ITSG-33 is the Canadian Centre for Cyber Security's IT security risk management guidance for Government of Canada systems. PBMM is a common security control profile for systems handling Protected B information with medium integrity and availability needs. This guide covers the preparation that makes assessment go smoothly.
Most assessment delays come from unclear scope, undocumented inheritance and missing evidence. All three can be fixed before the assessor arrives.
Assessment starts with a clear boundary: which components, data flows, users, interconnections and providers are part of the system being authorized.
Questions to ask
Tailor the control profile to the system and assign an owner to each applicable control, so nothing falls between teams.
Questions to ask
Many controls are inherited from a cloud provider, a departmental service or a common platform. Document exactly what is inherited and what remains your responsibility.
Questions to ask
Assessors need evidence that controls are implemented and operating: configurations, procedures, logs and test results mapped to each requirement, typically in a security requirements traceability matrix (SRTM).
Questions to ask
Not every gap is equal. Rank gaps by their effect on the system's mission and on the confidentiality, integrity and availability of Protected B information.
Questions to ask
Turn gaps into a sequenced plan with owners, effort, dependencies and dates, so the authorizing official can see a credible path to acceptable risk.
Questions to ask
Last reviewed September 24, 2026. This guide is general information, not legal advice. Print or save this page to use it as a workshop handout or pre-engagement checklist.
C3SA can help validate the current state, identify material gaps, define the target state and support implementation, testing and readiness.
