5. Address security and privacy risks

Checklist

• Document the approach to security and risk management including the types of information and optimum level of documentation, necessary to make timely and effective decisions.
• Ensure that you identify and categorize information based on the degree of injury that could be expected to result from a compromise of its confidentiality, integrity and availability. Determine the type of information collected, how it should be secured, how long it is kept, and how it may be used and shared.
• At the start of designing a new service or feature, the team lead should engage the appropriate privacy, information management, and legal officer(s) to ensure that solutions comply with all requirements for the collection, sharing and protection of personal information.
• Determine what you absolutely need to protect through risk assessment and threat modeling – can you clearly identify what components are essential to the success of your service? Not all assets need the same level of protection. #pragmaticsecurity
• Determine what you’re willing to pay for security – can you adequately protect your assets with the desired level of investment? Is the cost of protection in excess of the value of your assets? #pragmaticsecurity
• Complete a preliminary privacy impact assessment (PPIA) or privacy impact assessment (PIA) if personal information is involved in the service.
• Establish a cycle of re-evaluation to ensure what you’re protecting is actually what you need to protect and make improvements based on lessons learned.
• Develop your system with the 7 principles of Privacy by Design (Information and Privacy Commissioner of Ontario) in mind.
• Ensure your service complies with Canadian security and privacy legislation, government policy instruments, and departmental security policies at all stages.
• Identify and understand the jurisdictional requirements of where your digital service operates, and where your stakeholders are.
• Develop, update, and maintain written cybersecurity policies and procedures, including on governance by both service and organizational management.
• Develop, publish and maintain training and awareness material as required, to establish secure service-user behaviours
• Make sure the service limits access to physical and logical assets and associated facilities to authorized users, processes, or devices consistent with the risk of unauthorized access.
• Maintain logs of user access and system interactions to fully trace a user as they traverse each part of the system
• Implement layered defenses to reduce exposure to cyber threats with increased awareness and understanding to proactively manage such threats

Alpha Stage

• Plan recurring interactions with the business and information risk teams to ensure ongoing alignment.
• Integrate a security advisor into the delivery team to support IT security risk management throughout the full delivery of the service.
• Document the protective measures implemented to enable the secure processing and sharing of data and information across government
• Document how the service manages information and records (data) in order to protect their confidentiality and integrity, and ensure their availability.
• Ensure all APIs have appropriate authentication and that only authorized users/services are able to access the information; “open data” APIs are explicitly configured to allow access by all by default.

Beta Stage

{: .dpgn-standards-hide .dpgn-stage-beta} Note: Beta Stage includes all elements from the previous Alpha stage, plus the following:

• Where collecting personal information, inform users about privacy rights and protections, and about their right to access and correct their own personal information.
• Use appropriate de-identification strategies to minimize the risk of disclosing personal information.
• Establish a data access audit process to provide assurance to users that their data has not been accessed in an unauthorized manner.
• Incorporate privacy safeguards into partnership and data sharing agreements.
• Ensure that privacy breach protocol is implemented and understood. Federal institutions are required to notify the Office of the Privacy Commissioner of Canada (OPC) and the Treasury Board of Canada Secretariat (TBS) of all material privacy breaches and of the mitigation measures being implemented, if the breach involves sensitive personal information and could reasonably be expected to cause serious injury to the individual.
• Establish terms of services to ensure users understand how their data will be used and how it will be accessed
• Ensure your service has properly documented event management processes, in the event of a data breach or compromise of the integrity of your systems.
• Provide users adequate information (Terms and Conditions / Privacy Agreement) to ensure they fully understand the authority they are providing to 3rd party services.
• Ensure all APIs are developed in alignment with secure connection guidance; APIs should be accessed over HTTPS.

Live Stage

{: .dpgn-standards-hide .dpgn-stage-beta} Note: Live Stage includes all elements from the previous Alpha and Beta stages, plus the following:

• Establish agreements with 3rd parties who may benefit from receiving data from your service in accordance with guidance such as the TBS Guidance on Preparing Information Sharing Agreements Involving Personal Information, to ensure they will treat your data with appropriate care.

Checklist

• Implement an Identity and Access Management (IAM) solution that aligns with trusted digital identity frameworks, such as the Pan-Canadian Trust Framework, for security commensurate to service sensitivity, ID portability across platforms, and authentication and authorization agility.
• Where possible, provide users easily-accessible means of authentication (e.g.: biometrics) to your service - take advantage of improvements in consumer technologies.
• Use deployment scripts to ensure configuration of production environment remains consistent and controllable.
• Test and certify components in each layer of the technology stack for security vulnerabilities, and then to re-use these same pre-certified components for multiple services.
• Ensure all APIs are developed in alignment with secure connections requirements from TBS and CSE; all APIs should be accessed over HTTPS only.
• Ensure all APIs have appropriate authentication and that only authorized users/services are able to access the information; “open data” APIs are explicitly configured to allow access by all by default
• Ensure your digital service offers a quick and easy reporting mechanism, that enables the process of security vulnerability disclosures; alerts should be treated with care and consideration equal to internal evaluations.
• Develop robust IT Continuity plans, including infrastructure and data backups, to ensure that your digital service is able to return to operational status with minimal disruption.
• Document the plan and process for technical updates and support for services/system software
• Leverage existing services and frameworks such as the Pan-Canadian Trust Framework to foster multi-jurisdictional service delivery.