How should I ensure my project meets GC EARB requirements? (draft)
The Government of Canada Architectural Standards shall be applied to digital projects and initiatives in order to successfully align with the Government of Canada digital direction. The Government of Canada Enterprise Architecture Review Board (GC EARB) will use these standards to evaluate digital investments and solutions to ensure the GC acts as a single enterprise by validating, recommending and approving technology solutions and to ensure departmental alignment with enterprise-wide IT standards, security, and strategic direction. The Architectural Standards build upon the Government of Canada Digital Standards, focusing on best practices for architectural and design planning.
This page provides personalized guidance for how projects can meet the Government of Canada Digital Architectural Standards required by the Government of Canada Enterprise Architecture Review Board (GC EARB).
- 1. Business Architecture
- 2. Information Architecture
- 3. Application Architecture
- 4. Technology Architecture
- 5. Security Architecture and Privacy
1. Business Architecture
Align to the GC Business Capability model
Checklist
- Define program services as business capabilities to establish a common vocabulary between business, development, and operation
- Identify capabilities that are common to the GC enterprise and can be shared and reused
- Model business processes using Unified Modelling language to identify common enterprise processes
Design for Users First and Deliver with Multidisciplinary Teams
Checklist
- Focus on the needs of users, using agile, iterative, and user-centred methods
- Conform to both accessibility and official languages requirements
- Include all skillsets required for delivery, including for requirements, design, development, and operations
- Work across the entire application lifecycle, from development and testing to deployment and operations
- Ensure quality is considered throughout the Software Development Lifecycle
- Encourage and adopt Test Driven Development (TDD) to improve the trust between Business and IT
Implementation guides
- User research (Service Manual (UK))
- How user research improves service design (Service Manual (UK))
- Start by learning user needs (Service Manual (UK))
- Introduction to User-centred Design (usabilityfirst.com)
- Web Content Accessibility Guidelines (WCAG) 2.1 (W3C)
- Setting up the right team (Digital Service Standard (UK))
- Starting a team (Digital Service Standard (AU))
- The teams, they are a changin’ (18F (US))
Reusable solutions
2. Information Architecture
Keep Data Organized
Checklist
- Decouple Master Data from applications and host within the appropriate system of record
- Make systems of record authoritative central sources
- Assign data custodians to ensuring data is correct, consistent, and complete
- Design data resiliency in accordance with GC policies and standards
- Use Master Data Management to provide a single point of reference for appropriate stakeholders
Implementation guides
Enable Interoperability
Checklist
- Expose all functionality as services
- Use microservices built around business capabilities. Scope each service to a single purpose
- Run each service in its own process and have it communicate with other services through a well-defined interface, such as an HTTPS-based application programming interface (API)
- Run applications in containers
- Leverage enterprise digital exchange components such as the GC Service Bus, Digital Exchange Platform, and the API Store based on fit-for-use
Implementation guides
3. Application Architecture
Use Open Standards and Open Source Software
Checklist
- Avoid lock-in and seek independence and substitutability where open source software or open standards are available
- Enforce this order of preference: open source first, then platform-agnostic COTS, then proprietary COTS, and lastly custom-built
- Make source code open and reusable under an appropriate open source software license
- Expose public data to implement Open Data and Open Information initiatives
Implementation guides
Maximize Reuse
Checklist
- Leverage and reuse existing solutions, components, and processes
- Select enterprise and cluster solutions over department-specific solutions
- Achieve simplification by minimizing duplication of components and adhering to relevant standards
- Inform the GC EARB about departmental investments and innovations
- Share code publicly when appropriate, and when not, share within the Government of Canada
Reusable solutions
4. Technology Architecture
Use Cloud first
Checklist
- Enforce this order of preference: Software as a Service (SaaS) first, then Platform as a Service (PaaS), and lastly Infrastructure as a Service (IaaS)
- Enforce this order of preference: Public cloud first, then Hybrid cloud, then Private cloud, and lastly non-cloud (on-premises) solutions
- Design for cloud mobility and develop an exit strategy to avoid vendor lock-in
Implementation guides
- Government of Canada Right Cloud Selection Guidance
- Government of Canada Security Control Profile for Cloud-Based GC IT Services
- Government of Canada Cloud Adoption Strategy
- Government of Canada White Paper: Data Sovereignty and Public Cloud
- Government of Canada Cloud Security Risk Management Approach and Procedures
- Direction on the Secure Use of Commercial Cloud Services: Security Policy Implementation Notice (SPIN)
- Direction for Electronic Data Residency
Design for Performance, Availability, and Scalability
Checklist
- Design for resiliency
- Ensure response times meet user needs, and critical services are highly available
- Support zero-downtime deployments for planned and unplanned maintenance
- Use distributed architectures, assume failure will happen, handle errors gracefully, and monitor actively
Implementation guides
5. Security Architecture and Privacy
Design for Security and Privacy
Checklist
- Implement security across all architectural layers
- Categorize data properly to determine appropriate safeguards
- Perform a privacy impact assessment (PIA) when personal information is involved
- Balance user and business needs with proportionate security measures
Implementation guides
- Information Technology Policy Implementation Notices (ITPIN)
- GC Security Policy Implementation Notices (internal to Government of Canada)
- Security and Identity Management Policy Instruments
- Security Resource Centre
- Guidance Document: Taking Privacy into Account Before Making Contracting Decisions
- Direction for Electronic Data Residency
Reusable solutions
Design Systems to be Measurable and Accountable
Checklist
- Publish a Service Level Agreement for each service
- Make an audit trail available for all transactions to ensure accountability and non repudiation
- Establish business and IT metrics to enable business outcomes
- Apply oversight and lifecycle management to digital investments through governance