/cccs-guidance

description: CCCS assessment process and certified cloud provider guidance

CCCS Assessment Guidance

Guidance on the Canadian Centre for Cyber Security (CCCS) cloud security assessment process and certified cloud service providers.

Arguments

• `$1` - Topic (optional: process, providers, requirements) - defaults to "process"

CCCS Assessment Process

ITSM.50.100 Cloud Security Assessment

The CCCS assesses cloud service providers against the ITSP.50.103 Cloud Security Categorization framework.

**Assessment Tiers**:

• **Tier 1**: Self-assessment by CSP
• **Tier 2**: Independent third-party assessment
• **Tier 3**: CCCS assessment (for Protected B and above)

Protected B Assessment Steps

1. Pre-Assessment (1-2 months)

**Organization Activities**:

• Review ITSG-33 security controls
• Implement PBMM controls (10 required controls)
• Document security policies and procedures
• Prepare System Security Plan (SSP)
• Conduct internal audit

**Required Documentation**:

• System Security Plan (SSP)
• Privacy Impact Assessment (PIA)
• Security Assessment Report (SAR)
• Plan of Action and Milestones (POA&M)
• Incident Response Plan
• Contingency Plan

2. Application Submission (1 month)

**Submission to CCCS**:

• Complete assessment application
• Submit documentation package
• Provide cloud service description
• Identify Canadian regions used
• Demonstrate data residency controls

**CCCS Review**:

• Documentation completeness check
• Initial risk assessment
• Assessment schedule determination

3. Assessment Execution (2-4 months)

**Assessment Activities**:

• Document review and analysis
• Configuration review of cloud environment
• Security control testing (10 PBMM controls)
• Vulnerability assessment
• Penetration testing (if required)
• Interviews with personnel

**Evidence Requirements**:

• Configuration screenshots
• Log samples (2-year retention proof)
• Encryption validation (FIPS 140-2)
• Data residency verification
• Access control demonstrations
• Incident response procedures

4. Remediation (1-3 months)

**For Identified Gaps**:

• CCCS provides findings report
• Organization develops remediation plan
• Implement corrective actions
• Re-assessment of remediated controls

**POA&M**:

• Document residual risks
• Establish remediation timelines
• Assign responsible parties
• Track to completion

5. Certification (1 month)

**CCCS Deliverables**:

• Security Assessment Report (SAR)
• Authorization to Operate (ATO)
• Continuous monitoring requirements
• Re-assessment schedule

**Validity Period**: 2 years (re-assessment required)

Assessment Costs

| Item | Estimated Cost (CAD) | Notes | |------|---------------------|-------| | **Pre-assessment consulting** | $50,000 - $150,000 | Gap analysis, SSP development | | **Third-party assessment** | $100,000 - $250,000 | CCCS Tier 2 assessment | | **Remediation** | $50,000 - $200,000 | Depends on gaps | | **CCCS assessment fee** | Varies | For Tier 3 assessments | | **Annual maintenance** | $25,000 - $75,000 | Continuous monitoring | | **Re-assessment (2 years)** | $75,000 - $150,000 | Reduced scope |

Certified Cloud Service Providers

AWS Canada

**Certification Status**: ✅ ITSM.50.100 Assessed

**Canadian Regions**:

• ca-central-1 (Montreal, Quebec)
• ca-west-1 (Calgary, Alberta)

**Services Assessed**:

• EC2, S3, RDS, Lambda
• CloudTrail, CloudWatch
• KMS, IAM, VPC

**PBMM Features**:

• FIPS 140-2 Level 2 encryption (AWS KMS)
• Canadian data residency enforcement
• MFA support (IAM, Cognito)
• 2-year+ log retention (CloudWatch, S3)
• Network isolation (VPC)

**Contact**: AWS Canada Public Sector team

Microsoft Azure Canada

**Certification Status**: ✅ PBMM Assessed

**Canadian Regions**:

• canadacentral (Toronto, Ontario)
• canadaeast (Quebec City, Quebec)

**Services Assessed**:

• Virtual Machines, Storage, SQL Database
• Azure Monitor, Log Analytics
• Key Vault, Active Directory

**PBMM Features**:

• FIPS 140-2 Level 2 encryption (Key Vault HSM)
• Canadian data residency controls
• Azure AD MFA
• 2-year log retention (Monitor, Storage)
• Network Security Groups, Application Security Groups

**Contact**: Microsoft Canada Public Sector

Google Cloud Platform Canada

**Certification Status**: ⚠️ Assessment In Progress (verify current status)

**Canadian Regions**:

• northamerica-northeast1 (Montreal, Quebec)
• northamerica-northeast2 (Toronto, Ontario)

**Services**:

• Compute Engine, Cloud Storage, Cloud SQL
• Cloud Logging, Cloud Monitoring
• Cloud KMS, Identity and Access Management

**PBMM Features**:

• FIPS 140-2 Level 3 encryption (Cloud KMS)
• Data residency controls
• IAM with MFA
• Log retention configuration
• VPC Service Controls

**Contact**: Google Cloud Canada team

**Note**: Verify current CCCS certification status before use

Protected B Control Requirements

Mandatory Controls (Medium Cloud Security Profile)

| Control ID | Control Name | CCCS Requirement | |-----------|-------------|-----------------| | **PBMM-DATA-1** | Canadian Data Residency | All data in CA regions only | | **PBMM-AC-1** | Access Control Policy | Documented, enforced | | **PBMM-AC-2** | Multi-Factor Authentication | Mandatory for all users | | **PBMM-AU-1** | Audit and Accountability | 2-year log retention | | **PBMM-SC-1** | Encryption at Rest | FIPS 140-2 Level 2+ | | **PBMM-SC-2** | Encryption in Transit | TLS 1.2+ with FIPS | | **PBMM-SC-3** | Network Segmentation | VPC/VNet isolation | | **PBMM-RA-1** | Vulnerability Management | 48-hour critical patching | | **PBMM-IR-1** | Incident Response | CCCS notification process | | **PBMM-CP-1** | Backup and Recovery | Canadian region backups |

Continuous Monitoring Requirements

Post-Authorization

**Monthly Reporting**:

• Security control status
• Vulnerability scan results
• Incident summary
• Configuration changes

**Quarterly Reviews**:

• Access control verification
• Log analysis and anomaly detection

-