For all security matters, we have standards that define the requirements for different levels of protection of information. On the personal information and operational information it is Protected A, B and C, and on the national security side it's classified secret and top secret. For each one of those categorizations, we specify the minimum requirements.
Even for protected information, information about Canadians, we require encryption and different controls to make sure no one can access that data except the right people. Those controls are there for that reason, and I'm confident in them.