Auditor general finds Canadian gov't failing security test

Canadian government agencies are failing to meet security standards on industrial contracting procedures, leaving sensitive government information vulnerable.

This was one of the findings outlined by Auditor General Sheila Fraser, in her Annual Report, tabled recently in the House of Commons.

"We found serious problems in the system that is supposed to ensure the security of government information and assets entrusted to industry," Fraser said in her report.

Of particular concern, she said, was government's failure to identify security requirements for major defense contracts.

The audit looked at how the federal government is implementing safeguards to protect sensitive government information when engaging in contractual agreements with industry, the report said. These safeguards are based on the objectives outlined under the Government Security Policy (GSP), which ensures that sensitive government information and assets are protected during contracting.

The auditor general looked at how government, particularly Public Works and Government Services Canada (PWGSC) as the lead contracting authority for government, is implementing the Industrial Security Program (ISP), which outlines procedures for delivering the objectives of the GSP.

The ISP ensures that the contracting organizations have necessary security clearances, that the contracts contain the necessary security clauses and that these provisions are being complied with, the report stated.

The auditor general found there have been failures on the part of the PWGSC to follow key procedures under the ISP. The report said PWGSC has failed to allocate to the ISP a stable, long-term funding needed to hire and retain qualified professionals to support the provisions of the program.

In a statement sent to Intergovworld, PWGSC indicated it has implemented a "robust Action Plan" to respond to all the recommendations outlined in the auditor general's report, including the creation of an Industrial Security Management Advisory Board "to oversee the action plan and provide advice to management."

"The government takes security very seriously. PWGSC continues to improve its activities in accordance with government policies and has already addressed all the recommendations of the auditor general," the PWGSC statement said.

Fraser's report acknowledged that the GSP's contracting standard is "ambiguous," and has contributed to confusion about responsibilities under the policy.

"We found that PWGSC's roles and responsibilities for security in contracting are not clearly understood within the department," the report said.

The PWGSC accounts for 90 per cent of the total dollar value and about 10 per cent of the total volume of government contracts.

The auditor general's office also examined the IT environment supporting PWGSC's Industrial Security Program, to assess the system's capability to meet the security requirements of the GSP.

According to the audit report the ISP's information resides on a separate network with controlled access. While no incidents of security breaches have been reported, there was no evidence that the system has been certified under the government's Management of Information Technology Security standard.

The information system supporting the ISP also did not have a comprehensive disaster recovery plan, which would impair the program's operations in the event of a disaster, the report said.

Certifying its ISP's technology infrastructure under the GSP is part of PWGSC's action plan in response to the auditor general's recommendations. The department said it will also develop an action plan that would further enhance the IT systems that support contract security.

In addition, the federal government will finalize and implement standard operating procedures and train staff to ensure that procedures under the program are consistently followed.

PWGSC also said it will review all 3,000 active contracts with security requirements to ensure all the necessary steps to prevent breaches have been addressed. The department will also implement ongoing quality assurance and monitoring to ensure consistency and accuracy in processes.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

• Bookmark this page
• Share this article
  •  
  • facebook
  • slashdot
  • digg
  • Reddit
  • stumbleupon
  • linkedin
  • twitter
• Got more on this story? Email CIO
• Follow CIO on twitter

• Share
  Share this article

  •  google+
  • facebookfacebook
  • slashdotslashdot
  • diggdigg
  • RedditReddit
  • stumbleuponstumbleupon
  • linkedinlinkedin
  • twittertwitter
• print
• email
• Bookmark