How the Maturity sub-phase works

Every service

• Security categorizationAssessmentKeep currentsource

  A rating of how much injury would result if the service's information leaked, if someone altered it, or if the service became unavailable.

  Reviewing the category of the business activities the service supports is the first authorization-maintenance activity, on the department's cycle.

• Threat and risk assessment (TRA)AssessmentKeep currentsource

  The exercise that lists what could go wrong, ranks each by how likely it is and how much damage it would do, and states the risk left over after safeguards.

  Re-assessed as the threat picture moves, at a frequency set in the departmental security plan.

• Security assessment and authorization, ending in the Authority to Operate (SA&A, ATO)AuthorizationKeep currentsource

  The formal permission for the service to run.

  Authorization is maintained throughout the operational life: control performance reviewed, threat environment re-assessed.

• Business impact analysis (BIA)AssessmentKeep current

  The exercise that works out who is harmed if the service stops, how quickly that harm becomes serious, and what the service depends on.

  Refreshed on the department's own cycle. Public Safety Canada recommends a full refresh of the analysis and the plan in year one, with reviews in years two and three.

• Accessibility conformance and the accessibility statementStanding dutyKeep currentsource

  Conformance of the service itself to the Canadian accessibility standard for information and communication technology, plus a published statement that names what does not conform, what the alternatives are, and when the gaps close.

  Statement refreshed every 12 months and retained electronically for four years.

• GC Service InventoryRegisterKeep currentsource

  The government-wide register of what services exist, who they serve, how digital they are, and how much volume they handle.

  Updated annually, with every data element reviewed, typically collected over the summer for the previous fiscal year.

• Application Portfolio Management (APM)RegisterKeep current

  The register of the applications behind the services, rated for business value, technical condition, support cost and criticality, and sorted into tolerate, innovate, mitigate or eliminate.

  Updated through the year. Where owners are not engaged, the data goes incomplete and support costs go untracked.

• Records retention and disposition authorityRegisterKeep currentsource

  The written consent from Library and Archives Canada without which no government record may be destroyed, plus the department's own schedule saying how long each kind of record is kept.

  Disposition happens regularly through the life of the service, not only at the end.

• Information technology continuity managementPlanKeep currentsource

  The service team's own recovery arrangements: how this system gets back up, in what order its parts are restored, and proof from testing that the restore actually works.

  Re-tested on the department's cycle. An untested backup has not been shown to work.

• Cyber security event response and reportingPlanKeep currentsource

  The duty to have a way of spotting, containing and reporting a cyber incident before one happens, and to report it up the government-wide chain when it does.

  Response arrangements are exercised and kept current with the service.

• Service in both official languagesStanding dutyKeep current

  The duty to offer and deliver the service in English and French, equally and at the same time.

  Carried through the department's annual official languages review, and again on funding renewal.

• Application hosting decision, and the public cloud defaultReviewKeep currentsource

  The decision about where the service runs, made against a government-wide preference order rather than a local preference.

  Revisited as the technology ages, and again where custom support has to be extended to keep something supported.

• Access to information readiness, and the duty to documentStanding dutyKeep current

  Everything the service records is subject to an access request, and decisions of business value have to be documented in the first place.

  Summaries of completed requests are published monthly by the department.

• Open data and open informationFilingKeep current

  The expectation that data and information of business value are released openly by default, in reusable formats, unless something specific stops it.

  Releases and the institution's information description are kept current.

Only if it applies

• Business continuity plan (BCP)PlanKeep current

  The written arrangements for keeping a critical service delivering at a minimum acceptable level during a disruption, and recovering it afterwards.

  Tested. There is no mandated interval in the directive, which requires only regular testing in accordance with departmental practices; large departments are measured on a two-year testing window. The testing obligation lands on service owners in practice.

  Applies when: Only if the business impact analysis marks the service critical, meaning disruption would cause a high or very high degree of injury. One department reads that as needing to recover to minimum service levels within 72 hours.

• Privacy checklist and privacy impact assessment (PIA)AssessmentKeep currentsource

  A structured look at what personal information the service collects, why it is allowed to, where it flows, how long it is kept, and what happens to people if it goes wrong.

  Updated as the service changes, rather than left to go stale.

  Applies when: Triggers are broad. A new or substantially modified program that creates, collects, uses, discloses, retains or disposes of personal information brings it into scope. So does using it for an administrative purpose, contracting the program out or transferring it, bringing in a third party, changing the technology that processes it, or automating a decision. No dollar or user-count threshold.

• Algorithmic impact assessment (AIA)AssessmentKeep currentsource

  A questionnaire the department fills in about itself, scoring how much an automated decision could affect people's rights, health, economic interests or the ongoing sustainability of an ecosystem.

  Updated on a scheduled basis.

  Applies when: Only if the service makes or supports an automated decision about a person: scoring, ranking, recommending, or auto-approving. A later efficiency feature can trigger it without anyone noticing.

• Accessibility conformance report (ACR)AssessmentKeep currentsource

  A supplier's written statement of how far their product meets the accessibility standard, clause by clause, with the gaps named.

  Updated after significant software updates, and at minimum annually, with changes marked.

  Applies when: Only when buying. An in-house build has no supplier and no report; the equivalent duty is the department's own conformance assessment against the standard.

• Benefits realization plan and project close-out reportSubmissionKeep currentsource

  The written statement of what good this project is supposed to do, and the later report confirming what was actually delivered and whether the promised benefits arrived.

  Whether the promised benefits actually arrived is tracked after the project is over.

  Applies when: Universal for anything that counts as a project under the projects and programmes directive, with no dollar trigger. Baseline reporting to the Office of the Comptroller General starts at $25 million.

• Official languages in what you buyStanding dutyKeep current

  The obligation to write official languages requirements into the contract, so a supplier is contractually bound to deliver both languages rather than being asked for French later as a change request.

  Renewals and amendments carry the clauses forward.

  Applies when: Whenever a supplier delivers, hosts or supports any part of a service that reaches the public, or produces content on the department's behalf. Guidance is set through a contracting policy notice.

• Security Requirements Check List (SRCL, form TBS/SCT 350-103)SubmissionKeep current

  A short form that states, for one specific contract, exactly what security the supplier and its people need: what level of information they will touch, what screening each role needs, and whether the company may hold government information at its own offices.

  Renewals, re-competitions and amendments carrying a security requirement each need one.

  Applies when: Only where the supplier or its people will access Protected or Classified information or assets, enter restricted sites, or connect electronically to departmental systems, which includes any access to personal information the department holds. Where there are no security requirements, no check list is produced and the department certifies that instead.

• Supplier organization and personnel security screeningAuthorizationKeep current

  The clearances a company and its individual staff must hold before touching sensitive government work.

  Clearances expire and are renewed. Work cannot continue on lapsed screening.

  Applies when: Every procurement whose Security Requirements Check List identifies a security requirement, and the same applies to subcontractors at every tier. Organization screening covers Protected A, B and C; a facility clearance is for Classified.

• Cloud security profile, guardrails, and the cloud authorizationAuthorizationKeep current

  The extra security work a cloud-hosted service carries: a ready-made control profile to build against, a set of guardrails to be in place within the first days of a new cloud environment, and a security assessment that has to account for what the cloud provider does versus what the department does.

  Configuration drifts. The guardrails and the assessment are re-checked.

  Applies when: Only for cloud-hosted services. The Protected B control profile is the usual starting point. The Cyber Centre separately assesses cloud service providers, so a department inherits that assessment rather than repeating it, and assesses only its own configuration and use.

• Government of Canada credential and sign-in servicesStanding dutyKeep current

  The shared sign-in services a department uses instead of building its own: the government-branded credential service, the commercial bank-based option, and the newer federated sign-in platform.

  Platform changes and credential migrations land on the service.

  Applies when: Any external-facing service where clients sign in. Onboarding to the federated platform involves a compliance attestation and testing in a client acceptance environment.

• Publishing under the canada.ca brandStanding dutyKeep current

  The rules for anything the public sees: the domain, the global header and footer, the Government of Canada signature and wordmark, the mandatory page templates, the information architecture, and the content style guide.

  Analytics-based optimization is a continuing duty, not a launch task.

  Applies when: Every external-facing website and web application. Two sign-offs: inside the department the head of communications is accountable for external-facing sites, and outside it the Principal Publisher, which is Employment and Social Development Canada through Service Canada, controls the canada.ca domain and must approve every domain and sub-domain.

• Mobile: responsive by default, native app by justificationStanding dutyKeep current

  The rule that a public-facing service works properly on a phone, and that building a downloadable app instead of a responsive web page has to be justified.

  Re-tested as devices, browsers and operating systems change.

  Applies when: Every public-facing website and web application.

• Proactive publicationFilingKeep current

  Publication that happens without anyone asking.

  Amendments and renewals are published on the same cycle.

  Applies when: Triggered by what the service does rather than by its size. Any contract over $10,000 triggers contract publication; a grants or contributions program triggers the other.