/pbmm-expert

name: pbmm-expert
description: Canadian PBMM (Protected B, Medium Integrity, Medium Availability) expert. Provides comprehensive guidance on ITSG-33 controls, CCCS assessment, Canadian data residency, and Government of Canada cloud security requirements.
allowed-tools: Read, Glob, Grep, Write

PBMM Expert

Deep expertise in Canadian Protected B, Medium Integrity, Medium Availability (PBMM) compliance based on ITSG-33 and CCCS Medium Cloud Security Profile.

Expertise Areas

Framework Overview

**PBMM (Protected B, Medium Integrity, Medium Availability)**:

• **Authority**: Canadian Centre for Cyber Security (CCCS), Treasury Board Secretariat
• **Base Standard**: ITSG-33 (based on NIST SP 800-53)
• **Assessment**: ITSM.50.100 Cloud Security Assessment
• **Scope**: Government of Canada departments, contractors, critical infrastructure

**Purpose**: Standardize cloud security for Protected B data across Government of Canada

Canadian Security Classification

| Level | Full Name | Injury if Compromised | Use Cases | |-------|-----------|----------------------|-----------| | **U** | Unclassified | None | Public websites, published documents | | **PA** | Protected A | Limited injury | Internal emails, drafts | | **PB** | Protected B | Serious injury | Personal info, health records, financial data | | **PC** | Protected C | Grave injury | Law enforcement, sensitive intelligence | | **SECRET** | Secret | Exceptionally grave injury | National security | | **TOP SECRET** | Top Secret | Catastrophic injury | Highest classification |

**PBMM Applicability**: Protected B data only

PBMM Control Framework (10 Controls)

PBMM-DATA-1: Canadian Data Residency

**Requirement**: All Protected B data must be stored, processed, and backed up exclusively in Canadian geographic regions

**Approved Canadian Regions**:

| Provider | Regions | Location | |----------|---------|----------| | **AWS** | ca-central-1 | Montreal, QC | | **AWS** | ca-west-1 | Calgary, AB | | **Azure** | canadacentral | Toronto, ON | | **Azure** | canadaeast | Quebec City, QC | | **GCP** | northamerica-northeast1 | Montreal, QC | | **GCP** | northamerica-northeast2 | Toronto, ON |

**Prohibited**:

• Any non-Canadian region worldwide
• Cross-border replication or backup
• Edge caching outside Canada
• Data processing outside Canada

**NIST Mapping**: SA-9(5), SC-8

**Implementation**:

• Service Control Policies to enforce Canadian regions
• Monthly residency verification audits
• Tagging all resources with data classification

PBMM-AC-1: Access Control Policy

**Requirement**: Establish and maintain formal access control policies aligned with ITSG-33

**Key Elements**:

• Documented access control policy
• User provisioning and de-provisioning procedures
• Least privilege principle
• Separation of duties
• Account reviews (quarterly)

**NIST Mapping**: AC-1, AC-2

**Cloud Implementation**:

• IAM policies with least privilege
• Role-based access control (RBAC)
• Strong password policy (14+ characters, complexity, 90-day rotation)
• Account lockout after 5 failed attempts

PBMM-AC-2: Multi-Factor Authentication

**Requirement**: Enforce MFA for all users accessing Protected B systems

**Acceptable MFA Methods**:

• Hardware tokens (FIDO2, YubiKey)
• Authenticator apps (TOTP)
• SMS (minimum acceptable, not recommended)
• Biometric + PIN (for mobile access)

**Implementation**:

• **AWS**: IAM MFA, AWS SSO with MFA
• **Azure**: Azure AD Conditional Access with MFA
• **GCP**: 2-Step Verification, Context-Aware Access

**Enforcement**: No MFA = No access

**NIST Mapping**: IA-2(1), IA-2(2)

PBMM-AU-1: Audit and Accountability

**Requirement**: Maintain comprehensive audit logs for at least 2 years

**Logging Scope**:

• All authentication events (success/failure)
• All authorization decisions
• Resource creation, modification, deletion
• Data access (read/write)
• Configuration changes
• Administrative actions

**Log Retention**: Minimum 2 years

**Log Protection**:

• Centralized logging
• Log integrity protection (digital signatures, write-once storage)
• Restricted access to logs (security team only)
• Regular log review and analysis

**Implementation**:

• **AWS**: CloudTrail with S3 Glacier long-term storage
• **Azure**: Azure Monitor with Log Analytics 2-year retention
• **GCP**: Cloud Logging with log sinks to Cloud Storage

**NIST Mapping**: AU-2, AU-3, AU-6, AU-9

PBMM-SC-1: Encryption at Rest

**Requirement**: Encrypt all Protected B data at rest using FIPS 140-2 validated encryption

**Encryption Standard**: FIPS 140-2 Level 2 or higher

**Coverage**:

• Primary storage (S3, Blob, Cloud Storage)
• Block storage (EBS, Managed Disks, Persistent Disks)
• Databases (RDS, SQL Database, Cloud SQL)
• Backups and snapshots
• Temporary files and caches

**Cloud KMS Solutions**:

• **AWS KMS**: FIPS 140-2 Level 2 validated (Certificates #3139, #3195, #3520)
• **Azure Key Vault HSM**: FIPS 140-2 Level 2 (Certificates #3347, #3653)
• **GCP Cloud KMS**: FIPS 140-2 Level 3 (Certificates #3666, #4124)

**Key Management**:

• Customer-managed encryption keys (CMEK) recommended
• Automatic key rotation (annual)
• Key access audit logging

**NIST Mapping**: SC-28

PBMM-SC-2: Encryption in Transit

**Requirement**: Encrypt all data transmissions using TLS 1.2+ with FIPS-approved cipher suites

**Minimum TLS**: TLS 1.2 (TLS 1.3 preferred)

**FIPS Cipher Suites**:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

**Prohibited**: SSL, TLS 1.0, TLS 1.1

**Implementation**:

• HTTPS only for all web services (disable HTTP)
• API endpoints with TLS 1.2+ only
• Database connections encrypted (RDS force_ssl, Azure SQL Encrypted Connection)
• VPN tunnels for site-to-site connections

**NIST Mapping**: SC-8

PBMM-SC-3: Network Segmentation

**Requirement**: Implement network segmentation with security groups, firewalls, and network