Minister of Digital Government Appearance Before the House of Commons Standing Committee on Government Operations and Estimates (OGGO) - Main Estimates 2021–22 and Departmental Plans 2021–22 - May 26, 2021

Main Estimates 2020–21 and Departmental Plans 2021–22 (Digital Government Portfolio)

Check against delivery

Thank you, Mr. Chair.

It’s a pleasure to join you here today.

I’d like to acknowledge that I’m joining you from my home in Vancouver on the unceded territories of the Musqueam, Squamish and Tsleil-Waututh First Nations.

I would like to thank the Committee for inviting me here to discuss the 2021–22 Main Estimates and the 2021–22 Departmental Plan for the Digital Government portfolio.

I am pleased to be joined today by:

• Marc Brouillard, Acting Chief Information Officer of Canada
• Karen Cahill, Assistant Secretary and Chief Financial Officer
• Paul Glover, President of Shared Services Canada (SSC)
• Samantha Hazen, Assistant Deputy Minister and Chief Financial Officer at SSC

After my remarks, my officials and I would be happy to answer any questions members may have.

Anticipated business

• 2021–22 Supplementary Estimates (A)
• Strengthening the protection of the public interest within the Public Servants Disclosure Protection Act
• Government’s response to the COVID-19 pandemic
• Administration of the Canada Student Service Grant and WE Charity
• Shipbuilding procurement
• IT infrastructure improvements
• NucTech contracts

On March 10, 2021, the Committee adopted the following motion: That, in the context of its study of the Supplementary Estimates (C) 2020–21, the Committee send for, from TBS, all monthly COVID-19 expenditures reports and COVID-19 spending data as disclosed by the chief financial officers of all respective departments and that these documents be provided to the Committee no later than Wednesday, March 17, 2021, and then update this Committee on a monthly basis by the 15th of the month.

TBS has provided three of these reports to the Committee (March 17, April 15 and May 11, 2021), as well as the information submitted by organizations to TBS (April 23, 2021). The information is now also available publicly on InfoBase (as of May 12, 2021).

Main Estimates 2021–22 and Departmental Plans 2021–22

Procurement practices within SSC

Supplementary Estimates (C) 2020–21 and Departmental Results Reports 2020–21

Government response to COVID-19

Briefing on the Parliamentary Budget Officer’s reports

Supplementary Estimates (B) 2020–21

Meeting summaries

Mandate and actions to date

In this role, the Minister will lead the development and implementation of the Digital Strategy and programming at TBS and SSC, including efforts to identify core and at-risk IT systems and platforms, to assemble the expertise needed to effectively implement major transformation projects, and to renew SSC.

The Minister is also mandated with leading work on the Next Generation Human Resources and Pay System, with accelerating progress on a new strategy to create a single online window for all government services, and with supporting several key ministers in digitally transforming their services as well as leveraging both digital technologies like artificial intelligence (AI) and digital approaches like open source and open data.

This ministerial mandate builds on the Government of Canada’s work during the last mandate to lay the building blocks for digital government. This included amending the Financial Administration Act to formalize the role of the Chief Information Officer of the Government of Canada in legislation and elevate the function to a deputy minister–level position in order to strengthen management of government IT and support government-wide digital transformation.

The Government of Canada also announced its Digital Standards that establish how all public servants should work differently in the digital age. This includes ensuring that services, programs and operations are user-centric, and that the Government of Canada leverages digital technologies and methods to deliver the high-quality citizen services Canadians expect. The standards were recently updated with further guidance on how departments and agencies can fully integrate the standards into their work.

This includes responsibly and ethically leveraging AI in service delivery. The Government of Canada’s world-leading Directive on Automated Decision-Making and Algorithmic Impact Assessment tool supports the responsible, human rights–based use of automated decision-making systems by helping departments and agencies assess and mitigate any associated impacts. The Government of Canada has also created an AI source list to support departments and agencies in procuring ethical and effective AI solutions, services and products that enable improved, digital-age public services.

The Government of Canada is also building a policy framework that supports government-wide digital transformation. This includes the Policy on Service and Digital, which took effect April 1, 2020. This policy suite establishes a set of now-integrated rules that will guide how the Government of Canada manages service delivery, accessibility, information and data, IT, and cyber security in order to deliver better, user-centric services in the digital era.

Finally, the Government of Canada has established new organizations designed to support the transition to a more digital government. The Digital Transformation Office is leading the integration of the Government of Canada’s web presence on Canada.ca and improving it so that people can find and use the information and services they need, regardless of the department or agency that provides them. Fundamental to this work is measuring the performance of Canada.ca’s top tasks and providing guidance to departments and agencies on how to improve their top tasks to better meet the needs of citizens and businesses. The Canadian Digital Service helps federal organizations design and deliver services that meet the needs of citizens, including through GC Notify that allows departments to quickly and easily send emails and text messages to service users. To date, 110 services have sent over 11.8 million notifications through GC Notify. On July 31, 2020, the Canadian Digital Service and Health Canada also released COVID Alert, Canada’s free COVID-19 exposure notification app. The app was developed in collaboration with partners in the private sector and with provincial governments.

Additionally, the Digital Academy at the Canada School of Public Service equips public servants with the skills they need to deliver digital age service excellence.

Digital Strategy and Budget 2021

The Minister is leading the implementation of a Digital Strategy for government organized across four key areas:

• using modular methods to modernize the way we replace, build and manage mission-critical IT systems
• designing services for the people that use them so that they are reliable, secure, timely, accessible and easy to use from any device
• taking a whole-of-government approach to data stewardship and IT operations, tools and assets
• transforming the institutional barriers to change that have held us back in the past

Building on this existing strategy, Budget 2021 reinforces the government’s commitment to generational investments in Canada’s IT ecosystem. These include investments to acquire new technologies and tools to protect taxpayer information, the modernization of Canada’s benefit delivery systems, accelerating plans to ensure all Canadians have access to broadband Internet, establishing a new Data Commissioner to inform government and business approaches to data-driven issues, as well as a range of supporting investments to address the overall technical debt across government.

Budget 2021 outlines an ambitious next phase for Canada’s digital transformation, with over $2.5 billion invested in both the highest-impact services – like benefits, taxes and immigration – with over $1 billion of that amount dedicated to modernizing critical IT systems, strengthening cyber security efforts, and providing coordinated and informed centralized support to our government-wide transformation effort.

This includes $88 million over four years, starting in 2022–23, and $25.8 million ongoing, to TBS to renew and expand the capacity of the Canadian Digital Service and further improve how the government delivers digital services to Canadians. It also provides $34 million to the Office of the Chief Information Officer to provide strategic direction and leadership in the areas of information management, IT, security, privacy and access to information across the Government of Canada.

TBS continues to work actively with its partners across the Government of Canada to concretely advance the digital government mandate and to improve services to Canadians. This includes efforts to improve governance while empowering teams to be agile and focus on designing user-centred services.

Shared Services Canada (SSC)

SSC undertook a number of significant initiatives to support Government of Canada operations during the pandemic. Others include:

Issue

The 2021–22 Main Estimates for SSC were tabled in Parliament on February 25, 2021. Main Estimates provide an overview of spending requirements for the upcoming fiscal year.

Key facts

• With the approval of 2021–22 Main Estimates, the Department’s reference levels will decrease by $147.1 million, from $2,055.2 million in the 2020–21 Main Estimates to $1,908.1 million in the 2021–22 Main Estimates.
• The overall decrease of $147.1 million is due to a decrease in SSC’s reference levels of $347.2 million, which is offset by an increase of $199.2 million for new items and transfers as well as a $0.9 million increase in Statutory Employee Benefit Plan.
• The main cause of the $347.2 million decrease from the previous year is the reduction in funding related to various projects and initiatives from Budget 2017 and Budget 2018, including a decrease of $170.1 million for the existing Workload Migration Program, as well as a decrease $114.2 million related to the existing Information Technology (IT) Refresh Program.
• The largest new funding element included in the $199.2 million in new funding relates to the continuation of the IT Refresh Program, totalling $93.2 million.

Response

• SSC will invest funding to provide modern, reliable and secure IT infrastructure in support of government priorities and digital delivery of programs and services to Canadians.

Background

With the approval of 2021–22 Main Estimates, the Department’s reference levels will decrease by ($147.1) million, from $2,055.2 million to $1,908.1 million.

The net decrease of ($147.1) million is attributable to the following:

Issue

What is contributing to the net increase in Vote 1, Program Expenditures, in TBS’s 2021–22 Main Estimates?

Key facts

• TBS is seeking parliamentary approval for Vote 1, Program Expenditures authorities of $281.1 million in the 2021–22 Main Estimates, which includes $21.4 million in planned spending under the leadership of the Minister of Digital Government.

Response

• Spending plans for TBS to support the Minister of Digital Government in 2021–22 will continue to increase digitally enabled services and ensure they are supported by reliable and secure digital infrastructure.
• The Canadian Digital Service will use $21.6 million for COVID-19-related services and anticipated new priority government measures to help Canadians through the pandemic, as well as the core work of the Canadian Digital Service.
• These increases are partially offset by the sunsetting of time-limited funding initiatives of $200,000 by SSC.
• Together, these account for the net increase of $21.4 million when compared to last year’s Main Estimates under the Minister of Digital.

Background

The net increase of $21.4 million when compared to last year’s Main Estimates is explained as follows:

• The increase in funding as a result of new funding initiatives of $21.6 million:
  • $12.3 million funding for the Canadian Digital Service to provide critical digital products and services (COVID-19). This funding will be used for the COVID Alert, notably for its cloud computing costs and security review, to accelerate the implementation of Notify, specifically for COVID-19-related services and for the digital service teams to deliver anticipated new priority government measures to help Canadians through the pandemic.
  • $9.3 million funding to continue the Canadian Digital Service. This funding will be used to build on the Canadian Digital Service’s initial work and continue the planned evolution of moving into deeper and more complex service redesign challenges, partnering with core service departments.
• Sunsetting of time-limited funding initiatives and a reduction of funding authorities compared to the previous year of -$0.2 million:
  • Application Modernization Initiative (transfer from SSC): -$0.2 million

Overall, this results in a net increase of $21.4 million in 2021–22 under the leadership of the Minister of Digital Government.

Issue

SSC’s 2021–22 Departmental Plan was tabled February 25, 2021. It provides an account of the department’s mandate, priorities and resources for the upcoming year.

Response

• The digital world continues to grow quickly, with innovations in technological capabilities and use by Canadians. The Government of Canada’s digital transformation must keep pace so that every Canadian can access any federal government service, at any time, from any device.
• Under my new strategic direction, the Government of Canada is an open, service-oriented organization that operates and delivers programs, information and user-centric services securely, and in simple, modern and effective ways optimized for a digital world.
• SSC will continue to implement its enterprise approach to managing digital infrastructure and services. Focus remains on the Government of Canada in its entirety, moving away from providing unique services for each department and agency. Working with federal partners and customers allows leveraging of collective knowledge, expertise and working relationships to ensure the Government of Canada remains responsive, resilient and relevant for Canadians.
• The department’s priorities are aligned to four key areas: network and security, collaboration tools, application modernization and enabling the enterprise. By keeping these priorities top-of-mind, SSC will work towards achieving the seven departmental results under its sole core responsibility – Common Government of Canada Information Technology (IT) Operations.
• The enterprise approach proved instrumental in supporting the government’s pandemic response by allowing SSC and its partners to respond quickly and scale efforts to meeting the changing demand to deliver responsive modern digital services essential to the livelihood of millions of Canadians. These efforts will continue.

If pressed on specific initiatives:

Background

The Departmental Plan provides parliamentarians and Canadians with information on SSC’s mandate, priorities and resources for the upcoming year. It describes SSC’s core responsibility and departmental results, departmental priorities for 2021–22 and how the work of the department will support the government’s mandate, commitments and priorities.

SSC’s Departmental Plan acknowledges the important role SSC 3.0 will play in the digital transformation of the department. The Departmental Plan has been structured to reflect the close alignment between the SSC 3.0 priorities and the department’s core responsibility, results and initiatives.

Issue

What spending did TBS present to Parliament in its 2021–22 Departmental Plan?

Key facts

• Departmental Plans have been part of ongoing efforts to improve reporting to Parliament over the last 25 years.
• TBS’s Departmental Plan includes $7.02 billion in total planned spending, in all categories, including transfers for government-wide initiatives.
• 2,024 FTEs will help achieve results in the Departmental Plan.

Response

• The Government of Canada is committed to ensuring that digital services are efficient, secure and simple to use for Canadians.
• To implement the objectives of digital government, spending plans for TBS in 2021–22 will continue to increase digitally enabled services and ensure they are supported by reliable and secure digital infrastructure.
• TBS will lead the implementation of generational investments to update and replace outdated IT systems and modernize the way government delivers benefits and services, putting Canadians’ needs and expectations first.

Background

TBS’s 2021–22 Departmental Plan presents $7,022.1 million in total planned spending, which includes a total of 2,024 total FTEs.

The breakdown of these planned departmental expenditures consists of:

• $3,703.1 million and 303 FTEs to spending oversight to improve the accountability of how taxpayer dollars are spent, as well as strengthen the clarity and consistency of financial and performance reporting. In addition, TBS will support the government’s response to the COVID-19 pandemic by:
  • helping departments draft proposals for implementing government policies and programs to respond to the pandemic
  • tracking, in partnership with the Department of Finance Canada, the fiscal impact of the government’s pandemic response to inform and support decision-making across government      
• $104.4 million and 608 FTEs to administrative leadership as TBS leads government-wide initiatives, develops policies, and sets the strategic direction for federal government administration. As well, TBS will work with departments to better manage government assets, improve project management, and make government operations greener. In addition, TBS will support the government’s response to the COVID-19 pandemic by:
  • delivering services, including the COVID Alert app
  • leading the implementation of generational investments to update and replace outdated IT systems and modernize the way government delivers benefits and services to Canadians
• advancing open government, including by undertaking a comprehensive review of the Access to Information Act
• $3,114.1 million and 414 FTEs to employer responsibilities as TBS develops policies and sets the strategic direction for people and workplace management in the public service. As well, work with departments to ensure compliance with official languages legislation, negotiate in good faith with public sector unions, and lead the implementation of the Pay Equity Act in the core public administration and the Royal Canadian Mounted Police (RCMP). In addition, TBS will work with departments to prepare the public service for the future by:
  • exploring enhanced flexibility in working arrangements
  • achieving a more diverse and inclusive public service
• modernizing business practices in anticipation of adopting the next generation HR and pay system
• $9 million and 57 FTEs to regulatory oversight as TBS work with departments to improve regulatory transparency, modernize the regulatory system, and reduce administrative burden on Canadian businesses by:
  • reviewing the Red Tape Reduction Act
  • overseeing targeted regulatory reviews to remove bottlenecks to economic growth and innovation
  • working with other governments to reduce regulatory barriers to trade and investment, while continuing to support the health, safety and environmental protection objectives of the Government of Canada
• $91.5 million and 642 FTEs to internal services.

The Minister of Digital Government’s mandate is to lead the Government of Canada’s digital transformation, so every Canadian can access any federal government service at any time from any device.

The COVID-19 pandemic is a devastating circumstance that served to accelerate generational digital transformation. It now compels the Government of Canada to put forward an ambitious plan to build back better and requires dedication and innovation in how we deliver. Canadians expect responsive services and transactions with their government, supported by reliable and secure digital infrastructure.

To do so, in 2021–22, under the administrative leadership core responsibility, TBS aims to achieve the following departmental result: government service delivery is digitally enabled and meets the needs of Canadians, including the following departmental result indicators:

• degree to which clients are satisfied with the delivery of Government of Canada services, expressed as a score out of 100; target at least 60
• percentage of high-volume Government of Canada services that meet service standards; target at least 80%
• percentage of high-volume Government of Canada services that are fully available online; target at least 80%
• usage of high-volume Government of Canada online services, as a percentage of all service delivery channels, including in person and telephone; target at least 75%
• percentage of Government of Canada websites that provide digital services to citizens securely; target 100%
• degree to which clients complete tasks on Government of Canada websites; target to be determined as it is a new indicator

As well as the following departmental result, Canadians have timely access to government information, including the following departmental result indicators:

• number of datasets available to the public; target at least 1,000 new datasets
• percentage of access to information requests responded to within legislated timelines; target at least 90%
• percentage of personal information requests responded to within legislated timelines; target at least 85%

Issue

How will investments included in Budget 2021 support digital government in Canada?

Key facts

• Budget 2021 proposed to invest a total of $101.4 billion over the next three years.
• The Budget includes $648 million over seven years to TBS and Employment and Social Development Canada to continue implementing Benefit Delivery Modernization, invest in Service Canada’s IT systems and related activities, and support service delivery to Canadians

Response

• Budget 2021 recognizes the critical role played by digital government and provides the investments needed to continue the government’s digital transformation and ensure a resilient digital government for the future.
• Proposed key investments outlined in the budget will enable the government to improve and defend our cyber networks, repair and replace critical IT infrastructure, and continue to help departments move digital applications to modern computing facilities.
• Budget 2021 investments will also allow continued work on the Benefit Delivery Modernization program and support the government’s future service delivery to Canadians.
• We look forward to working together to ensure the investments made through Budget 2021 continue to strengthen the Government of Canada’s ability to meet the needs and expectations of Canadians, now and into the future.

Background

Budget 2021 proposed to invest a total of $101.4 billion over the next three years, which is forecasted to result in a deficit of $354.2 billion in 2021–21. The deficit is further forecasted to decline to $30.7 billion in 2025–26, approximately 1% of gross domestic product (GDP).

To support digital government, Budget 2021 committed:

• $88 million over four years, with $25.8 million ongoing, to the Canadian Digital Service to continue to design and deliver digital government services
• $34 million over five years, with $7 million ongoing, to the Office of the Chief Information Officer to continue to provide strategic direction and leadership in the areas of information management, IT, security, privacy and access to information across the Government of Canada
• $456.3 million over five years, starting in 2021–22, with $60.7 million in remaining amortization and $62.2 million ongoing, to SSC and the Communications Security Establishment, to ensure the security of Canadians’ information (allocation of funds between SSC and Communications Security Establishment is not publicly disclosed)
• $215 million over five years to SSC to continue to help government departments and agencies assess digital applications and data, and then decommission or move them to modern computing facilities
• $300 million over three years to SSC to continue work to repair and replace critical IT infrastructure.

Other Budget 2021 investments supporting the government’s digital service delivery include:

Issue

How is cyber security addressed in the Government of Canada, including cyber threats that may pose a risk to government infrastructure, or when aimed at private enterprise?

Key facts

• TBS, SSC and the Communications Security Establishment are the primary stakeholders with responsibility for ensuring the government’s cyber security posture is effective and continues to evolve.
• The RCMP is the primary investigative department on all cyber security incidents dealing with actual or suspected cybercrime of non-state origin on the government’s infrastructure.
• The Policy on Service and Digital outlines the roles and responsibilities of departments for specific aspects of cyber security.
• The Policy on Government Security outlines the roles and responsibilities for lead security agencies.
• Government of Canada departments and agencies play an integral role in establishing governance to ensure the integrated management of service, information, data, IT and cyber security within their department.

Response

• Government of Canada departments and agencies, in collaboration with lead security agencies, are responsible for ensuring that cyber security risks are assessed and mitigated within their organization.
• Together, TBS, SSC and the Communications Security Establishment work to ensure the government’s cyber security posture is current and effective.
• We have robust systems and tools in place to monitor, detect and investigate potential threats, and take active measures to address and neutralize these threats.
• The government will continuously work to enhance cyber security in Canada by preparing for all types of cyber incidents, protecting Canadians and their data.

Background

Issue

The Government of Canada, like every other government and private sector organization in the world, is subject to persistent and constantly evolving cyber threats. As more government services move online, the associated risks to Canadians’ and the Government of Canada’s information is increasing exponentially.

Key facts

• SSC is responsible for managing the security and network infrastructure for its partners and clients. SSC is also responsible for securing the network perimeter and managing the government’s secret infrastructure. There are 50 wide area networks supported by SSC, enabling digital communications for approximately 377,000 government users nationally and internationally.
• SSC is continually updating its security infrastructure and software to leverage the latest security measures to better protect its networks.
• SSC collaborates with the Canadian Centre for Cyber Security and TBS-OCIO for cyber security event management (incident identification, prevention, detection, response and recovery).
• The National Security and Intelligence Review Agency, recently the target of a cyberattack on their email system, is not a SSC partner department, but an optional client that does not receive its email through secure SSC services.
• Recently exploited vulnerabilities to SolarWinds and Microsoft Exchange have increased our need to be able to respond to cyber incidents quickly and pivot to new technologies.

Response

• SSC’s role as the government’s IT service provider is to manage, support and secure the infrastructure required to deliver services to the government and ensure that departments can deliver their services to Canadians.
• SSC inherited more than 50 different departmental network infrastructures and has been on a journey to simplify, standardize and improve its cyber security. Given increasing cyber threats, we have accelerated our actions in priority areas.
• Since 2015, the Government of Canada has invested approximately $576.7 million in cyber and IT security infrastructure projects to evolve and enhance the security posture of critical government systems. These investments include automated vulnerability detection, network device authentication, migrating applications from legacy at-risk data centres to modern housing solutions, and secure remote access migration, to name a few.
• SSC continues to deploy enterprise-level services, which provides consistency and standardization across the environment to reduce complexity. This allows SSC to maximize the productivity of scarce resources and establish a baseline security standard across all organizations.
• When a cyber security event occurs, SSC collaborates with the Cyber Centre and TBS-OCIO to coordinate with affected SSC-managed departments and agencies to determine root causes, limit any impact and undertake recovery.
• The Government of Canada is continually updating its technology to support a more agile public service working in service to Canadians and to ensure the security of the information it collects.

Background

Issue

In the context of the COVID-19 pandemic a large portion of the public service is working from home. Concerns have been raised regarding potential risks associated with security and information management.

Key facts

• In her letters to the President of the Treasury Board on April 2, 2020, and April 28, 2020, the Information Commissioner of Canada reminded the government of the importance of documenting decisions and proactively disclosing data during these extraordinary times.
• On May 28, 2020, the President wrote to his Cabinet colleagues encouraging ministers to proactively publish as much information as possible related to COVID-19 and reminded them of the importance of ensuring best practices in information management.
• TBS released an updated version of the Guideline on Service and Digital in November 2020 that provided organizations with the most current advice and guidance for the strategic management of information and data.

Response

• The government remains committed to managing information securely and effectively, in accordance with its sensitivity, while ensuring transparency, openness and accountability to Canadians.
• All public servants are expected to manage, secure and document information according to legislative requirements and Treasury Board policies, whether working on-site or remotely, and regardless of the tools they use.
• Tools that are publicly available can only be used for unclassified, non-sensitive discussions that would be permitted in an open, public setting.
• Robust systems are in place to monitor, detect and investigate potential cyber security threats to information that may result from working remotely.
• Safeguards such as encryption, encrypted virtual private network (VPN), encrypted storage devices, and upgraded tablets have been used to protect information while ensuring employees can continue delivering trusted services and programs to Canadians.
• Guidance has been provided to departments and agencies emphasizing the importance of documenting decision and adhering to information management security requirements and to notify departments that security policy requirements for the protection of government assets remain in place, whether in the office or off-site.

Background

Government of Canada employees were reminded of the requirements to manage information securely and effectively in accordance with its sensitivity and all relevant policy and legislative requirements while working remotely. These requirements are set out in legislation, including the Library and Archives Act, as well as in Treasury Board policy instruments, including the Policy on Service and Digital and Directive on Service and Digital, and the Policy on Government Security, including the Directive on Security Management.

These requirements include the obligation of employees to document decisions and activities of business value. This includes information, regardless of medium or form, which is created or acquired because it enables and documents decision-making in support of programs, services and ongoing operations, or supports departmental reporting, performance and accountability requirements. Information of business value, no matter where it is created or collected, is required to be transferred to and stored in the appropriate organizational corporate repository.

Employees are also required to ensure the security and proper handling of sensitive information, consistent with the security categorization of the information, as outlined in the Policy on Government Security instruments. This means respecting security markings and making sure that appropriate tools, devices and methods are used to store, transmit, use and protect the information. In the case of third-party applications, such as Zoom and Google Drive, their use is acceptable for unclassified information. Employees have been reminded to use approved government tools and services for collaboration and communication, such as Office 365, Microsoft Teams and GC Tools, wherever possible.

TBS continues to provide guidance to organizations on information management and security. Last April, we released guidance entitled “Managing government information when working remotely” as well as a toolkit (accessible only on the Government of Canada network) to further guide employees in managing government information when working remotely. The toolkit has been updated regularly since its initial release to ensure it provides the most relevant and up-to-date guidance.

TBS also co-hosted a virtual Security Summit in October 2020 and reinforced the important leadership role of the government security community to continue to provide direction and guidance to employees on the protection of government information. This message was again re-emphasized to Government of Canada chief security officers in an email from TBS in January of this year.

TBS hosted a virtual event last November for over 1,600 public servants to launch the Policy on Service and Digital with a focus on the integrated approach of the policy that brings together technology, information and data, services and cyber security. This event coincided with the release of updated policy guidance that provides organizations with the most current advice and guidance for the strategic management of information and data.

Issue

The Government of Canada’s response to cyber incidents such as GCKey, SolarWinds, Microsoft Exchange and the recent third-party supplier incident.

Key facts

• On August 5, 2020, the Government of Canada was made aware of a credential stuffing attack against the GCKey service.
• Of the roughly 12 million active GCKey credentials in Canada, the passwords and usernames of just over 9,300 GCKey credentials were used by bad actors to access government accounts.
• On December 13, 2020, SolarWinds disclosed a security advisory outlining recent malicious activity impacting SolarWinds Orion Platform resulting from a supply chain compromise.^{Footnote 1} SolarWinds Orion software products are used to help monitor networks for problems.
• In early March 2021, Microsoft announced that they detected four zero-day vulnerabilities being exploited to compromise on-premises versions of Microsoft Exchange Server in limited and targeted attacks. Microsoft released out-of-band patches to address all four vulnerabilities.
• On March 12, 2021, a third-party printing services supplier to the government was impacted by a ransomware cyber event. Upon its detection, the supplier shut down all external access to their systems. This attack was not directed at the Government of Canada, nor its IT infrastructure.

Response

• The Government of Canada, like many other public and private sector organizations in the world, faces ongoing and persistent cyber threats.
• The government has robust systems and tools in place to monitor, detect and investigate potential threats, and to neutralize threats when they occur.
• TBS, the Canadian Centre for Cyber Security, SSC and other partners work closely together to investigate and respond to the cyber events as soon as alerted, and to make data, applications and systems secure for Canadians.
• We work continuously to protect Canadians’ data and personal information against cyber threats. We will continue to work to identify cyber threats and vulnerabilities and preparing for and responding to all types of cyber incidents.

Background

In this past fiscal year, the Government of Canada experienced four notable cyber security events: GCKey credential stuffing attack, SolarWinds supply chain compromise, the exploitation of Microsoft Exchange critical vulnerabilities, and a ransomware incident at a third-party printing service that has contracts with the Government of Canada. The incidents are the result of threats faced by public and private sector organizations alike.

Issue

Data security and the protection of personal information is paramount in Canada’s increasingly digitally enabled government.

Key facts

• The Government of Canada has to be particularly vigilant to ensure the integrity of data and the protection of personal information.
• The Communications Security Establishment stops approximately 2 billion malicious activities every day. This includes reconnaissance scans, attempts to install malicious software, and attempts to access databases.
• Every month, SSC blocks 70 million malicious emails via its layered protection. For every email that arrives at the Canada.ca account, four other malicious emails have been filtered out by our email security infrastructure.
• The Privacy Act requires that government institutions protect Canadians’ personal information. TBS privacy policies and guidelines support institutions to meet these obligations.
• Since 2019, TBS has been implementing a Privacy Breach Action Plan, which focuses on strengthening the prevention and management of privacy breaches across government.
• Recent cyberattacks have highlighted the need to continue to protect personal information.

Response

• The Government of Canada is committed to protecting its data, IT infrastructure, and information – especially personal information of individuals – so Canadians can rely on a secure, stable and resilient digital government.
• A number of policies guide federal organizations to build in privacy and security considerations, including the Policy on Service and Digital and the Digital Standards.
• All new or significantly modified government programs that collect personal information must conduct Privacy Impact Assessments and provide them to the Office of the Privacy Commissioner and TBS.
• SSC uses a holistic approach to IT security by ensuring that initiatives are built with security in mind from day one. This is Security by Design, and it is leveraged alongside a rigorous Security Assessment and Authorization process for organizations that are developing or modifying IT systems.
• TBS has also been strengthening the prevention and management of privacy breaches across government through the Privacy Breach Action Plan, including those that might arise as a result of cyber incidents.
• By modernizing our legislative frameworks, we are ensuring that privacy protection and data security are key considerations in Canada’s increasingly digitally enabled government.

Background

• The government has improved its enterprise capacity to detect and defend against cyber threats, centralized Internet access points, launched an enterprise security architecture program, and implemented a whole-of-government incident response plan.
• To support the government’s urgent response to the COVID-19 pandemic, TBS has issued an Interim Privacy Policy and related directives concerning privacy protection.
• Effective from March 13, 2020, to March 31, 2021, the interim policy and related directives gave institutional heads the discretion to undertake a more condensed, but still rigorous, analysis of privacy considerations to ensure privacy is protected in the implementation of urgent COVID-19 initiatives. These measures were used to ensure that privacy continued to be protected as we move forward with the urgent benefits and supports that Canada needs to manage and respond to the pandemic.
• The Office of the Chief Information Officer maintained regular contact with chief information officers across the Government of Canada to coordinate the government’s response to COVID-19 and the associated IT-related needs as well as assisting chief information officers in filling their unmet staffing needs.
• SSC is the custodian of the largest portion of the government’s IT infrastructure. It works with other departments and agencies to help prevent cyber threats by protecting the government’s networks and information. SSC is responsible for planning, designing, building, operating and maintaining effective, efficient and responsive enterprise IT security infrastructure services to secure Government of Canada data and systems under its responsibility.^{Footnote 5}
• SSC has adopted a Project Governance Framework to manage IT projects. This ensures that privacy and security are considered at each stage of a project to decrease risks and effectively implement security controls in IT systems and services. SSC validates the security controls in place for all infrastructure through the Security Assessment and Authorization process and uses Privacy Impact Assessments to validate that the appropriate privacy safeguards are implemented and functioning, as intended.

Issue

AI and quantum computing bring new challenges and opportunities. Governance and investments are required for the Government of Canada to adapt to these new technologies.

Key facts

• The Government of Canada’s Directive on Automated Decision-Making was introduced in March 2019 and came into force on April 1, 2020. It encourages the responsible use of automation and AI in delivering services to Canadians.
• SSC is actively working with science-based departments and agencies to develop methods for continuous improvement of High-Performance Compute service offerings, ensuring services are accessible, reliable, scalable and sustainable for the development of AI.
• Together, these tools help ensure that the government’s use of technology leads to more efficient, accurate, consistent and interpretable decisions.
• The Government of Canada relies on cryptography as an effective way to protect the confidentiality and integrity of information and to protect systems from cyberattacks.
• Quantum computing threatens much of the cryptography used today to protect the confidentiality and integrity of information and to protect systems from cyberattacks.
• Experts estimate that a large universal quantum computer could exist as early as the 2030s.
• Virtually all systems used by the Government of Canada will need to be updated or replaced in the coming years to support quantum-safe cryptography to address this threat.

Response

Background

Issue

Much of the Government of Canada’s applications, infrastructure and hosting environments are outdated, lack modern security, and are at constant risk of outages.

Key facts

• Digital services to Canadians are underpinned by the applications and infrastructure on which they reside.
• At present, only 36% of government applications are considered healthy.
• Many of these applications and their associated data remain hosted in legacy data centres, which, while being maintained through the Information Technology (IT) Repair and Replacement Program, have greater risks of service interruptions, loss of data and security vulnerabilities.
• SSC, in collaboration with TBS, supports the migration and modernization of these outdated and mission-critical government applications to safe and secure modern environments, either to the cloud or to a newer Enterprise Data Centre.
• By adopting cloud computing, the government is better able to support a digitally enabled workforce and digital services for Canadians, particularly during this critical pandemic period.
• Moving application workloads from on-premise environments to the cloud supports green IT initiatives by reducing the corresponding carbon footprint.
• The protection and privacy of government data stored and processed in the cloud is a top priority for SSC and includes compliance monitoring.

Response

• As government applications continue to deteriorate, we must prioritize investments to replace those applications that rely on aging IT and outdated infrastructure.
• The 2021 federal budget announced $300 million to SSC over the next three years to repair and replace critical IT infrastructure and another $215 million to continue to help departments migrate digital applications to modern computing facilities.
• The government is building the digital foundation for modern service delivery to Canadians by adopting cloud technologies, modernizing IT systems, as well as the IT infrastructure and networks on which they reside.
• SSC in collaboration with TBS are supporting these efforts, ultimately improving overall application health to provide efficient, secure and stable digital services.
• Over the last three years, the measure of overall health of the application portfolio has increased from 28% to 36%, which is progress, but we need to continue this trend.
• TBS is providing departments and agencies with financial assistance to acquire the expertise to accelerate department readiness to modernize their applications.
• SSC is providing core services to departments and agencies by assessing and modernizing IT infrastructure, and works with departments on new initiatives to further advance cloud adoption, standardize support, improve processes and service levels, and enhance security.
• Cloud adoption presents great opportunities for better serving Canadians through agility, elasticity, improved service levels and enhanced security.

Background

To provide Canadians with important programs and services, federal government organizations depend on SSC to provide modern and reliable IT infrastructure and services.

To modernize/enhance government digital services, Budget 2018 proposed significant investments to address evolving IT needs and opportunities, while proactively addressing cyber security threats. TBS received $110 million over six years, starting in 2018–19, to be accessed by SSC’s partner departments and agencies to help them modernize their applications to migrate them from older data centres into more secure modern data centres or cloud solutions.

$110 million over six years to TBS, starting in 2018–19, to be accessed by SSC’s partner departments and agencies to help them migrate their applications from older data centres into more secure modern data centres or cloud solutions.

Issue

SSC is helping to accelerate Government of Canada cloud adoption and workload modernization. Public cloud and state-of-the-art enterprise data centres also support of the Government of Canada’s response to COVID-19.

Key facts

• SSC provides the government with access to commercially available cloud services for up to Protected B data.
• As the government’s cloud services broker, SSC helps departments choose public cloud services or enterprise data centres to meet their business needs.
• By adopting cloud computing, the government is able to better support a digitally enabled workforce and digital services for Canadians, particularly during this critical pandemic period.
• Canadians can rest assured that their data is safe in the cloud.
• SSC monitors compliance with Government of Canada–specified security requirements to ensure they are implemented and remain in place.
• The government will not award contracts unless all security requirements are met and has policies in place that enforce where data resides (residency) and how it is controlled (sovereignty).

Response

• The Government of Canada is leveraging cloud adoption to provide secure computing resources with greater agility, performance and security for core IT systems serving Canadians.
• SSC established a contact centre in the cloud to deliver excellent client service while managing constantly evolving security threats.
• In fiscal year 2019–20, SSC launched a Secure Cloud Enablement and Defence pilot with 10 partner departments, which established secure network connections from SSC-managed data centres to the public cloud.
• In fiscal year 2020–21, funding was secured to scale up the pilot, now referred to as Secure Cloud to Ground.
• SSC is working with departments to securely transition to the cloud. As of March 31, 2021, SSC fulfilled $113.9 million of cloud requests across the Government of Canada.
• SSC is also advancing a number of enterprise solutions by leveraging cloud capabilities. These include:
  • migration of email systems to the cloud to provide more stable and integrated solutions to federal public servants
  • building contact centre solutions that enable client departments to scale up call centre capacity as needed
  • making collaborative tools such as Teams available to more than 300,000 employees
• Cloud solutions have been leveraged as part of the effort to respond to the COVID-19 pandemic. For example:
  • a secure cloud-to-ground network connection for the Public Health Agency of Canada is supporting the National Vaccine Management Information Platform initiative and vaccine rollout
  • Employment and Social Development Canada’s cloud-based app enables Canadians to access the Canada Emergency Response Benefit
  • Canada Border Services Agency’s cloud-based ArriveCAN 2.0 supports the re-entry of Canadians after travelling

Background

SSC provides the Government of Canada with access to commercially available cloud services for up to Protected B data and state-of-the-art Enterprise Data Centres.

As the government cloud services broker, SSC helps departments choose public cloud services for their business needs.

By adopting cloud computing or in conjunction with Enterprise Data Centres, the Government of Canada will be able to better support a digitally enabled workforce and digital services for Canadians, particularly during this critical pandemic period.

Issue

SSC conducts innovative, open, fair and transparent procurement processes that are supported by a solid governance. Whenever possible, SSC uses competition to get the best value for Canadians.

Key facts

• SSC procurement is guided by the principles of fairness, openness and transparency.
• SSC is taking action to:
  • simplify procurement and increase access for small and medium enterprises (SMEs) and companies owned and operated by priority groups, such as Indigenous peoples and persons with disabilities
  • leverage its buying power to drive innovation and economic growth
• SSC has in place a Procurement Governance Framework that provides procurement oversight, control, integration, risk management and decision-making to ensure transparency and accountability of decision-making.
• SSC has created a Compliance and Quality Assurance Program to measure adherence and compliance with law, policy and governance.
• SSC is piloting better vendor management tools to explore new ways in which to hold contractors accountable for poor performance or unacceptable behaviour, particularly in large-scale procurements.
• SSC openly collaborates and consults with industry on its integrated procurement strategies and practices.

Response

SSC procurement adheres to Government of Canada procedures and transparency practices. Like other departments, SSC proactively discloses all awarded contracts over $10,000, competitive and non-competitive.

SSC supports market-based competition, where possible.

SSC fully justifies all instances of non-competitive contracts by referencing the legal authority found in the applicable trade agreements and the Government Contracts Regulations.

Examples of non-competitive contracts with a supplier may include:

• to maintain substantial investments in IT infrastructure to maximize its useful life and make the best use out of government resources
• to acquire essential, interchangeable or interoperable equipment to maintain the existing government IT infrastructure where:
  • the original equipment manufacturer is the only one that sells the product (and does not have a reseller network)
  • SSC can demonstrate that a change of supplier cannot be made for economic or technical reasons and would cause significant duplication of costs

Background

• SSC procures the necessary IT assets and services to support digital services and program delivery to Canadians.
• SSC procurement is conducted in a manner that enhances access, competition and fairness, and results in best value or optimal benefits to Canadians, and is guided by the following principles:
  • fairness, transparency, inclusiveness and integrity
  • market-based competition is the best vehicle for delivering the most efficient, effective and highest-value solutions
  • procurement supports economic growth, innovation, economic, socio-economic, innovation, and environmental and sustainability goals
  • positive industry relation and early engagement is key to successful procurement

Issue

The Auditor General tabled a performance audit report on procuring complex information technology solutions on February 25, 2021.

Key facts

• The audit covered the period of April 1, 2018, to August 30, 2020, and implicates SSC, TBS, PSPC and Employment and Social Development Canada.
• The Auditor General observed that federal organizations had made good progress towards modernizing procurement practices and adopting agile procurement.
• The audit found that organizations did not provide enough guidance or training to staff related to agile procurement.
• The audit noted that there were opportunities to strengthen governance to ensure that senior representatives were sufficiently engaged in procurement initiatives.
• The audit noted that improvements are needed to detect and prevent integrity risks in procurement processes.
• The audit made recommendations related to training on agile procurement, and on information management and the use of data analytics to support demonstration of fairness and integrity in procurement.

Response

• The Government of Canada welcomes the Auditor General’s recommendations.
• The government will continue to work across organizations and key stakeholders to develop and promote guidance and tools to support agile procurement.
• SSC has governance frameworks in place to ensure that projects and procurements have appropriate governance and stakeholder engagement, and sound information management practices.
• SSC is working closely with TBS and PSPC to foster a common understanding of agile procurements when undertaking transformational IT initiatives.
• In 2019, SSC established a Centre of Expertise in Agile and Innovative Procurement supporting procurement officers in the implementation of agile and innovative procurements.
• SSC will continue to work with the Office of the Chief Human Resources Officer at TBS and senior officials and users in other departments and agencies to define business needs and anticipate change management requirements for transformational IT initiatives, such as NextGen.
• SSC uses data analytics to inform decision-making and will continue to augment its capabilities through a Departmental Analytics Strategy and roadmap. To help identify procurement integrity issues, SSC will be uploading its procurement data into the department’s Enterprise Data Repository.
• SSC’s Compliance and Quality Assurance Program contributes to support the continuous improvement of information management practices in procurement

Background

Objective of the audit: This audit focused on whether selected departments planned and carried out agile procurements for complex IT solutions that supported the achievement of business outcomes and demonstrated the government’s commitment to fairness, openness and transparency in the process.

In particular, the audit examined the procurement processes for three major IT initiatives: Next Generation Human Resources and Pay (NextGen), Benefits Delivery Modernization, and Workplace Communication Services (WCS). While NextGen and Benefits Delivery Modernization used elements of agile procurement, WCS used a traditional procurement process.

Findings: Overall, the Office of the Auditor General found that the implicated departments made good progress towards adopting agile procurement practices. However, the Office of the Auditor General also found that:

• the organizations rolled out agile procurement without enough training to staff or engagement with key stakeholders
• monitoring of fairness, openness and transparency needed improvement in the areas of procurement integrity, tracking of fairness issues and information from third-party fairness monitors

Recommendations: The report makes five recommendations. TBS was implicated in two of the audit’s recommendations because of its central agency policy role and its involvement with the NextGen HR and Pay Initiative (TBS was lead between 2018 and 2020 before responsibility for the project was transferred to SSC). SSC was scoped into the audit on four of the audit’s recommendations related to the WCS and NextGen.

1. To further support the government’s modernization of procurement, the Treasury Board of Canada Secretariat, Public Services and Procurement Canada, and Shared Services Canada should develop more comprehensive guidance and training for employees to improve understanding of agile procurement and how to apply collaborative methods.

   The Treasury Board of Canada Secretariat, with input from Public Services and Procurement Canada and Shared Services Canada, should also assess what skills, competencies, and experience procurement officers need to support agile approaches to complex IT procurements

2. TBS, Employment and Social Development Canada, and SSC should ensure governance mechanisms are in place to engage senior representatives of concerned departments and agencies for each of the complex IT procurements we audited. This will be particularly important to support agile procurements of complex IT initiatives and their successful achievement of business outcomes.
3. PSPC should continue to advance its use of data analytics so that it can identify procurement integrity issues.
4. SSC should begin to use data analytics to improve its ability to identify procurement integrity issues.
5. PSPC and SSC should improve their information management practices to help contracting authorities better demonstrate that procurement processes are fair. The departments should ensure that procurement records include, at a minimum, file histories, explanations of problems that arise (and how they were resolved) and all relevant decisions and communications with implicated parties.

TBS, PSPC, SSC, and Employment and Social Development Canada agree with the recommendations directed at their departments respectively.

Issue

Government of Canada networks are aging, costly to maintain and unable to support modern services such as cloud, video and voice services. What is SSC doing to facilitate the end-to-end digital services public servants and Canadians need?

Key facts

• SSC provides network services to more than 400,000 government users.
• SSC inherited more than 50 different departmental network infrastructures.

Response

• A high-performing and resilient enterprise network is an underpinning enabler of a digital government.
• SSC is driving an enterprise approach by working with federal partners and clients to consolidate, modernize and standardize Government of Canada networks.
• This enterprise approach is advanced, for example, by sharing network infrastructure across departments and agencies, developing open industry standards, and working with the Communications Security Establishment to design security safeguards into the network from the ground up.
• SSC is leveraging emerging technologies to provide high-performing network services across the country, including northern and remote locations, to lower the total cost of ownership, and to automate and simplify network support.
• SSC is collaborating with industry to ensure we align with global best practices, develop realistic transition plans, and maximize the use of competitive procurement vehicles.
• SSC has outlined its proposed approach in its network modernization way forward document, which has been released for wider industry and peer group feedback and input.

Background

What are the emerging technologies that will support network modernization?

• SSC will leverage emerging technologies such as software-defined networks (SDN), Zero Trust network architecture (ZTNA), next-generation wireless including Long-Term Evolution (LTE) and 5G technologies, AI and continuous network monitoring:
  • SDN is a network architecture paradigm that enables the network to be centrally controlled using software applications
  • ZTNA is a security strategy that is based on the principle that no user, application or device can be trusted
  • LTE (Long-Term Evolution) is a standard for wireless broadband cellular networks
  • 5G is the fifth generation technology standard for broadband cellular networks
  • AI refers to the simulation of human intelligence in machines that are programmed to think and analyze
  • continuous network monitoring is an automated approach to measuring the security and health of the network

What are some of the recent procurement activities?

• Long-term: SSC has initiated five procurement streams for long-term solutions via the Government of Canada network services procurement process.
• Short-term: SSC has recently competed a number of competitive procurements for:
  • network equipment for new buildings for small real property projects (awarded to Ruckus Networks)
  • network equipment refresh (awarded to Juniper Networks)
  • Wi-Fi equipment (in progress)
  • Wide Area Network routers (awarded to Cisco)
  • secure remote access equipment (in progress)
  • firewall equipment (to be initiated in summer 2021)

Issue

The national exposure notification app, COVID Alert, was developed to let users know that they may have been exposed to COVID-19.

Key facts

• COVID Alert, a national exposure notification app, was launched July 31, after approximately 45 days of design and development efforts.
• It was made available to provinces and territories as a public health tool intended to help individuals know that they may have been exposed to COVID-19. Onboarded provinces and territories include Ontario, Manitoba, Saskatchewan, Quebec, Newfoundland and Labrador, Nova Scotia, Prince Edward Island, New Brunswick and the Northwest Territories.
• Metrics about app downloads and usage of one-time keys (OTKs) have been available in the public domain since the launch of the app on Canada.ca.
• COVID Alert was developed by the Canadian Digital Service, using open-source code developed by volunteers from Shopify, as well as Bluetooth exposure notification technology co-developed by Apple and Google. It received security reviews from the Office of the Chief Information Officer at TBS, the Canadian Centre for Cyber Security and BlackBerry.
• Engagement with the Office of the Privacy Commissioner began before the launch of the app and continues as improvements and features are added to the app.

Response

• As Canadians continue to face the health and economic impacts of the pandemic, we need to work together to keep people safe and healthy and contain the virus.
• One of the tools that some countries have found effective in helping to slow the spread of COVID-19 is exposure notification. That’s why the Government of Canada developed the COVID Alert app.
• COVID Alert is just one of many tools the Government of Canada has made available to provinces and territories for Canadians to help protect them from the pandemic and keep them safe.
• The COVID Alert app has been downloaded by millions of Canadians, but because there continues to be a low distribution of OTKs to people who test positive, COVID Alert hasn’t realized its potential.
• The federal government has continued to engage with the provinces and territories – both those who have adopted COVID Alert and those who have not – to find ways to encourage uptake of the app and improve distribution of OTKs when people test positive.
• We are continually assessing the value of COVID Alert in the dynamic context of the pandemic.

Background

Exposure notification uses Bluetooth technology via an application that is downloaded to mobile devices. This is different from conventional contact tracing done by public health officials, a manual process requiring extensive personal information.

As of May 6, COVID Alert app has been downloaded approximately 6.5 million times, with 32,1000 OTKs claimed in the app across nine provinces and territories. Low rates of OTK distribution continue to limit the effectiveness of the OTK-based service. Fewer than 5% of people in Canada diagnosed with COVID-19 have received an OTK to enter into COVID Alert. Of the COVID Alert users who tested positive for COVID and did receive an OTK from their provincial or territorial health authority, nearly all (over 80%) entered that OTK into the app. This indicates that users are willing and able to participate in the system. However, while there have been ongoing discussions with provinces and territories at all levels, OTK distribution is reliant on provinces and territories, which face limited capacity and competing priorities, including vaccine distribution. Downloads of COVID Alert have plateaued since December 2020.

Consideration is being given to a QR (Quick Response) Code exposure notification service (QR Code service) that could be introduced into the app with the potential to help to break the chain of transmission faster, by streamlining contact tracing for app users, businesses and organizations, and public health officials. It is also intended to help respond to the rise in variants of concern. The success of a QR Code service would depend on widespread uptake from provincial and territorial health authorities and businesses.

Issue

How did SSC support IT capacity of Government of Canada departments and agencies, and their employees working from home, during the COVID-19 pandemic?

Key facts

Response

• Providing tools needed by public servants to deliver services to Canadians is critical. This enables work to be performed remotely such as from home and to operate from anywhere in Canada.
• Having reliable, flexible and secure technology enables government departments and agencies to adapt their services, support their teams, and implement responsive measures in a time of crisis.
• SSC provided reliable, secure IT infrastructure, digital collaboration tools, and telecommunications services to Government of Canada departments and agencies delivering critical services to Canadians during the pandemic and so that workers could safely and securely work remotely from home. SSC enabled government employees to access their digital workspaces anywhere, anytime, by:
  • more than doubling the government’s secure network capabilities so that more public servants than ever before are equipped to access networks and systems while teleworking
  • significantly increasing Internet bandwidth to the Government of Canada
• SSC worked diligently to support departments in ensuring that, despite the increased demand, Canadians received seamless services from the federal government.
• For example, SSC worked with the Canada Revenue Agency and Employment and Social Development Canada to help launch the Canada Emergency Response Benefit and the Canada Emergency Wage Subsidy.
• SSC worked with 15 key departments to set up new call centres and toll-free lines; examples include:
  • Global Affairs Canada for Canadians overseas trying to return home to Canada and to respond to travel-related enquiries
  • PSPC for the procurement of personal protective equipment and medical supplies to support health care workers
  • Employment and Social Development Canada for 1-800-O-Canada increased capacity to handle significant increase in call volume
• SSC rolled out the temporary GC-COVID Collaboration System to over 40 departments and 100,000 users. Employees were able to gain reliable and secure access to email, video conferencing, text and audio calling, along with other collaboration tools having accessibility and security built in from the outset.

All of this was not part of the original plan. Initiatives that would normally have taken months or years were compressed into days and weeks, a credit to the SSC’s commitment to other departments and agencies.

Background

How many public servants can work remotely?

• Building on pre-existing tools and approaches, SSC facilitated remote work for employees that needed to connect to the corporate IT infrastructure by increasing the secure remote access capacity for almost 300,000 simultaneous connections. This is more than double the capacity from the beginning of 2020.
• Similarly, by accelerating the deployment of the Microsoft Office 365 collaboration system, SSC enabled users across the government to engage and collaborate remotely without the need to leverage secure remote access. This resulted in the creation of approximately 100,000 Microsoft Office 365 accounts during the pandemic, and approximately 1,000 accounts on a special Microsoft Office 365 tenant designed for emergency/backup communications for senior executives.
• SSC continues to work with private sector vendors on expanding secure remote access capacity to support remote work.
• In addition to increased network capacity, our government partners are taking action to limit non-critical network usage and reduce non-critical activities. Departments are responsible for determining what activities are deemed critical in order to meet their business objectives

Is the delivery of online services to Canadians affected by the COVID-19 pandemic?

• Yes. The COVID-19 pandemic has led to more Canadians accessing services online than ever before.
• Additionally, new services and benefits, such as the Canada Emergency Response Benefit, have placed an increased demand on government networks.
• Our role has been to work with our government partners to ensure they have the infrastructure they need to continue delivering online services to Canadians.

How are we working with other departments during this pandemic?

• SSC plays an important role in ensuring critical services for Canadians remain operational during emergency events.
• SSC is working in close collaboration with the COVID-19 government lead – Public Safety under the Federal Emergency Response Plan – and our government partners.
• SSC supported the government by accelerating the deployment of leading-edge collaboration tools, training and operational guidance so that workers could safely and securely work remotely from home. SSC rolled out the temporary GC-COVID Collaboration System to over 40 departments and 100,000 users.
• Employees were able to gain reliable and secure access to email, video conferencing, text and audio calling, along with other collaboration tools having accessibility and security built in from the outset.

Supporting the Canadian Emergency Response Benefit and Canada Emergency Wage Subsidy:

• SSC worked with Canada Revenue Agency and Employment and Social Development Canada to help launch the Canada Emergency Response Benefit and Canada Emergency Wage Subsidy.
• SSC continue to work with Employment and Social Development Canada and Canada Revenue Agency to provide recommendations and remediation to support critical new and enhanced federal benefits for Canadians.
• SSC provided the IT infrastructure Canada Revenue Agency needed for its MyAccount application to handle the more than 15 million Canadian Emergency Response Benefit applications received to date.

Supporting our first responders:

• SSC enabled Mobile Broadband for First Responders for more than 1,000 users across the Government of Canada. This service provides essential personnel such as first responders and critical infrastructure supporters with priority mobile voice and data services in times of commercial congestion.

Issue

Update on the Next Generation HR and Pay Initiative

Response

• The NextGen HR and Pay is about testing pay solutions against pay requirements of federal departments. It is an iterative and agile testing process that will lead to a comprehensive recommendation about building the HR and pay solution for the future.
• This initiative builds on the lessons learned from the development and implementation of Phoenix.
• Through a competitive, agile procurement process, SAP was selected to work with the Government of Canada for preliminary testing of their Success Factors software, a software as a service solution with industry-leading HR and pay practices built into its configuration.
• Since October 2020, we have worked with Canadian Heritage to establish the parameters to test the pay capabilities of SAP’s proposed solution. Future testing will include other organizations to test the diverse levels of pay and HR complexity required of the Government of Canada system.
• The team is leveraging input and advice from other complex private and public sector organizations that have implemented a software as a service HR and pay to ensure the software can handle the complexities of the Government of Canada environment.

Background

Budget 2018 announced the government’s intention to move away from Phoenix and begin development of a pay system that will be better aligned with the complexity of the federal government’s HR and pay structure.

TBS received $16 million over two years, beginning in 2018–19, to explore replacement options for a next generation HR and pay solution.

In summer 2019, the government announced it had selected Ceridian, SAP and Workday as the vendors deemed qualified to deliver a next generation HR and pay solution for the Government of Canada.

In September 2019, the government announced that it will invest $117 million to co-design and deliver pilot projects for the NextGen HR and pay system.

In March 2020, after extensive evaluation, and testing, it was announced that SAP had been selected to work with our team on a pilot for a new HR and pay solution.

SAP was selected through a rigorous evaluation process which was open and transparent and placed users at the centre. The evaluations involved elements such measuring vendors against digital, privacy and security standards, as well as testing of hundreds of HR and pay scenarios, both simple and complex.

All three vendors remain qualified to work with the government in the future for HR and pay solutions. This means maximum flexibility for the government to access the solutions of multiple, best-in-class vendors, which is critical to the NextGen approach.

The NextGen team at SSC engaged SAP on a series of discussions to assess organizational capacity and readiness to work on NextGen under the current COVID-19 circumstances.

Initial focus of work with SAP included establishing governance and oversight, project management tools and protocols, and development of a detailed plan to pilot the solution in a core department.

Effective April 1, 2020, leadership for NextGen was transitioned from TBS to SSC. The Chief Human Resources Officer at TBS remains the business owner and a key collaborator of the NextGen initiative.

On October 14, 2020, the selection of the Canadian Heritage for the exploratory phase of the Next Generation HR and pay initiative was announced.

The government is working with the selected vendor (SAP) and Canadian Heritage to develop an approach to testing that reflects the needs of Canadian Heritage in the context of the core public service.

Canadian Heritage was selected as the exploratory phase department because their organization provides a good representation of the government’s HR complexities, including multiple occupational groups, regional representation, overtime and other considerations.

Throughout this process, the NextGen team is engaging with public service employees, leaders, HR advisors and technical specialists, as well as working hand in hand with bargaining agents in the development of a user-centric HR and pay solution.

As part of this pilot initiative, NextGen has involved over 890 employees from 20 federal organizations through 38 workshops and 90 working sessions with HR and pay practitioners, end users and technical experts. These activities form the basis for NextGen’s exploratory phase, and they will inform the next steps in the initiative.

The government will be making a decision this month about moving from the exploratory phase with SAP’s Success Factors into the design and experimentation phase, where configuring of the solution will occur.

Any testing undertaken will not affect employees’ actual pay. Testing will occur in a controlled environment that is not connected to payment systems. Canadian Heritage employees will continue to be paid through the Phoenix pay system while testing is completed.

The government continues to work with stakeholders, such as bargaining agents, employees, and HR and pay practitioners, and will continue to engage in an open and transparent manner so that the new solution can address the needs of a modern public service and its employees as soon as possible.

Over the next three years, NextGen will carry out additional pilots and a feasibility study. The details for the additional pilots and the feasibility study are being finalized, and learning from the exploratory phase will inform the planning for these future phases.

Ongoing stabilization of the Phoenix Pay System remains a top priority for the government and is being pursued by PSPC.