IT Security Professional Services

Description of Work: Tasks for the Business Continuity/Disaster Recovery Resource, Level 3 The tasks and responsibilities of the Business Continuity and Disaster Recovery Specialist, Level 3 could be but are not limited to the following:

Policy and Governance Review – a review of the existing BCP Policy and the current governance structure and roles and responsibilities for the planning, preparedness and the ongoing BCP program as well as governance during an actual business interruption. BCP Program Governance Business Continuity Event Governance

Business Impact Analysis Review – a review will be done of the current BIA, comparing it against current standards and the current (or near future) organizational structure of INFC. Comment will be made on the status of the Business Impact Analysis (BIA) and recommendations provided on what is the simplest and most practical method to close any remaining BIA gaps.

Business Continuity Plans Review – a review of the current BCP Plans, documenting Gaps and recommending any corrective or improvement actions required.

Information Technologies Continuity (Disaster Recovery) Review – a look at the status of IT Continuity planning, alternate IT requirements and capabilities.

BCP Program Review – a review of all aspects of the BCP program including

Exercising and Testing - a review of exercises and tests done to date

Maintenance Program - a review of ongoing review and revision of all BIAs and plans to account for any changes (legislation, critical services, organization, mandate, management, threat environment, stakeholders, dependencies, etc.).

Training: a review of current planned training requirements.

Exercising and Test Program – a review of planned actions for regular testing and validation of all plans, including the preparation of a lessons learned report after testing activities or actual events (validation can range from a questionnaire through table top exercises to departmental or interdepartmental live exercises -frequency as determined by departments).

Audit – a review of any development of an audit cycle for the BCP Program, as the basis of regular reporting to the Treasury Board Secretariat.

Gap Analysis and Recommendations: Document all findings in the form of a simple BCP GAP analysis report with action plan and corrective recommendations to bring INFC into full compliance with the applicable GoC acts, policies and standards.

BCP Policy and Governance Update: In this stage of work, tasks will be completed to update the BCP policy with a specific focus on the governance and roles and responsibilities for BCP Program Governance and Business Continuity Event Governance (which will be incorporated into both the policy and BCP). Steps for this work will include:

Prepare for governance interviews and set up meetings; Meet with INFC representatives to review, and finalize roles and responsibilities; Create first draft updated Policy with define governance and roles and responsibilities; Obtain review and input from INFC through the Project Authority; and Update and finalize the Policy including governance and roles and responsibilities.

Business Impact Analysis: In this stage of work, work is to be completed in order to leverage all existing Business Impact Analysis (BIA) data and fill gaps identified in the review and assessment stage, above. The outcome of the BIA will be to establish what business functions are critical, their recovery priorities and dependencies so that recovery time objective and recovery requirements can then be set. Criticality[1] will be defined by analyzing the probability and impact of a significant service disruption based on a specific scenario (or group of scenarios), using a variety of impact criteria. Some of the steps in this phase are:

Develop BIA Template to use to guide BIA interviews (if required); Identify organization functions and knowledgeable and credible functional area representatives; and Review the proposed BIA template with Project Authority for input, make revisions and finalize the template.

Perform BIA Interviews

Perform business impact analysis (BIA) interviews (if required), with key departmental representatives to validate the accuracy of the current information and to gather information and consensus on impacts of outage During the interviews: Identify business function dependencies Determine the impact of a disruption on each critical service and dependency Develop a draft list of critical services and dependencies, ranked by resumption priority Determine and define recovery objectives and timeframes for critical services and dependencies Determine the IT systems and components Recovery Time Objectives (RTOs) Determine critical staff and staffing levels required to deliver critical services in the event of a pandemic influenza outbreak

Consolidate and document the BIA data in the form of a BIA Update Report

Presentation to Management: Present the BIA update findings and resultant recommendations for sign-off by the Project Authority.

Final Report: Using feedback from INFC, the BIA Update Report will be updated and finalized,

Tasks for the IT Security Methodology, Policy and Procedures Analyst, Level 3 The tasks and responsibilities of the IT Security Methodology, Policy and Procedures Analyst, Level 3 could be, but are not limited to, the following: The will be required to perform, but is not limited to, the following tasks:

Review current Departmental IT Security Plan; Review current IM/IMIT Security Plan and ensure the IM and IT Security components are also addressed and updated ; Update all Security Risk Snapshots for each security risk in order to determine the likelihood and impact to INFC Identifying new security controls and/or mitigation strategies in order to address the risks once finalized. Prepare Security Gap analysis to identify the discrepancies and identify means to address those issues (“as is” to “future state). Coordination and consolidation of information related to IT security goals; Analyze security data and provide advisories and reports; Prepare technical reports such as requirement analysis, options analysis, technical architecture documents, mathematical risk modeling; and A simple refresh of the documents look and feel, as well as updated content.

Knowledge Requirements

Knowledge of TBS guidelines and directives related to departmental security; Extensive knowledge of security zoning as outlined within CSEC guidelines; Extensive knowledge in GC Threat and Risk Assessment methodologies; Extensive knowledge of security controls and safeguards employed at a corporate level; and Knowledge of requirements for high integrity systems.

Tasks for the IT Security TRA and C&A Analyst, Level 3 The tasks and responsibilities of the IT Security TRA and C&A Analyst, Level 3 could be, but are not limited to, the following:

Assist with the evaluation and definition of security controls for new applications; Work with application developers to ensure inclusion of security requirements into development activities; Help assess department against MITS; Review risk and manage risk through the application of GC – ITSG 33 activities; Develop templates for repeatable process; and Conduct Threat Risk Assessments based on HTRA methodology.

[1] A Critical Service is defined as a service and associated assets that are critical to the health, safety, security or economic well-being of Canadians, or the effective functioning of government. Unavailability would result in a high degree of injury to Canadians and government