ITSP.10.171

Protecting Specified Information in Non-Government of Canada Systems and Organizations

ITSP.10.171 sets out security requirements for protecting 'specified information' when it resides in non-Government of Canada systems or organizations. It aligns with NIST standards but adapts them to the Canadian regulatory environment.

Book your strategy call View source ↗

Overview

ITSP.10.171 is a cybersecurity standard issued by the Canadian Centre for Cyber Security to ensure the confidentiality of specified information as it resides in non-Government of Canada (non-GC) systems. The publication is modeled after NIST SP 800-171 but tailored to reflect Canadian legal, regulatory, and operational contexts. It outlines 17 families of security requirements, such as access control, incident response, and supply chain risk management. Non-GC organizations working with GC bodies must comply with these standards to safeguard contractual information. The document also supports scoping methods to limit security requirements to designated system components, balancing security needs with practicality. It references ITSP.10.033 as its control baseline and introduces organization-defined parameters (ODPs) for scalability and flexibility.

Related in Cybersecurity

CybersecurityControl setGuideline

ITSG-33 — IT Security Risk Management: A Lifecycle Approach (ITSG-33)

ITSG-33 is a guideline developed by the Canadian Centre for Cyber Security to help government departments manage IT security risks effectively. It outlines activities at both departmental and project levels, providing a structured process for integrating security considerations into IT environments and maintaining authorization to operate.

Canadian Centre for Cyber Security • Canada

View details

CybersecurityStandard

ESMA Minimum Standard IT Security Controls

The ESMA Minimum Standard IT Security Controls is a cybersecurity and compliance framework that defines the minimum security requirements service providers must implement to protect ESMA systems, applications, data, and information services.

European Securities and Markets Authority (ESMA) • EU

View details

CybersecurityStandardFramework

DISP 2020 — Defence Industry Security Program (DISP)– Suitability Assessment (2020)

The Defence Industry Security Program (DISP) is an Australian Defence membership program that helps organizations implement and demonstrate appropriate security controls for participating in Defence projects and managing Defence-related information and assets.

Australian Department of Defence • Australia • v2020

View details

CybersecurityStandardFramework

DISP 2022 — Defence Industry Security Program – Suitability Requirements (2022)

The Defence Industry Security Program (DISP) is an Australian Defence security assurance program that helps organizations meet security requirements for Defence contracts and projects by implementing appropriate governance, personnel, physical, and information security controls.

Australian Government • Australia • v2022

View details

Ready to manage these frameworks?

6clicks maps regulations to controls, evidence and risks — automatically.

Book your strategy call