As the scope and severity of IT threats evolve, so too are the measures in place to prevent them. For the law enforcement community, those measures include ITSG-33, a security risk management framework published by the Canadian Centre for Cyber Security, an entity under the Communications Security Establishment (CSE).
Released in 2012, ITSG-33 details an IT security risk management process that all entities working in the federal public realm must eventually adopt – particularly as the Canadian government moves closer to embracing cloud-based operations.
“The Canadian government is undergoing a significant transition to the cloud; and as part of that, cloud-based service providers will need to demonstrate compliance with the ITSG-33 framework to be allowed to provide services to the Government of Canada,” says Francois Marinier, Chief Information Security Officer with FSET Information Technology & Services.
“And since what FSET offers is driven by the power of the cloud,” he continues, “We need to be ahead of the curve.”
Adopting ITSG 33
ITSG-33 draws inspiration from other global standards (e.g., the US’s NIST Risk Management Framework for Information Systems and Organizations). It holds all federal public sector stakeholders to higher standards when it comes to mitigating today’s cybersecurity threats. That includes the RCMP, which, like many public entities, needs to consider embracing cloud-based data management and Software as a Service (SaaS) solutions.”
FSET’s #MobilityFirst is one such tool that is gaining traction in the law enforcement community. It uses mobile technologies and server-based computing to replicate the functionality of an officer’s Mobile Data Terminal (MDT) on a Samsung Galaxy mobile device, thereby creating a genuine desktop experience, or what Samsung refers to as DeX. And given #MobilityFirst’s reliance on cloud-based technology, FSET has taken proactive steps to meet and promote ITSG-33 standards.
“We know that in the very near future that our law enforcement partners will be asking for ITSG- 33 certifications in order to use our services, so we proactively instituted the Security Assurance program that will allow us to do that,” explains Kate Shippey, Director of Business Development.
There were many motivations to become ITSG-33 compliant, she adds. Beyond the fact that such compliance will be table stakes for working with many of FSET’s clients, the firm recognized that implementing ITSG-33 standards into its services would align it with international standards, thereby positioning the company for future expansions.
Moreover, adds Shippey, it would make the procurement process for its Canadian clients easier to tackle: “When agencies want to buy FSET services, they have to do their due diligence to make sure we are walking the walk when it comes to security standards. By being ITSG-33 compliant, we can help fast-track that process for our clients right from the start, saving them time, resources, and money during the procurement process.”
Raising the bar
It’s one thing to keep speed with IT security standards. It’s another to lead the pack. To that end, FSET is also playing a role in preparing the law enforcement industry for ITSG-33 adoption through its Security Assurance Program.
“What we can help law enforcement agencies do is map the security safeguards they currently have in place to the security requirements of ITSG-33, do the analysis, find the gaps, and identify what they need to become ITSG-33 compliant,” says Marinier. “After all, while we can demonstrate compliance for the layers of technology that we control, there are still processes that are within their area of responsibility. That’s why we created our Security Assurance Program – to make sure our clients are secure on all fronts.”
As the Canadian government and its agencies move closer to the cloud, the standards for IT security are rising. Meeting those requirements can be a challenge, which is why FSET is doing its part to bring itself and its partners in line with ITSG-33 requirements and serve as a trusted ally in cybersecurity.
To learn more about FSET’s Security Assurance Program contact the FSET team for more information and details
