CybersecurityControl setGuideline

ITSG-33

IT Security Risk Management: A Lifecycle Approach (ITSG-33)

ITSG-33 is a guideline developed by the Canadian Centre for Cyber Security to help government departments manage IT security risks effectively. It outlines activities at both departmental and project levels, providing a structured process for integrating security considerations into IT environments and maintaining authorization to operate.

Book your strategy call View source ↗

Overview

ITSG-33 helps Canadian federal departments address IT security risks by integrating risk management practices into departmental security programs and IT project lifecycles. It provides a comprehensive framework for identifying, managing, and mitigating risks through the use of a security control catalogue structured into technical, operational, and management controls. Additionally, it includes control profiles tailored for specific confidentiality, integrity, and availability requirements. By following ITSG-33, organizations can ensure cost-effectiveness, compliance with risk management strategies, and continuous improvement in adapting to evolving threats.

Related in Cybersecurity

CybersecurityStandard

ESMA Minimum Standard IT Security Controls

The ESMA Minimum Standard IT Security Controls is a cybersecurity and compliance framework that defines the minimum security requirements service providers must implement to protect ESMA systems, applications, data, and information services.

European Securities and Markets Authority (ESMA) • EU

View details

CybersecurityStandardFramework

DISP 2020 — Defence Industry Security Program (DISP)– Suitability Assessment (2020)

The Defence Industry Security Program (DISP) is an Australian Defence membership program that helps organizations implement and demonstrate appropriate security controls for participating in Defence projects and managing Defence-related information and assets.

Australian Department of Defence • Australia • v2020

View details

CybersecurityStandardFramework

DISP 2022 — Defence Industry Security Program – Suitability Requirements (2022)

The Defence Industry Security Program (DISP) is an Australian Defence security assurance program that helps organizations meet security requirements for Defence contracts and projects by implementing appropriate governance, personnel, physical, and information security controls.

Australian Government • Australia • v2022

View details

CybersecurityLaw

Alabama Data Breach Notification Act of 2018 — Chapter 38 Data Breach Notification Act of 2018

The Alabama Data Breach Notification Act of 2018 is a state data protection law that requires organizations to safeguard sensitive personal information, investigate security breaches, and provide timely notification to affected individuals and regulatory authorities when personal data is compromised.

State of Alabama • Alabama, USA • vPolicy 621-01

View details

Ready to manage these frameworks?

6clicks maps regulations to controls, evidence and risks — automatically.

Book your strategy call