Evidence of meeting #56 for Public Accounts in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was departments.
A video is available from Parliament.
4 p.m.
Conservative
Stephanie Kusie Conservative Calgary Midnapore, AB
Thank you.
Madam Luelo, do you think the Government of Canada is matching cloud adaptation standards as seen abroad?
4 p.m.
Deputy Minister, Chief Information Officer of Canada, Treasury Board Secretariat
I think we are experiencing things that are very similar to what other organizations do at this stage of our maturity. We are less than 10% in the cloud. I think we are adopting what are standard best practices, and I think we are learning unfortunately a lot of the same lessons that organizations learn, which is.... One of the key findings of the Auditor General's report was that we have great standards and guardrails in place, but the application of them was inconsistent, which is why the automation is so very important.
4 p.m.
Conservative
Stephanie Kusie Conservative Calgary Midnapore, AB
Was there an international comparative analysis completed?
4 p.m.
Deputy Minister, Chief Information Officer of Canada, Treasury Board Secretariat
Not that I'm aware of, but I might ask my colleague, who has been around the table a little longer, if there was an international benchmark done. There is not one that I'm aware of.
4 p.m.
President, Shared Services Canada
What I know about that—and maybe our colleagues from the Centre for Cyber Security will have views—is that we often compare our practice here in Canada to the standards of the Americans on cybersecurity. We do comparisons, but again, I'm not sure we have a report that will do a broader scan.
4 p.m.
Associate Head, Canadian Centre for Cyber Security, Communications Security Establishment
I would like to add as well that in terms of our assessment of the CSPs, the cloud service providers, we do look at international standards such as ISO FedRAMP in the United States, as well as SOC 2 Type 2 reports, which are required in terms of the assessment process. We make sure that we're very harmonized with the international standards and the U.S. in that space.
4 p.m.
Conservative
Stephanie Kusie Conservative Calgary Midnapore, AB
Thank you.
Mr. Hayes, in your audit, you mentioned that one security weakness was that contract security clauses were “unclear” and not standard. At the government operations committee, we found that in some instances contractors were able to start work on the project without a security clearance in place.
Were those the types of issues you found with Shared Services and Public Services and Procurement Canada?
4 p.m.
Deputy Auditor General, Office of the Auditor General
In terms of the roles and responsibilities, we were concerned that unclarity led to questions about who was on first, who was going to be dealing with issues when there was an event. We did also identify that the monitoring and oversight could be improved both by Shared Services and by PSPC.
4 p.m.
Conservative
Stephanie Kusie Conservative Calgary Midnapore, AB
Expanding upon that, Mr. Hayes, what security measures for IT contracts were recommended by your organization?
4 p.m.
Deputy Auditor General, Office of the Auditor General
I won't get into the details of some of the information that we weren't able to include in the report, but what we identified was that for the guardrails for the security requirements that are in place, they should be implemented in their entirety, and ongoing monitoring should be happening as well.
4 p.m.
Conservative
Stephanie Kusie Conservative Calgary Midnapore, AB
You also recommended in your report that cloud contracts need to have the “security requirements” clarified within the federal government. Who do you think should be taking on that role?
4 p.m.
Deputy Auditor General, Office of the Auditor General
In my view, this is a role for the Treasury Board Secretariat to provide guidance and policy.
4 p.m.
Conservative
Stephanie Kusie Conservative Calgary Midnapore, AB
Thank you, Mr. Hayes.
Ms. Luelo, you mentioned that currently less than 10% of government information is on the cloud. Do you think we should be halting storing more information on the cloud until the recommendations of the Auditor General are implemented?
4:05 p.m.
Deputy Minister, Chief Information Officer of Canada, Treasury Board Secretariat
Just to make a point of clarification, it's 10% of systems, not data. It's a little different.
4:05 p.m.
Conservative
4:05 p.m.
Deputy Minister, Chief Information Officer of Canada, Treasury Board Secretariat
No, no, that's okay, but it's important that nuance.
I think we can continue course and speed. We have actually quite aggressively moved on the Auditor General's findings already, as I outlined in some of my remarks, and we will continue to tighten things as we move along.
There is always, as part of putting a new system into production, i.e., into the cloud, a released production activity list you go through to make sure that things have been met. We'll be disciplined in making sure that for cloud migrations, we pay very close attention to that, to ensure that we're managing that risk.
4:05 p.m.
Conservative
4:05 p.m.
Conservative
The Chair Conservative John Williamson
That ends your time, Ms. Kusie. Thank you.
Ms. Bradford, you have the floor for six minutes, please.
March 30th, 2023 / 4:05 p.m.
Liberal
Valerie Bradford Liberal Kitchener South—Hespeler, ON
Thank you, Mr. Chair.
Thank you to all of our witnesses. I think this is one of the few occasions where we have practically more witnesses than we actually have committee members. It's good to a see a full house today.
I'm going to start with a question for you, Mr. Hayes.
What percentage of the government departments that you assessed were deficient regarding their security event management plans as it pertains to cybersecurity and personal information in the cloud?
4:05 p.m.
Deputy Auditor General, Office of the Auditor General
We looked at three departments. We weren't looking across the entire government. Because it's not a representative sample or anything, our results can't be extrapolated across the government, but the areas we identified in our report related to three departments.
4:05 p.m.
Liberal
Valerie Bradford Liberal Kitchener South—Hespeler, ON
Did your audit find that any information had been compromised?
4:05 p.m.
Deputy Auditor General, Office of the Auditor General
We didn't look into that degree of specificity. We were looking at the testing of their plans and the implementation of their plans.
4:05 p.m.
Liberal
Valerie Bradford Liberal Kitchener South—Hespeler, ON
Mr. Gupta, what work is being done to ensure that Canadians' personal information is safe as we shift to more digital forms of storage?
4:05 p.m.
Associate Head, Canadian Centre for Cyber Security, Communications Security Establishment
On an ongoing basis, we're assessing the threats to cloud service providers. We're providing threat assessments on those. We're providing advice and guidance for cloud service providers, including for the government and Canadians, in terms of how to secure your cloud systems. On an ongoing basis we're seeing how the threat landscape is changing in accordance with technologies and we're making sure that our advice and guidance and information are up to par.
For the government we're also deploying cyber-defence services to make sure the technologies we deploy for the government are actually taking into account the new threat factors we're seeing from both classified and unclassified sources, and we're making sure that those technologies are implemented on our servers.
4:05 p.m.
Liberal
Valerie Bradford Liberal Kitchener South—Hespeler, ON
Mr. Thompson, how does the Government of Canada ensure that cloud service providers meet the Government of Canada's security requirements?