative.

Cloud Security

Overview and Current Situation in Government of Canada

Cloud computing has made the jump from buzzword to deployed technology. However, many potential cloud customers do not understand the scope of the cloud, how it should be used, and how to address security in the cloud. The image below is a simplified view of an enterprise such as the GC. The goal of the organization is to provide needed services to the citizens of Canada and other public users as well as internal services to allow GC employees and contractors to keep the business of the GC running. Service delivery is the ultimate goal, but there are several foundational elements provided by the people, processes, and technology of the GC. The technical contribution to the foundation is contained in information technology and information systems (IT/IS). As shown in the image on the left, cloud computing is simply an enabling information technology supporting the mission of the business of the enterprise.

The GC IT/IS enterprise is large in scope and geography, yielding a challenging operational, maintenance, and security environment. GC users hail from 400,000+ federal government employees and 100,000+ federal government business enterprise employees. Canada's population is 35 million, representing the pool of potential Canadian citizen public users. GC resources are also accessed by non-Canadian public users, including international visitors to GC sites. The hundreds of GC agencies and departments are spread across the country and around the world, each with independent policies, assets, and resultant security postures.

Currently, the GC operates 480+ data centres attached to thousands of stove-piped networks running unique instances of front-office and back-office applications. These data centres consist of purpose built servers racked for each application, resulting in low hardware utilization rates (i.e. 15% or less), long lead times for provisioning (i.e. weeks to months), sub-optimal use of data centre space, power and cooling, and high recurring costs.

Current use of cloud computing is department-based, deployed internally in department-hosted private data centres and clouds for processing sensitive information and contracted with cloud providers for unclassified and public information sites. This distributed, department-led IT procurement and deployment model leads to a number of enterprise level issues, including: inconsistent application and adoption of new technologies and business processes, standards, and open systems; a lack of ability to adapt to the changing threat environment while increasing the threat surface faster than security mitigations are deployed; incomplete network and element awareness and mapping; independently owned and operated legacy applications (5000+) and associated data and information stores, many without a path to a consolidated infrastructure and modern security protections; limited inter-domain interoperability and inadequate information sharing and access between agencies, departments, and partners. All of these effects perpetuating the expensive, inefficient, and insecure aspects of the current enterprise.

A contributing aspect to the low penetration of low-cost, high performance solutions enabled by cloud computing is the slow uptake of cloud technology in Canada as a whole. In a white paper published by IT World Canada, the perspective of Canadian CIOs on cloud computing was described as follows: "Their posture towards the cloud, in other words, could not be more Canadian: optimistic but pragmatic, slow but deliberate, purposeful but not aggressive."

In addition to worries about security and reliability, several additional factors contribute to the slow uptake, including data and information security and the protection of personal privacy, loss of control, expected cost and effort to convert to cloud computing, lack of a clear return on investment, change to a different management and contracting paradigm, data and information sovereignty requirements, ramification from the Personal Information and Electronic Documents Acts (PIPEDA) and the US Patriot Act, lack of open cloud and cyber security standards, concerns with vendor lock-in, lack of suitable bandwidth, and the desire to try the technology first or see solid proof of cost savings from other with trusted vendors before deploying to the greater enterprise.

The measured rate of adoption places Canada 9th out of 24 countries considered part of the cloud global economy, up from 12th in 2012. Several efforts are pushing Canada toward the cloud. GC's Cloud First campaign is an effort to hasten the adoption of cloud computing in the GC. The Canadian Cloud Council was formed to help push the adoption and thought leadership of Canada in the global cloud economy. Large cloud service providers, such as Amazon, are moving to Canada as the country's appetite for cloud services increases. The ultimate measure of success is the establishment of cloud computing offerings within Canada and subsequent increase in adoption rates by Canadian businesses and governments.

With responsibility for processing and storing large amounts of sensitive data/information (e.g. classified, protected, private), the GC needs to minimize the risk of unauthorized disclosure of data. Adoption of cloud technology provides a wrinkle in the current approach to information security since portions of the information system are out of the direct control of the GC and the department charged with protecting sensitive GC information.

For more information, please read the GC ESA ConOps Annex B: Cloud Security document.

Cloud Security Initiative

https://www.gcpedia.gc.ca/wiki/Cloud_Security_Initiative

Learn more

• About us.
• Myths and Frequently Asked Questions.
• Read about cloud from news to the most influential blogs.
• GC Cloud Success Stories
• Find events in your area and training for your team.

ZZCIOBDP@tbs-sct.gc.ca Cloud and Computing Network of Expertise Cloud Technical Working Group Digital Workplace Network of Expertise Back to top