Government of Canada Cyber Security Event Management Plan (GC CSEMP)

• Treasury Board policy requirements under the PGS^{Reference R10} and PSD^{Reference R11}, and guidance such as GC Patch Management Guidance^{Reference R12}, GC Event Logging Guidance^{Reference R13} and the GC Guideline on Vulnerability Management^{Reference R24}.
• Lessons learned from previous events, mitigation strategies, exercises and test scenarios
• Ongoing recommendations from lead security agencies (LSAs)
• Industry best practices
• Up-to-date contact information and assignment of generic mailboxes that are regularly monitored
• Up-to-date departmental inventories of critical services and their supporting applications, information and systems/technologies

• Application of protective and preventive measures to ensure the security of systems
• Implemented lessons learned
• Updated GC -wide cyber security event management plans, processes, guidelines and tools
• Exercises, scenarios and tests to regularly validate the effectiveness of the GC CSEMP and departmental CSEMPs
• Employee security awareness training
• Updated departmental plans (including departmental CSEMPs), processes and procedures that align with the GC CSEMP
• Understanding of critical systems across the GC
• Clear, documented roles and responsibilities, including for cyber event management and the implementation of security safeguards, documented in third-party contracts, internal enterprise agreements (as applicable), and GC interconnection agreements

• Threat and intelligence reports from GC event management stakeholders or external sources (for example, vendors, open source)
• Incident reports from GC event management stakeholders, departmental incident reports or external sources

• Departmental and government-wide impact assessment reports, and possible public communications
• Establishment of a GC response level
• Identification of events that require a coordinated GC-wide response
• Invocation of GC CSEMP, and possibly FERP governance, if required

• Incident reports
• Intelligence
• Forensic findings
• Other considerations (political, legal)
• Impact assessment reports
• Business continuity plans
• Disaster recovery plans

• Situation reports (SITREPs)
• Change log
• Response plan
• Mitigation of threat or vulnerability (when applicable)
• Containment and eradication of incident (when applicable)
• Ongoing restoration to normal operations

• Review of event timeline
• Change log
• Review of reporting and communication procedures and timeliness of products
• Root-cause analysis
• Other relevant input from implicated CSEMP stakeholders

• Departmental lessons-learned report and action plan (if applicable)
• GC level post-event reports
• GC-wide lessons-learned and action plan (if applicable)
• Recommendations to improve policy instruments, cyber security event management process, training, or enterprise security architecture

Stakeholders that lead the coordination of all events that meet the criteria for a GC CSEMP Level 2 response and above. This includes potential threats, vulnerabilities and confirmed incidents.

• Treasury Board of Canada Secretariat (TBS)
  • Office of the Chief Information Officer (OCIO)
  • Strategic Communications and Ministerial Affairs (SCMA)
• Canadian Centre for Cyber Security (Cyber Centre), part of Communications Security Establishment Canada (CSEC)

Stakeholders that will be involved in the GC CSEMP process for confirmed cyber security incidents or threat events that are relevant to their specific mandate.^{Footnote 4}

• Privy Council Office (PCO)
  • Security and Intelligence (S&I)
• RCMP
  • National Cybercrime Coordination Centre (NC3)
  • Federal Policing Cybercrime (FPCC)
• Canadian Security Intelligence Service (CSIS) – Cyber
• National Defence / Canadian Armed Forces (DND-CAF) – Information Management Operations
• Public Safety Canada – National Cyber Security Directorate (NCSD)
• Global Affairs Canada (GAC)

Stakeholders who are involved in the GC cyber security event management process and may be engaged for confirmed cyber security incidents or threat events.

• Shared Services Canada (SSC)
• Public Safety Canada – Government Operations Centre (GOC)
• Privy Council Office (PCO)
  • Strategic Communications (SC)
• Director General Emergency Management Committee (DG EMC)
• Departments
  • Legal Services
  • Incident Management Team
  • Access to Information and Privacy Team (privacy breach management)
  • Communications (Comms) Team
• IESOs (such as Shared Services Canada)
• External partners
• Third-party suppliers

Director level (or above) participants from the following departments:

Activated by GC CSEMP Level 2 or higher

• Support central coordination for all threat and vulnerability management and response
• Establish and participate in cyber war rooms to identify, assess and mitigate the threat or vulnerability (ECT co-chairs will designate which stakeholder will establish the cyber war room)
• Collaborate with key stakeholders to jointly propose recommended mitigation plans
• Engage third-party suppliers as appropriate
• At Level 3 or higher, ensure that situational awareness is maintained at the DG level by actively updating EMT members of ongoing CSEMP progress

Activated by GC CSEMP Level 2 or higher

• Support central coordination and information sharing for all event management and response
• Establish and participate in cyber war rooms to identify, assess and mitigate the incident (ECT co-chairs will designate which stakeholder will establish the cyber war room)
• Collaborate with key stakeholders to jointly propose recommended mitigation plans
• Engage third-party suppliers as appropriate
• At Level 3 or higher, ensure that situational awareness is maintained at the DG level by actively updating EMT members of ongoing CSEMP progress

DG level (or above) stakeholders from the following departments:

Activated by GC CSEMP Level 3 events or higher

• Brief senior GC officials (decision briefs, SITREPs and mitigation plans that require ADM approval), on an ongoing basis, as required
• Provide situational awareness, executive direction and guidance to the ECT
• Engage third-party suppliers as appropriate

Activated by GC CSEMP Level 3 events or higher

• Brief senior GC officials (decision briefs, SITREPs and mitigation plans that require ADM approval), on an ongoing basis, as required
• Provide situational awareness, executive direction and guidance to the ECT
• Engage third-party suppliers as appropriate.
• As a subcommittee to the EMT, stand up a DG-level incident command centre with primary stakeholders (including affected department(s)), to enable rapid incident-related decisions and ensure a coordinated approach for compromise recovery and remediation efforts, in support of business resumption

TBS provides strategic oversight and direction in the GC cyber security event management process.^{Footnote 6} TBS ensures that events are effectively coordinated to support decision making and minimize potential impacts and losses to the GC.

In the context of this plan, the Chief Information Officer of Canada (GC CIO) represents whole-of-government interests during cyber security events that affect or may affect the delivery of programs and services. The GC CIO addresses topics that include overall GC response to cyber security events and enterprise-level actions taken to protect GC information systems. This includes responsibilities for:

• executing cyber security risk management decisions by issuing mandatory direction to departments in response to cyber security events^{Footnote 7} (for example, implementing security controls and disconnecting systems that put the GC at risk, when warranted)
• briefing the associate DM’s office and higher, as required, and advising assistant deputy minister committees on event-related issues, such as security and operations of GC IT systems and networks, service delivery and confidence in government
• chairing a committee of departmental CIOs through the CIO Council; through this council, the GC CIO may issue directions to departmental CIOs regarding cyber security event management activities, specifically activities related to mitigation and recovery

TBS-Office of the Chief Information Officer (OCIO) supports the GC CIO and has strategic oversight responsibilities, including:

• establishing, maintaining, and testing the GC CSEMP and related procedures, in accordance with the PGS^{Reference R10} and the PSD^{Reference R11}
• ensuring strategic coordination of GC response to priority cyber security events (typically Level 3 events or, when warranted, by Level 2 events), which includes:
  • the role of co-chair and secretariat for all GC CSEMP governance teams, alongside the Cyber Centre (including escalation and deescalation decisions in coordination with the Cyber Centre)
  • assessment of government-wide program and service impact of cyber threats, vulnerabilities and security incidents to support government wide reporting and prioritization (assessed in collaboration with the Cyber Centre and other applicable partners)
  • issuance of direction (through the GC CIO) to departments and agencies on measures to minimize the GC-wide impact of significant cyber security events
  • standing up a DG-level incident command centre and sub-committee to the EMT, to enable rapid incident-related decisions and ensure a coordinated approach for compromise-recovery and compromise-remediation efforts, in support of business resumption
• providing advice to the DG EMC during Level 4 cyber security events
• ensuring that TBS’s SCMA team has timely information to develop communications products and ensure that a coordinated and aligned approach is in place for public communications among stakeholders, according to the TBS-SCMA Cyber Security Communications Framework^{Reference R19}
• analyzing post-event reports and conducting GC-wide lessons-learned exercises (when warranted) to drive security policy, privacy policy or enterprise security architecture–related improvements
• receiving material privacy breach reports from institutions
• providing government-wide advice on privacy breach management

In addition, TBS’s strategic communications responsibilities, through its SCMA division, include:

• acting as designated spokesperson on behalf of the GC for any cyber security event affecting government program and service delivery, typically for Level 3 events (or when warranted by events at other levels)
• for Level 4 events, supporting Public Safety Communications (PS-Comms), which leads strategic communication responsibilities for events that fall under their purview (Level 4 events), according to the FERP
• supporting affected organizations by developing and or sharing internal (GC-wide) and external communication material related to all phases of cyber security event management, in collaboration with the Cyber Centre and the PCO’s Strategic Communications, and in consultation with communications teams from implicated CSEMP stakeholders
• determining the necessity and timing of public statements (proactive and reactive)
• approving all communications plans (internal, stakeholder, client and public), in collaboration with affected organizations and PCO’s Strategic Communications

The Cyber Centre is housed in the CSE. Under the GC CSEMP, the Cyber Centre is Canada’s national coordination centre for preventing, mitigating, preparing for, responding to and recovering from cyber security events^{Footnote 8} impacting the GC.

In the context of this plan, the Cyber Centre is responsible for:

• collaborating with TBS-OCIO as one of the primary LSA stakeholders
• performing operational coordination, which includes issuing technical direction and advice to departments and agencies on measures to mitigate or contain impact to departments, and tracking and reporting these measures (all events)
• engaging with international counterpart organizations, such as international computer security incident response teams (CSIRTs) and national cyber centres as part of the coordination activities as appropriate

RCMP is the lead security agency responsible for fulfilling government-wide functions related to criminal investigations.^{Footnote 9}

The NC3 and Federal Policing Cybercrime (FPCC) are the primary stakeholders within the RCMP responsible for law enforcement functions under this plan, including:

• leading the criminal investigation of cyber security incidents linked to criminal activity (including criminal investigations involving terrorist activity) (FPCC)
• participating on GC CSEMP governance teams in an advice and guidance capacity, when warranted by a particular cyber security incident or threat event (FPCC and NC3)
• coordinating and assisting multi-jurisdictional cybercrime investigations in collaboration with law enforcement, federal government and other partners (FPCC and NC3)

CSIS is mandated to investigate threats to national security^{Footnote 10} including cyber-espionage, cyber-sabotage, cyber-terrorism, and cyber-based foreign-influenced activities and advise the GC accordingly.

In the context of this plan, CSIS is responsible for:

• leading the investigation of cyber security threats to Canada’s national security, defined by the Canadian Security Intelligence Service Act
  • to enable these investigative actions, CSIS requires the provision of all information related to cyber security events impacting GC systems when it is assessed that there to be a link to national security threat activities
• when applicable, if there are reasonable grounds to believe that a particular cyber activity constitutes a threat to the security of Canada or Canadians, CSIS is authorized to take measures to reduce the threat
• participating on CSEMP governance teams in an advice and guidance capacity, when warranted by a particular cyber security incident or threat event

DND/CAF is responsible for addressing cyber threats, vulnerabilities- or security incidents against or on military systems.^{Footnote 11}

In the context of this plan, DND/CAF is responsible for:

• leading the investigation of any cyber incidents linked to activities directed against military systems (systems directly supporting military operational theatres and weapon systems)
• providing additional support and assistance to other government departments, if tasked
• participating on CSEMP governance teams in an advice and guidance capacity, when warranted by a particular cyber security incident or threat event

Through its National Cyber Security Directorate (NCSD), located in the National and Cyber Security Branch, PS leads and coordinates Canada’s national cyber security policy and strategy, and provides advice to the Minister on cyber security incidents and events affecting GC and non-GC systems.

PS coordinates the overall response to significant events that could affect the safety and security of Canadians. The Government Operations Centre (GOC), described in Table C-1.3, resides within PS’s Emergency Management Branch.

In the context of this plan, PS-NCSD is responsible for participating on CSEMP governance teams in an advice and guidance capacity.

GAC is responsible for conducting Canada’s international relations, including working with partners and allies to address international cyber threats.

In the context of this plan, GAC is responsible for:

• developing international messaging related to cyber security event management, in collaboration with TBS-SCMA, Cyber Centre, and the PCO’s Strategic Communications, and in consultation with communications teams from implicated CSEMP stakeholders
• coordinating with and messaging international partners (at a state-to-state level), allies and other Ministry of Foreign Affairs counterparts in the context of a cyber event taking place in Canada, even if there is no cross-jurisdiction coordination involved
• providing foreign policy advice and international coordination in the context of a cyber event that has international ramifications
• leading GC coordination efforts in developing public attribution statements of malicious cyber activity to a foreign state actor or their proxies

SSC is responsible for planning, designing, building, operating, supporting and maintaining effective, efficient and responsive enterprise IT security infrastructure services to secure GC data and systems under its responsibility.^{Footnote 12} This includes managing tools to support the monitoring of departmental electronic networks and devices.^{Footnote 13}

In the context of this plan, SSC is responsible for:

• monitoring the security infrastructure health and unusual activity on the SSC managed networks
• blocking and mitigating cyber threat activity targeting SSC-managed networks or information
• reporting security events of interest to the Cyber Centre and client departments through the Cyber Centre, as required
• responding to the Cyber Centre and TBS recommendations, and ensuring that updates and mitigating measures are applied in a timely manner
• supporting the identification, risk assessment, mitigation, recovery and post-analysis of cyber security events within the GC
• assessing government-wide program and service impacts of cyber threats, vulnerabilities and security incidents to support government-wide reporting, to be submitted to the Cyber Centre and TBS
• implementing prevention, mitigation and recovery efforts, including timely situational awareness updates to key GC CSEMP stakeholders
• when a cyber security event occurs, coordinating with partners to determine whether any infrastructure it manages has to be shut down or be isolated from the network establishing and implementing a patch management plan, including an emergency patching process, for the scope of the services and systems under its responsibility
• providing reporting and other information products to key CSEMP stakeholders including:
  • status of vulnerability and mitigation to affected organizations
  • infrastructure security logs to the Cyber Centre
  • producing post-event reports, including timeline of events and root-cause analysis, and submitting them to the Cyber Centre, TBS and other relevant organizations, as required (for example, PCO)

The GOC leads and supports response coordination of any type of event affecting the national interest. It provides 24/7 monitoring and reporting, national-level situational awareness, warning products and integrated risk assessments, as well as national-level planning and whole-of-government response management. During periods of heightened response, the GOC is augmented by staff from other organizations.

In the context of this plan, the GOC is responsible for:

• monitoring Level 3 and higher cyber security events for potential escalation, such as:
  • providing warning and awareness products to operations centres across government
  • conducting risk assessments and planning
  • briefing the FERP governance
• ensuring that a link is maintained between the CSEMP and the SEISP^{Reference R3} (Accessible on the GC network only)
• recommending activation of the CSEMP, should the GOC become aware of a significant event with a cyber nexus
• recommending escalation of the SEISP should a cyber incident pose concerns within the scope of the SEISP
• coordinating the overall GC response to events that fall under the FERP (Level 4) and ensuring coordination between cyber and non-cyber aspects
• ensuring that PS-Comms has timely information to develop communications products and ensure that a coordinated and aligned approach is in place for public communications among stakeholders during a Level 4 incident

PCO helps to articulate and implement the GC’s policy agenda and to coordinate timely responses to issues facing the GC that are of national, inter-governmental and international importance. In that respect, PCO’s Security and Intelligence (S&I) team has a leading role in the coordination of government-wide response to national security emergencies.

In the context of this plan, PCO Security and Intelligence (S&I) is responsible for:

• supporting the GC decision-making process by ensuring that senior officials are apprised in a timely manner of cyber security incidents that may be of national importance or may have national security implications
• participating on GC CSEMP governance teams in an advice and guidance capacity, when warranted by a particular national incident or threat event

In addition, PCO Strategic Communications (SC) team plays a role during significant cyber events including:

• providing communications advice to Cabinet and senior officials of the PCO
• coordinating government-wide communications (in collaboration with PS-Comms and CSE Comms (Cyber Centre)), including crisis management, during a cyber security event

The DG EMC comprises federal institutions with statutory mandates to advance a disaster-resilient Canada, as well as a broad range of federal institutions with potentially relevant mandates to emergency management. The DG EMC is responsible for advancing a whole-of-society perspective on horizontal emergency management issues.

In the context of this plan, the DG EMC becomes the GC CSEMP interface into the FERP governance structure during Level 4 events, liaising with ADM, DM and Cabinet Committees, as required.

Departments and agencies play a key role in GC-wide cyber security event management, whether they are directly affected by an event or not. Departmental governance, plans and procedures are to be developed to support departmental roles and responsibilities related to security event management and business continuity plans in place, in accordance with the Policy on Government Security^{Reference R10} and related directives and standards.

In the context of this plan, departments and agencies, under the leadership of the departmental DOCS, in collaboration with the departmental CIO and CSO as appropriate, are responsible for:

• ensuring that cyber security requirements and appropriate risk-based measures are applied continuously in an identify, protect, detect, respond and recover approach, in accordance with the Directive on Security Management, Appendix B: Mandatory Procedures for Information Technology Security Control^{Footnote 14}
• establishing a departmental cyber event management plan, including clear roles and responsibilities where there may be various stakeholders involved in responding to GC CSEMP activities^{Footnote 15} (for example, incident management team, Access to Information and Privacy team (for privacy breach management), departmental communications representatives, and IESOs (such as SSC))
• ensuring that management and reporting requirements related to cyber security events are clearly stipulated in contracts, memoranda of understanding or other formal arrangements with external partners (for example, private sector suppliers and other levels of government) and address the requirements established in applicable GC and departmental policy instruments including, but not limited to, this plan
• ensuring that an up-to-date inventory of critical services and understanding of information holdings is maintained to facilitate event response and prioritization
• ensuring that a departmental patch management plan that includes clear roles and responsibilities and emergency patch management procedures is established and maintained
• ensuring that event logging is configured on department-managed IT services, and logs are forwarded to centralized security event and information log system
• performing information security continuous monitoring for services and systems within scope of the department’s span of responsibility (including applications and department managed IT services such as desktop endpoints, cloud-based environments.)
• ensuring alignment of roles, responsibilities and processes between the departmental business continuity plan(s) and the departmental cyber security event management plan
• monitoring the Cyber Centre technical information products and assessing their applicability to department owned and managed information systems
• maintaining generic departmental CIO, DOCS and IT Security teams mailboxes that are PKI-enabled to support secure communications
• assessing departmental program and service impacts of cyber threats, vulnerabilities and security incidents
• reporting cyber security events and incidents, in accordance with sections 2.3.1.2–2.3.1.4 of this plan, including:
  • following appropriate protocols upon occurrence of a privacy breach, including reporting material privacy breaches to the Office of the Privacy Commissioner of Canada and TBS (the Directive on Privacy Practices^{Reference R16})
  • notifying the Cyber Centre if additional assistance is required to perform event response–related activities
  • notifying appropriate law enforcement or national security authorities when an event falls under these domains
  • taking immediate action within the department to assess impacts, including whether there has been a privacy breach, and implementing mitigation measures in response to cyber security events^{Footnote 16}
• responding to requests for action (RFAs) in accordance with specified timelines
• implementing mitigations and supporting recovery activities based on direction and guidance issued by LSAs or central agencies
• participating on GC CSEMP governance teams when requested (typically when affected by a cyber security event)
• developing and disseminating applicable stakeholder and client management communications products (in consultation with or under the direction of TBS-SCMA and PCO-SC, as required)
• conducting post-event analysis and preparing departmental lessons-learned reports (for applicable events) and submitting them to the Cyber Centre
• continually maintaining and improving their departmental event response capability, including, but not limited to implementing lessons learned (GC-wide and departmental), regularly exercising departmental plans and procedures, maintaining departmental contact lists, and training appropriate cyber security response personnel

IESO as defined under the PGS^{Reference R10} is a department or organization that provides internal enterprise services to other GC departments. IESOs are responsible for establishing mechanisms to inform service recipients of cyber security events that impact their systems or information. This includes providing service recipients with the information necessary for the completion of incident reports and responses to RFAs in a timely fashion, as well as any other digital evidence required to support departmental mitigation, recovery and post event- activities.

Departments and agencies often rely on various partners external to the GC to support program and service delivery, including other orders of government and academic or scientific partners. External partners are required to manage and report on cyber events in accordance with the stipulations outlined in their respective agreements with departmental service owners.

Third-party suppliers include private sector organizations such as cloud service providers (CSP) and managed service providers (MSP). While an MSP is a company that remotely manages IT infrastructure and user end systems on behalf of a client, a CSP dictates both the technology and the operational procedures available to the consumer (departments and agencies). Third-party suppliers are required to manage and report on cyber events in accordance with the stipulations outlined in their respective contractual agreements provisioned by departmental service owners as part of the departmental supply chain risk management approach.

In the context of this plan, third party suppliers are expected to:

• respond quickly to an incident that has an impact on GC information and assets to minimize the resulting damage. Cyber events can be identified by the GC (for example, usability issues with a service) or by the third-party supplier
• manage and report on cyber events in accordance with the stipulations outlined in the respective contractual agreements provisioned by departmental service owners
• work collaboratively with the Cyber Centre and affected departments to obtain the necessary information, including event logs, to conduct investigations and to support containment, eradication and recovery activities

Contact details

Name, phone number, email, organization or department, and role

Type of request

Request for Assistance (urgent or not urgent) or Information only

Incident description/summary

Describe the cyber incident by answering as many of the following questions as possible:

• When did the activity occur?
• When was the activity discovered?
• Is the malicious activity still ongoing?
• What type of asset(s) are affected (phone, website, computer, account, services, other?)
• What is the impact of the incident on your organization or services (scope and severity)?
• Is the situation under control?
• Have any artifacts been preserved (email addresses, IP addresses, suspicious files, ransom note, log files, other)?

Additional information

Any further information including references, device details, indicators such as URLs, IP addresses, any mitigation actions taken, and so on.

• Declaration of a Level 2 GC CSEMP event is jointly determined by executives at the director-level from the Cyber Centre and TBS-OCIO
• An update is disseminated to operational stakeholders by the Cyber Centre
• Upon declaration, the Cyber Centre will establish an ECT as a central coordination body. The ECT will meet on an agreed upon frequency to facilitate information sharing and deconfliction, with ECT representatives providing their respective department’s operational updates
• Participating GC CSEMP stakeholder organizations are responsible for designating operation leads (primary and secondary) and SMEs that are to attend each meeting
• During these meetings, departments will provide in-depth updates to the Cyber Centre on all lines of incident response and coordination, for the purposes of the creation of a formal situation report (SITREP) report.
• Escalation may occur if increased mitigation efforts are required, a greater event impact is realized, or when the situation dictates a heightened GC response
• TBS-SCMA’s Cyber Security Communication Framework will also be invoked

• Declaration of a Level 3 GC CSEMP event is jointly determined by executives at the director general level from the Cyber Centre and TBS-OCIO (GC CISO)
• An update will be disseminated by the Cyber Centre to operational stakeholders.
• The Cyber Centre will stand up an EMT and may include impacted departments, depending on the size and scope of the compromise. In addition to the ECT, the EMT will meet on a regular basis
• As a subcommittee to the EMT, TBS-OCIO will stand up a DG-level incident command centre that comprises primary stakeholders (including affected department(s)), to enable rapid incident-related decisions and ensure a coordinated approach for compromise recovery and remediation efforts, in support of business resumption
• The ECT will continue meeting and coordinating ongoing activities on a regular basis. Central SITREP reporting will continue to be issued by the Cyber Centre. Representatives from impacted departments, SSC (where appropriate), TBS-OCIO, and other LSAs will attend and provide their department’s brief on important operational updates
• TBS-SCMA’s Cyber Security Communication Framework will also be invoked

• Where a FERP event is declared by Public Safety, executives at the director general level from the Cyber Centre, TBS-OCIO (GC CISO), and the GOC, in consultation with the EMT, will recommend to the GC CIO whether a GC CSEMP Level 4 event should be declared, in alignment with the FERP response coordination framework
• If a GC CSEMP Level 4 event escalation is approved by the GC CIO, the GOC will activate FERP
• GC CSEMP stakeholders will continue to fulfill their respective mandates within the GC and remain engaged in coordinating ongoing activities alongside FERP event teams
• The ECT and EMT will continue meeting and coordinating ongoing activities on a regular basis. Central SITREP reporting will continue to be issued by the Cyber Centre. Representatives from affected departments, SSC (where appropriate), TBS-OCIO and other LSAs will attend and provide their department’s brief on important operational updates
• TBS-SCMA’s Cyber Security Communication Framework will be invoked, in coordination with FERP

• Where Public Safety stands down a FERP event that triggered a Level 4 GC CSEMP event, GC CSEMP level automatically de-escalates to a Level 3
• An update will be disseminated to all operational stakeholders as appropriate
• EMT and ECT meetings will continue on a regular basis, along with ongoing central SITREP reporting from the Cyber Centre at Level 3 GC CSEMP event
• TBS-SCMA’s Cyber Security Communication Framework will be invoked

• De-escalation is jointly determined by executives at the director general level within the Cyber Centre and TBS-OCIO (GC CISO), who will hold a conference to determine the current severity of the cyber event
• An update is disseminated to all operational stakeholders as appropriate
• The Cyber Centre will stand down the EMT
• ECT meetings are to continue on a regular basis, along with ongoing central SITREP reporting from the Cyber Centre
• TBS-SCMA’s Cyber Security Communication Framework will remain invoked

• De-escalation is jointly determined by executives at the Director level within the Cyber Centre and TBS-OCIO, based on the current severity of the cyber event
• An update is disseminated to all operational stakeholders as appropriate
• The Cyber Centre will stand down the ECT
• Post-event activities will be conducted, in accordance with section 4.4
• TBS-SCMA will support organizations in the transition to communicating at a Level 1

• Establish clear, achievable event response objectives
• Ensure effective resource allocation and management
• Provide a unified source of truth in communicating critical information to relevant stakeholders

• Organize and direct appropriate stakeholders in response to the event unfolding.
• Lead engagements with external organizations (such as, third-party suppliers)
• Chair event coordination meetings
• Lead briefings to senior officials

• Escalate events in accordance with the appropriate framework or other supporting plans applicable to the non-cyber event at hand
• Work with appropriate stakeholders
• Make final decisions on courses of action, in collaboration with appropriate stakeholders and supporting functions

• Lead important briefings to senior leadership committees and/or members, depending on the nature of the event
• Provide situational reports to executive committees as required, including but not limited to:
  • initial incident reports
  • detailed incident reports
• Escalate decisions requiring senior official or ministerial approval