Horizontal Internal Audit of Information Technology Security in Large and Small Departments (Phase 1)

Governance frameworks over IT security

The audit examined whether governance frameworks over IT security for unclassified government networks were in place. Overall, the audit found that elements of such frameworks were in place [This information has been severed]^{Footnote 9}.

The audit noted that government-wide policy direction for IT security has been established via the Treasury Board policy framework, with more up-to-date technical guidance recently provided in certain areas; however, foundational policy instruments are outdated and need to reflect the government’s current operational environment, including the clarification of roles and responsibilities. Namely, Treasury Board policy instruments need to address the consolidation of the IT infrastructure for 43 government organizations (hereafter referred to as the shared IT infrastructure) under Shared Services Canada (SSC). Furthermore, although SSC provided high-level guiding principles to these 43 organizations (hereafter referred to as partner organizations), the audit noted a need for SSC to further define operational roles, responsibilities and expectations for securing the current legacy shared IT infrastructure maintained on behalf of its partner organizations. Within departments, IT security policies were established, but these are also mostly outdated.

In support of security governance, several interdepartmental committees were established to address matters relating to IT security across government. [This information has been severed] the need to improve the coordination between interdepartmental committees. The audit also noted that governance structures were in place in most departments to support the coordination of IT security activities, and that the structures aligned with government-wide policy requirements.

[This information has been severed]

Selected control frameworks

While recognizing that no single measure can prevent all malicious cyber activity, the audit examined the control frameworks of unclassified government networks [This information has been severed]^{Footnote 10}

Foundational policy instruments are outdated, [This information has been severed].

Under the Policy on Government Security, the Secretariat is responsible for setting government-wide direction and providing leadership for federal government security policies. The policy also states that CSE is responsible for developing guidelines and tools related to IT security, as the government’s national technical authority for signals intelligence and communications security. As a shared service provider and owner of a shared IT infrastructure relied upon by 43 partner organizations, SSC is expected to define its roles, responsibilities, and accountabilities toward its partner organizations as per the Directive on Departmental Security Management and the Operational Security Standard: Management of IT Security (MITS).

Pursuant to its mandated responsibilities, the Secretariat has been providing government-wide direction on IT security roles, responsibilities and expectations mainly through the following policy instruments: the Policy on Government Security, the Directive on Departmental Security Management, the Operational Security Standard: Management of IT Security (MITS), and the Government of Canada Information Technology Incident Management Plan. However, most of these policy instruments have not been updated in several years, [This information has been severed]

The Secretariat’s representatives mentioned that the delays in updating the policy instruments are mainly due to the need to align with the ongoing broader review of the Treasury Board policy suite.

[This information has been severed]^{Footnote 24}.

Several governance committees have been established but coordination needs to improve.

The Policy on Government Security states that the Secretariat is responsible for establishing and maintaining interdepartmental security governance.^{Footnote 25} It also states that Deputy Heads are accountable for the effective implementation and governance of security within their departments. Since SSC owns the IT infrastructure shared with its partner organizations, we expected that SSC’s deputy head would be accountable for the governance of security over this shared IT infrastructure.

The Secretariat is leading various committees, working groups, and forums to support a whole-of-government approach to IT security. In 2014-15, the Public Service Management Advisory Committee established a sub-committee on governance led by the Secretariat to provide an integrated view of IT planning across the federal government.

SSC has put in place an executive committee structure comprised of several committees for the purpose of establishing and maintaining collaborative working relationships with its partner organizations. Most of these committees are not specifically dedicated to IT security and deal with IT security issues only on an ad hoc basis. SSC also established an Operations Security Review Committee, which is dedicated to IT security and focuses on reviewing and evaluating IT security incidents and their business impacts on SSC’s partners.

Other Lead Security Agencies (e.g., Privy Council Office, Public Safety Canada) have also established governance committees.

The audit found that there were several interactions between the governance committees; however, the reporting relationships were not formally defined. [This information has been severed]

Well-defined, streamlined, and coordinated governance committee structures with clear roles and responsibilities would improve the efficiency and effectiveness of IT security governance [This information has been severed].

The Policy on Government Security states that “security is achieved when it is supported by senior management - an integral component of strategic and operational planning - and embedded into departmental frameworks, culture, day-to-day operations and employee behaviours.” It also states that at a government-wide level, security threats, risks and incidents must be proactively managed. The principles outlined in MITS further build on these concepts by emphasizing that government should be viewed as a single entity and that efforts need to be coordinated between departments, SSC and other Lead Security Agencies to support IT security.

According to the Policy on Government Security, the Secretariat is responsible for exercising strategic oversight, providing leadership, and establishing priorities related to government security (including incident management for government systems).

The Policy on Government Security also requires Deputy Heads of all departments to approve a Departmental Security Plan (DSP) that details decisions for managing security risks and that outlines strategies, goals, objectives, priorities and timelines for improving departmental security and supporting its implementation. The Directive on Departmental Security Management further elaborates on the requirements applicable to DSPs.

[This information has been severed].

CSE issued guidance (i.e., ITSG-33, Annex 1) recommending a specific approach for managing IT security risks consistently within federal government departments.

Pursuant to its mandated responsibilities, the Secretariat developed the Government of Canada Information Technology Incident Management Plan to provide an enterprise framework for the management of IT security incidents.

[This information has been severed].

The Policy on Government Security requires that the Secretariat review and report to the Treasury Board on the effectiveness and implementation of this policy and associated directives and standards at the five-year mark from the effective date of the policy (i.e., by July 2014).

Under the Directive on Departmental Security Management, departments are expected to evaluate the achievement of the objectives outlined in their DSPs and report on the results to the appropriate governance committees. This involves measuring performance on an ongoing basis to ensure that an acceptable level of residual IT security risk is achieved and maintained. Given the importance of the shared IT infrastructure relied upon by its partner organizations, we expected that SSC would have put in place similar monitoring and reporting frameworks to address the security risks associated with this IT infrastructure.

[This information has been severed]

Recommendations – Governance at the government-wide level

1. The Secretariat should ensure that appropriate plans are in place and regularly monitored to expedite the renewal of its policy frameworks for IT security. [This information has been severed].
2. [This information has been severed].
3. [This information has been severed].
4. [This information has been severed].
5. [This information has been severed].
6. As part of its policy suite renewal initiative, the Secretariat should assess the need for reporting on the implementation and the effectiveness of its current security policy instruments (as required under the Policy on Government Security).
7. [This information has been severed].

Departments generally have departmental IT security policies; however, they need to be updated.

The Operational Security Standard: Management of IT Security (MITS) requires every department to have a departmental IT security policy that is reviewed by its IT security Coordinator (ITSC) and approved by senior management. Such policies must be communicated to stakeholders and must cover all aspects listed under section 10 of MITS, as a minimum (e.g., definition of roles and responsibilities). MITS also states that IT security practices need to reflect the changing environment.

The audit found that both large and small departments had departmental policies that generally included the required elements listed in MITS; however, most of the small departments could not provide documentation to verify the review or approval of their IT security policies.

In addition, mechanisms were not in place in most of the large and small departments to ensure that departmental IT security policies were updated in a timely manner to reflect the changing environment (e.g., transfer of responsibilities to SSC). [This information has been severed].

Departmental governance structures supporting the coordination of IT security activities are mostly in place and align with the Treasury Board’s policy requirements.

The Policy on Government Security requires that departments appoint a departmental security officer (DSO), who is functionally responsible to the deputy head or to the departmental executive committee to manage the departmental security program. MITS in turn requires that departments appoint an ITSC with at least a functional reporting relationship to both the departmental Chief Information Officer (CIO) and the DSO. The ITSC is responsible for establishing and managing a departmental IT security program as part of a coordinated departmental security program. Finally, MITS also requires departments to appoint an individual or establish a centre to coordinate incident response and act as a point of contact for communication with respect to government-wide incident response. Departments that do not have an Information Protection Centre should assign this function to the ITSC.

The Directive on Departmental Security Management requires departments to ensure that the accountabilities, delegations, reporting relationships, and roles and responsibilities of departmental employees with security responsibilities are defined, documented, and communicated to the relevant persons. Under this directive, departments are also expected to establish security governance mechanisms (e.g., committees, working groups) to ensure the coordination and integration of security activities, and facilitate decision making.

The audit found that all departments had formal committees in place to support the coordination of their organizations’ activities, including IT security activities. As a best practice, the audit noted that some of the large and small departments had established committees specifically dedicated to overseeing IT security activities.

The departmental governance structures also partially aligned with the Secretariat’s requirements listed previously. However, in most of the small departments it was noted that the roles, responsibilities and accountabilities of individuals with security responsibilities (e.g., DSO, ITSC and incident coordination) were not formally defined or communicated. Representatives from some of the small departments mentioned that they felt the current informal approach suited their needs, given the small size of their department.

Formalizing communication of the roles, responsibilities and accountabilities of individuals with security responsibilities would help foster a better understanding of expectations, and the coordination of IT security activities.

[This information has been severed].

The Policy on Government Security requires Deputy Heads to approve a DSP detailing decisions for managing security risks and outlining strategies, goals, objectives, priorities and timelines for improving departmental security and supporting its implementation. The Directive on Departmental Security Management provides further direction on the required content of a DSP.

The Government of Canada Information Technology Incident Management Plan requires all departments to have incident management processes and plans that are integrated with their DSP and aligned with the process outlined in the Government of Canada Information Technology Incident Management Plan. The ability to detect and respond to incidents in a coordinated and consistent fashion is essential to ensuring the security of government systems.

[This information has been severed]

The Framework for the Management of Risk states that Deputy Heads are responsible for managing their organization’s risks by leading the implementation of effective risk management practices, both formal and informal. According to the principles of this framework, effective risk management in the federal public service should be integrated and systematic. This implies a continuous, proactive and systematic process to understand, manage and communicate risk from an organization-wide perspective. Integrated risk management is about supporting strategic decision making that contributes to the achievement of overall objectives.

To support alignment with the risk management principles previously outlined, CSE issued guidance (i.e., ITSG-33, Annex 1) recommending a specific approach for managing IT security risks consistently within government departments.

The audit found that most of the large departments had systematic risk management processes covering IT security risks; [This information has been severed]

The Policy on Government Security requires deputy heads to ensure that periodic reviews are conducted to assess whether their departmental security program is effective; whether the goals, strategic objectives, and control objectives detailed in their DSP were achieved; and whether their DSP remains appropriate to the needs of the department and the government as a whole.

MITS states that departments must conduct an annual assessment of their IT security program and practices to monitor compliance with government and departmental security policies and standards.  

[This information has been severed].

Recommendations – Governance at the departmental level

8. Departments should ensure that their IT security policies are updated in a timely manner to reflect changes in the operating environment.
9. [This information has been severed] departments should ensure that the roles, responsibilities and accountabilities of individuals with security responsibilities are formally established and communicated.
10. [This information has been severed].
11. [This information has been severed].
12. [This information has been severed].

Recommendation – Selected control frameworks

13. [This information has been severed].