CCCS guidance
Canadian Centre for Cyber Security guidance (ITSG, ITSP, ITSM series) — CCCS (Canadian Centre for Cyber Security)
Also known as: CCCS, ITSG-33, ITSP.10.033, Canadian Centre for Cyber Security, Cyber Centre
Official site Official change log Subscribe to CCCS guidance (RSS)
At a glance
- Current version
- ITSP.10.033 Security and privacy controls and assurance activities catalogue
- Published 31 March 2026. source
- Status
- In force
- Next deadline
- None announced
- How it is assessed
- Organisations select and tailor controls from the catalogue through their own risk management processes; a companion assessment publication for ITSP.10.171 is planned. source
- Written by
- Unclassified publications issued under the authority of the Head of the Canadian Centre for Cyber Security (Cyber Centre). source
- Enforced by
- The guidance binds through Treasury Board policy for federal departments and through federal contracts for suppliers. source
- Last change
Canada's national security guidance, published as numbered series: ITSG for the long-lived documents, ITSP for requirements, ITSM and ITSAP for shorter advice. The series is worth watching as one subject rather than document by document.
Recent changes
-
Low
CCCS publishes guidance on managing security risks in vibe coding
CCCS has published new guidance titled Managing security risks in vibe coding (ITSM.60.043). This guidance is intended for anyone in an organization who uses or oversees …
-
Low
CCCS publishes overview of Cyber security and privacy risk management lifecycle approach in ITSP.10.035
CCCS has published ITSP.10.035, an overview document outlining a lifecycle approach to cyber security and privacy risk management. This guidance integrates security and privacy considerations into …
-
Low
CCCS publishes guidance on cyber threat to aviation
The Canadian Centre for Cyber Security has published new guidance addressing cyber threats to the aviation industry. This guidance provides aviation sector organizations with information on …
-
Low
CCCS publishes guidance on managing AI token consumption for operational resilience
CCCS has published ITSM.00.125, new guidance on managing AI token consumption as part of operational resilience strategies. Organizations should implement controls to monitor, limit, and optimize …
-
Low
CCCS publishes Cyber security considerations for submarine cables (ITSP.20.001)
The Canadian Centre for Cyber Security (CCCS) published ITSP.20.001, providing guidance on cybersecurity considerations for submarine cables. The publication outlines the threat landscape affecting submarine cable …
-
Low
CCCS publishes Best practices for setting up a SOC (ITSAP.00.500)
The Canadian Centre for Cyber Security has published ITSAP.00.500, a new guidance document on best practices for setting up a Security Operations Centre (SOC). As cyber …
-
Low
CCCS publishes guidance on organizational cyber security and privacy risk management activities ITSP.10.036
The Canadian Centre for Cyber Security (CCCS) has published ITSP.10.036, providing guidance on organizational cyber security and privacy risk management activities. This guidance establishes frameworks and …
-
Low
CCCS publishes guidance on careful adoption of agentic AI
The Canadian Centre for Cyber Security (CCCS) has published guidance on the careful adoption of agentic AI systems. The guidance addresses key security considerations and risks …
That is the last 90 days. Sign in to read further back.
Key dates
No upcoming datesVersion history
-
ITSP.10.033 Security and privacy controls and assurance activities catalogue Major versionCurrent
New control catalogue aligned with NIST SP 800-53 Rev. 5 that supersedes ITSG-33 Annex 3A and adds privacy controls. source
More
- Alignment moves from NIST SP 800-53 Rev. 4 to Rev. 5.
- Adds privacy and privacy-related controls and assurance activities, and new families PM (Program Management), PT (Personal Information and Transparency) and SR (Supply Chain Risk Management).
- Canadian-specific controls and enhancements now start at 400 instead of 100 (for example SA-400, IA-04(400)); assurance-related controls are now called activities.
- The series' audience now includes critical infrastructure as well as the Government of Canada.
-
ITSP.10.171 (second release) Revision
Second release of the Canadian version of NIST SP 800-171. source
-
ITSP.10.171 Protecting specified information in non-GC systems Major version
Canadian version of NIST SP 800-171: security requirements for protecting specified federal information in non-Government of Canada systems and organisations. source
-
ITSG-33 IT security risk management - a lifecycle approach Major version
The federal IT security risk management guideline and its annexes, effective 1 November 2012. source
Who it applies to
The Cyber Centre's control catalogues serve federal departments in every sensitivity domain, critical infrastructure, and contractors handling specified federal information.
- Federal departments
- ITSP.10.033 provides controls for departments and agencies with business activities of very low to very high sensitivity and criticality, in Unclassified, Protected and Classified domains. source
- Critical infrastructure
- The Cyber security and privacy risk management series now addresses critical infrastructures in addition to the Government of Canada. source
- Contractors
- ITSP.10.171 sets requirements for components of non-GC systems that handle specified information, for use by departments in contracts and other agreements. source
How compliance is assessed
Organisations select and tailor controls from the catalogue through their own risk management processes; a companion assessment publication for ITSP.10.171 is planned.
- Selecting controls
- ITSP.10.036 (organisational) and ITSP.10.037 (system lifecycle) explain how to select, tailor and implement the catalogue's controls and assurance activities. source
- Assessment procedures
- The Cyber Centre will produce a companion publication based on NIST SP 800-171A with procedures to assess the ITSP.10.171 requirements. source
Enforcement and penalties
The guidance binds through Treasury Board policy for federal departments and through federal contracts for suppliers.
- Federal departments
- Departments and agencies are required to follow the policies and directives published by the Treasury Board of Canada Secretariat when using federal systems to handle information. source
- Federal contracting
- The security controls and activities in ITSP.10.171 outline requirements for federal contracting. source
Documents
- Standard Security and privacy controls and assurance activities catalogue (ITSP.10.033)
- Guidance Cyber security and privacy risk management - a lifecycle approach (series)
- Standard Protecting specified information in non-Government of Canada systems and organizations (ITSP.10.171)
- Guidance IT security risk management - a lifecycle approach (ITSG-33)
Frequently asked questions
What replaced the ITSG-33 security control catalogue?
ITSP.10.033, the Security and privacy controls and assurance activities catalogue, which took effect on 31 March 2026 and supersedes ITSG-33 Annex 3A. source
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to CCCS guidance (RSS)