Public Accounts committee  Well, Mr. Chair, I cannot really comment on the decision to use these words or not. I would say that you're probably right in your allusion that the potential in the future is more important than what we have done so far and in the past, but if we don't take the steps now.... Changing these clauses and including these means that my team—and Costas was part of that—is engaging with the industry on how we can do this and getting their views about how this could work, because we do not want to invent requirements and clauses that will not work for them, that cannot be built and that cannot be met in the future.

Public Accounts committee  Okay.

Public Accounts committee  It would have been my predecessor, Mr. Chair, saying that, but that is right.

Public Accounts committee  This is a question that would probably be better addressed by the Canada Revenue Agency. I have to say that digital enablement is essential. In this day and age, if we want to provide agile services and deal with peak demand, we have to be digital. We have to ride the right infrastructure.

Public Accounts committee  Someone was saying, “Who's first?” In fact, it's a team sport here, and sometimes with a team, there isn't a first. However, there is a primary role for looking forward and identifying what new issues can be—which we have to prepare for, work on and anticipate—and this belongs to the Canadian Centre for Cyber Security.

Public Accounts committee  Mr. Chair, that applies only to the establishment of the cloud framework agreement, where we have eight qualified vendors. We had asked initially when they were qualified—among many things we were validating—what their environmental commitment was and if they had a net-zero commitment towards 2050.

Public Accounts committee  Mr. Chair, it would be a great pleasure to respond to this.

Public Accounts committee  Maybe I can start. This is a statement that is true in Canada. It's true everywhere in the world. It's just a pure fact that when you are in a digital world, everything is always at risk. We need to start from there. Otherwise, we won't be doing our job. I think in Canada, for the Government of Canada, we have an infrastructure that can stand a lot.

Public Accounts committee  Exactly. I think it's the departure point of all work. If we work with too much security, believing we have everything in place and there will not be risk, we will be surprised pretty quickly, because the threat actors are very creative. This is where the Canadian security establishment and the cybersecurity centre are bringing us the intelligence and the signal for what we need to prepare next all the time.

Public Accounts committee  If I can, Mr. Chair, digital is not an option. It's where we host that data, whether it's a data centre that is controlled by the Government of Canada, or it's the cloud, or in between. The reality is, a lot of the work we are going to do going forward will be hybrid. We are going to leverage traditional data centres for some aspects of the business or the process, and we are going to leverage the cloud for some other aspects.

Public Accounts committee  Thank you, Mr. Chair, for the question. That is a very good one. We are using the cloud as a commercial solution. Catherine mentioned the name “hyperscaler”, which offers cloud. When they have been certified and we have approved utilization, they are integrated into our network.

Public Accounts committee  Mr. Chair, I think the member of Parliament is referring here to the automation of guardrails verification. We'll have to find a way to share that with you. What it is, basically, is that right now there are 12 guardrails. My team, following the wise advice from the Auditor General, has taken to checking not only once at the beginning but on an ongoing basis that these guardrails are maintained.

Public Accounts committee  Thank you, Mr. Chair, for the question. This is a product that we are working on with multiple departments. We're under the leadership of the Treasury Board Secretariat. There is nothing to hide. It's something that we'll share with the departments because it's a tool, so I assume that we will be able to share it with this committee when the product is ready for distribution.

Public Accounts committee  What I know about that—and maybe our colleagues from the Centre for Cyber Security will have views—is that we often compare our practice here in Canada to the standards of the Americans on cybersecurity. We do comparisons, but again, I'm not sure we have a report that will do a broader scan.

Public Accounts committee  Yes.