Government Operations Committee on Feb. 27th, 2019

[Les Linklater]

Yes.

[Cheryl Hardcastle, NDP, Windsor—Tecumseh, ON]

We're looking for a new system. Is there some off-chance that somebody's going to decide that no, we're going to fix Phoenix, that we're going to stick with this, or have we already decided we're fixing it in the interim and we're moving into something new?

[Les Linklater]

The government, in budget 2018, made a very clear signal that they were looking for a next-generation HR-to-pay system. The Treasury Board Secretariat, under the chief information officer, is now looking at options for what that new system could/should look like based on available software.

There is a process now to evaluate potential vendors to be able to test options for moving forward. I'll underline, though, that it will be years before any new system would be fully functional. That means we need to continue to invest in stabilization efforts with Phoenix. Phoenix will remain the system of record until the data is clean enough to be able to transmit or transfer to a new platform. That's going take a number of years to accomplish.

[The Chair, Conservative, Tom Lukiwski]

Thank you very much.

Our final intervention will be with Monsieur Drouin for seven minutes.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

I have the final intervention. I feel so special.

Thanks again for being here.

I do want to touch on procurement, but first I have to ask a question on supplementary estimates (B). There's $19.9 million for Shared Services for cyber and information technology security initiatives. What type of initiatives is SSC undertaking with that particular portfolio?

[Paul Glover]

We are constantly working with partners to assess the threat landscape, see how it is evolving and make sure that we have the tools necessary to respond. It is a process of continually assessing, working with our partners in the security agencies, and then making sure we have the technology, the firewall, the perimeter, properly protected so the government services and employees are able to function within our network safely and securely. It is just this constant: Threats are changing, understanding where they're changing, what security we need to put in place and software and servers to protect that perimeter.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

SSC does an assessment, I would think, and I'm just going off the ball here, but I would think departments like National Defence would have better equipment or better protection than perhaps other departments.

Does SSC use best practices that other departments have used and then try to implement those in other departments? I'm assuming threat levels are different from department to department.

[Paul Glover]

We have worked to set up the Canadian Centre for Cyber Security, so there is a centre of expertise that is responsible for identifying what those best practices are and identifying what the security profile needs to be for the Government of Canada. We work very closely with them to make sure that we understand the threat profile and what the appropriate response mechanism is. They're doing that right now with all departments. We're trying to consolidate and collapse that to reduce risk to bring everybody to the best practice right across the federal public service.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

That would bring me to my next question on procurement.

We know threat levels, and there are often new ways that government systems can get hacked. They often move a lot faster than technology can get adapted to, so how are we doing with procurement? Are you guys talking with procurement to say, “Okay, well, we have these threat levels that are constantly changing, and we have technology that's constantly changing, but if procurement doesn't adapt quickly enough to ensure that, yes, SSC and the Government of Canada can procure new technologies and new systems quickly enough so we don't fall behind the line essentially by putting our systems at risk“? Is that conversation happening as well?

[Paul Glover]

That conversation is absolutely happening at multi-levels. As we heard earlier, we are looking at new procurement processes that are agile and are meant to move small but fast to see what the level of risk is, understand what's working and be able to scale those up quickly.

We also have processes that ensure the supply chain integrity of anything that we are procuring so that we're able to see, not just the end vendor, but the whole supply chain that resulted in a product or service being provided to us so that we have confidence in it all the way through, are able to see all of the potential areas where there may be a threat risk and are confident that those have been properly mitigated. That supply chain integrity through procurement is exceptionally important to us as we move forward.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

That's great.

Mr. Chair, I'm done.

[The Chair, Conservative, Tom Lukiwski]

Thank you, Mr. Drouin.

Madam Paquet, gentlemen, thank you all for your appearance here today. The information that you transmitted has been helpful.

For the benefit of those of you who have not had the ability to answer certain questions because of time constraints, I would suggest that if you can provide those answers to the clerk in writing, we will make sure that we distribute them to the appropriate colleagues around this table who had asked the questions originally. All members will receive the answers to those questions.

The meeting is adjourned.