Disposition of Government of Canada Windows XP Devices

Subject: Disposition of Government of Canada Windows XP Devices

The purpose of this ITPIN is to reinforce direction to departments and agencies with regard to the disposition of devices running the Windows XP operating system software (herein referred to as XP devices) after end of support. Note that devices running Windows XP using Microsoft Enterprise Desktop Virtualization (MED-V) are also considered to be XP Devices.

This ITPIN is effective immediately and applies to all Government of Canada departments and agencies within the meaning of Schedules I, I.1 and II of the Financial Administration Act. Departments and agencies are expected to be in compliance with the requirements set forth by March 31, 2015.

Background

In January 2013, the Chief Information Officer of the Government of Canada directed all departments and agencies to upgrade Windows XP devices to Windows 7 by March 31, 2014. Microsoft discontinued support of Windows XP on April 8, 2014. To provide departments and agencies with additional transition time, the Government of Canada (GC) put in place a Custom Support Agreement (CSA) with Microsoft for extended Windows XP support. This CSA will expire on March 31, 2015 and will not be renewed for economic and security reasons. Departmental Chief Information Officers are reminded that operating unsupported software on GC networks exposes the GC to increased cyber security risks.

Direction

XP devices must not be connected to GC networks or the Internet after March 31, 2015. Exemptions to this directive will not be provided.

XP devices required to meet operational needs after March 31, 2015 are to be isolated and contained within a tightly controlled network environment with no access to GC networks or the Internet.

Operating XP devices in isolation zones is to be considered a temporary measure and the rationale and operating strategy is to be submitted to Treasury Board Secretariat's Chief Information Officer Branch (CIOB) each year as part of the departmental IT plan.

Departmental Chief Information Officers or equivalents are directed to put in place active measures to ensure compliance with this direction; e.g. identify and block the usage of XP devices on GC networks, establish procedures for managing XP Devices in isolation zones, etc.

GC departments and agencies are not to put in place Windows XP Custom Support Agreements with Microsoft.

References

Additional information may be found in the following resources:

• CSE ITSB-68, End of Support for Microsoft Windows XP SP3 and Microsoft Office 2003 - Guidance for the Government of Canada
• CSE ITSB-89 Version 3, Top 10 IT Security Actions to Protect Government of Canada Internet-Connected Networks and Information

Please address any inquiries you may have by email to the CIOB IT Division.

Marc Brouillard
Chief Technology Officer of the Government of Canada
Chief Information Officer Branch
Treasury Board of Canada Secretariat