This publication is part of a series of guidelines published by the Cyber Centre under Cyber security and privacy risk management: A lifecycle approach. It provides a high-level description of the series which details a cyber security and privacy risk management process, including activities at the organizational and system levels. The guidelines have been developed to help organizations integrate cyber security and privacy considerations from the outset, embedding them into governance and system lifecycle activities instead of addressing them after deployment. Early consideration of cyber security and privacy supports greater predictability and cost-effectiveness and helps organizations avoid unforeseen issues that could disrupt the authorization process.
The new Cyber security and privacy risk management: A lifecycle approach replaces IT security risk management: A lifecycle approach (ITSG-33). This revision acknowledges the evolving security landscape, where the focus can no longer solely be limited to information technology (IT) security. It now addresses cyber security as a whole, including IT and operational technology (OT) systems as well as the growing importance of privacy in the security discussion.
Effective risk management requires clearly defined roles and responsibilities, integration with organizational governance processes, incorporation of cyber security and privacy considerations into system lifecycle and assessment activities as well as the selection and tailoring of appropriate controls and assurance activities.
To support these objectives, the series includes guidance on both organizational and system-level dimensions of cyber security and privacy risk management.
Organizational cyber security and privacy risk management activities (ITSP.10.036) focuses on risk management at the organizational level and establishes a structured approach for organizations to identify and understand the cyber security and privacy needs of their programs and services.
System lifecycle cyber security and privacy risk management activities (ITSP.10.037) extends this approach into the system lifecycle and integrates Security Assessment and Authorization (SA&A) into system engineering activities. It describes how cyber security and privacy considerations are embedded into technical lifecycle processes and introduces the concepts of robustness and security assurance requirements to support informed risk-based decisions.
The series is structured around a comprehensive catalogue of cyber security and privacy controls and assurance activities, which is set out in the Security and privacy controls and assurance activities catalogue (ITSP.10.033). Suggested organizational security and privacy control and activity profile - Medium impact (ITSP.10.033-01) provides a suggested medium-impact baseline profile that organizations can tailor to reflect their specific context. Finally, Assessment of security and privacy controls and assurance activities (ITSP.10.033-02) complements the aforementioned guidance by providing assessment practices to verify that controls and activities are appropriate to the system’s criticality and implemented with sufficient strength and assurance to address relevant threat actors. These assessment activities support authorization and provide a means to demonstrate compliance with applicable legal and contractual requirements.
Organizations that apply this series can expect significant benefits, including alignment with their overall risk management objectives, improved confidence in authorization decisions, structured and demonstrable assurance, and greater predictability and cost-effectiveness throughout the system lifecycle.
Table of contents
- 1. Introduction
- 2. Revision of the ITSG-33 series
- 3. Supporting cyber security and privacy risk management across the lifecycle
- 4. Benefits of using this series
List of Figures
List of Tables
1 Introduction
The Cyber security and privacy risk management: A lifecycle approach series provides a structured approach for organizations to integrate cyber security and privacy into governance and system lifecycle activities. This overview introduces the series by describing its context and purpose and outlining how it evolved from the former ITSG-33 series. It also explains how the guidance supports lifecycle cyber security and privacy risk management activities and highlights the benefits of adopting a lifecycle approach.
1.1 Context
Managing cyber security and privacy risks is a multifaceted process that requires the involvement of an entire organization, from the senior officials establishing organizational objectives to the individuals developing and operating systems that support organizational objectives.
Organizations depend on complex and interconnected digital systems to deliver programs and services. These systems introduce cyber security risks that may affect the confidentiality, integrity and availability of assets, and must be managed across their entire lifecycle. At the same time, the increasing digitization of services and the ubiquitous use of personal information further reinforce the need to integrate privacy into cyber security risk management.
Effective risk management requires integrating security and privacy considerations into governance processes and system engineering activities from the outset. Structured and repeatable approaches promote consistency and help ensure alignment with applicable legal and policy frameworks.
1.2 Purpose
This publication provides a high-level overview of the series, which can help organization implement a structured cyber security and privacy risk management approach. It explains how the publications in the series relate to one another and how organizations can use them.
The series provides a lifecycle-based approach to cyber security and privacy risk management. It helps organizations select, tailor, implement as well as assess controls and assurance activities. The process documented throughout the series provides a set of activities that can be fully integrated into an existing organizational security program as well as into a system lifecycle. This helps organizations manage risk consistently across the lifecycle.
The series addresses cyber security and privacy aspects of enterprise risk management. It does not provide guidance on broader enterprise risk domains that are not directly related to cyber security and privacy.
1.3 Target audience
This series is intended to serve a diverse audience, including:
- individuals with system-development responsibilities, including mission or business owners, program managers, system engineers, system security engineers, privacy practitioners, hardware and software developers, system integrators and acquisition or procurement officials or executives
- individuals with logistical or disposition-related responsibilities, including program managers, procurement officials or executives, system integrators and property managers
- individuals with security and privacy implementation and operations responsibilities, including mission or business owners, system owners, information custodians, system administrators, continuity planners and system security or privacy officers
- individuals with security and privacy assessment and monitoring responsibilities, including auditors, system evaluators, control assessors, independent verifiers and validators and analysts
- commercial entities, including industry partners, that produce component products and systems, create security and privacy technologies, or provide services or capabilities that support cyber security or privacy
In the Government of Canada (GC), this publication is intended for the audience above, as well as for individuals who support departmental cyber security and privacy risk management activities, such as:
- individuals with system, information security, privacy, or risk management and oversight responsibilities, including authorizing officials, chief information officers (CIOs), chief security officers (CSOs), senior officials in the department’s security governance, designated officials for cyber security and appropriate privacy officials or executives
- individuals who participate in the definition, design, development, installation and operation of information systems; more specifically, authorizers, project managers, cyber security architects, cyber security engineers, cyber security assessors and members of cyber security operations groups
1.4 Publication taxonomy
This publication is part of a series of guidelines that fall under Cyber security and privacy risk management: A lifecycle approach. The documents in the series are as follows:
- Overview, Cyber security and privacy risk management: A lifecycle approach (ITSP.10.035)
- Organizational cyber security and privacy risk management activities (ITSP.10.036)
- System lifecycle cyber security and privacy risk management activities (ITSP.10.037)
- Security and privacy controls and assurance activities catalogue (ITSP.10.033)
- Suggested organizational security and privacy control and activity profile — Medium impact (ITSP.10.033-01)
- Assessment of security and privacy controls and assurance activities (ITSP.10.033-02)
- Calculating robustness for boundary controls (ITSP.10.032)
2 Revision of the ITSG-33 series
The Cyber Centre revised the ITSG-33 series in response to the expanding scope of digital risk and increasing interdependence between cyber security and privacy. Increased system connectivity and evolving legal and policy requirements have required a more integrated framework. The update aligns the guidance with contemporary engineering and governance practices and broadens its applicability across a wider range of organizations and contexts.
2.1 Scope
The Cyber security and privacy risk management: A lifecycle approach expands the ITSG-33 series’ scope beyond traditional IT security by addressing cyber security across IT and OT environments and integrating privacy as a core component of risk management.
The revised series also has broader applicability. It was originally developed for GC departments and agencies, but the guidance now supports organizations at all levels of government, industry sectors including critical infrastructure (CI), organizations of any size, and academia.
2.2 New structure
The new iteration of the framework contains an important structural change. The former annexes are now standalone documents. Table 1 below presents the new breakdown of the various publications.
| ITSG-33 | Cyber security and privacy risk management: A lifecycle approach |
|---|---|
| Overview | Overview, Cyber security and privacy risk management: A lifecycle approach (ITSP.10.035) |
| Annex 1 | Organizational cyber security and privacy risk management activities (ITSP.10.036) |
| Annex 2 | System lifecycle cyber security and privacy risk management activities (ITSP.10.037) |
| Annex 3A | Security and privacy controls and assurance activities catalogue (ITSP.10.033) |
| Annex 4 | Suggested organizational security and privacy control and activity profile—Medium impact (ITSP.10.033-01) |
| New | Assessment of security and privacy controls and assurance activities (ITSP.10.033-02) |
| New to the series | Calculating robustness for boundary controls (ITSP.10.032) |
2.3 Privacy
Cyber security risk management overlaps with privacy risk management as data containing personal information is increasingly present in information systems throughout the data lifecycle. Privacy breaches can arise from cyber security incidents when there is a loss of confidentiality or integrity during data processing. The publications in the series address privacy risks related exclusively to cyber systems.
The Security and privacy controls and assurance activities catalogue (ITSP.10.033) now includes privacy controls and activities to ensure that organizations and government institutions protect and manage personal information. These additions help identify, assess, monitor and mitigate compliance gaps in programs and activities involving the collection, creation, retention, use, disclosure and disposal of personal information. Additionally, they aim to ensure that privacy is architected and then engineered into the design and operation of information systems.
3 Supporting cyber security and privacy risk management across the lifecycle
Cyber security risk management is achieved through the management and implementation of security controls, assurance activities, tools and techniques to protect assets against identified threats. In applying cyber security and privacy risk management, organizations should ensure that the implementation of security and privacy controls and activities reduces risks to acceptable residual levels consistent with their organizational mission, objectives and priorities.
The Cyber security and privacy risk management: A lifecycle approach series presents a set of activities at both the organizational and system levels. At the organizational level, these activities are integrated into business functions to help organizations manage cyber security and privacy risks and ensure the incorporation of these considerations throughout the organization.
At the system level, these activities are integrated into a system lifecycle to ensure that the cyber security and privacy needs of supported organizational functions are met and that appropriate security and privacy controls and assurance activities are implemented and operating as intended. They further ensure that continued performance of the implemented controls and activities is assessed, reported back and acted upon to address any issues.
Long description – Figure 1: Cyber security and privacy risk management process
This figure describes the high-level organizational cyber security and privacy risk management activities. The figure also describes the system lifecycle cyber security and privacy risk management activities within projects and operational groups. It highlights how the cyber security and privacy risk management activities at both levels act together in a continuous cycle to efficiently maintain and improve the security posture of organizational systems.
The Organizational cyber security and privacy risk management activities are intended for organizational cyber security and privacy authorities and encompass the following steps:
- Define the organizational cyber security and privacy needs
- Submits organizational cyber security threat assessment report to Projects and operational groups in charge of system lifecycle cyber security and privacy risk management activities
- Develop organizational security and privacy control and activity profiles
- Disseminated approved organizational security and privacy control and activity profiles
- Allocate security and privacy controls and activities
- Lists of controls and activities allocations (common, hybrid, system-specific) are submitted to Projects and operational groups in charge of system lifecycle cyber security and privacy risk management activities
- Monitor and assess performance of security and privacy controls and activities
- Maintain authorization
- Update security and privacy control and activity profile(s)
- Then return to step 2, Develop organizational security and privacy control and activity profiles
The System lifecycle cyber security and privacy risk management activities enacted by projects and operational groups are aimed at project managers, security and privacy architects, assessors and engineers, and developers, among others. They encompass the following steps:
- Concept: Define system cyber security and privacy needs
- Development: Architect and design secure systems
- Production: Implement, integrate, verify and validate secure systems
- Operations and support: Operate, monitor and maintain secure systems
- Submit Cyber security and privacy performance feedback to Organizational cyber security and privacy authorities to inform step 4, Monitor and assess performance of security and privacy controls and activities
- Retirement: Securely dispose of assets at retirement
3.1 Lifecycle risk management activities
The series provides guidance for activities that support cyber security and privacy risk management at the organizational level, throughout the system lifecycle.
Organizational cyber security and privacy risk management activities (ITSP.10.036) focuses on risk management at the organizational level. It provides guidance to help organizations:
- understand their business context as well as their security and privacy needs
- perform injury assessment and categorization as well as threat and risk assessments
- develop baseline profiles
- allocate security as well as privacy controls and activities
It also describes activities related to the continuous improvement of the organization’s cyber security and privacy posture such as controls and activities, monitoring and assessment, maintaining authorization and updating profiles.
System lifecycle cyber security and privacy risk management activities (ITSP.10.037) extends risk management into the system lifecycle. It provides guidance on integrating cyber security and privacy considerations into the system lifecycle processes, aligned with ISO/IEC/IEEE 15288:2023 Systems and software engineering – System life cycle processes and with NIST SP 800-160 Vol. 1 Rev. 1 Engineering Trustworthy Secure Systems. These guidelines suggest cyber security risk management activities to design, implement, operate and maintain dependable systems, and they incorporate SA&A activities.
3.2 Controls and assurance activities
The lifecycle risk management activities described in this series leverage a set of controls and assurance activities as well as a baseline profile. These resources offer a common foundation that supports the consistent selection, allocation, tailoring, implementation, and assessment of controls and activities across organizations and systems.
Security and privacy controls and assurance activities catalogue (ITSP.10.033) presents a set of security and privacy controls and assurance activities that organizations can use to support cyber security and privacy risk management. It can serve as a foundation for selecting and tailoring controls and activities to meet organizational and system-specific needs. From an organizational perspective, security and privacy practitioners can use this catalogue to select common controls and activities that should be part of the overall organizational baseline profile. The organization-defined parameters (ODPs) are used to refine the organizationally mandated controls and activities to fit the system’s specific security and privacy needs.
Suggested organizational security and privacy control and activity profile — Medium impact (ITSP.10.033-01) provides a suggested starting point for control and activity selection. It presents a baseline profile to support organizations in developing tailored profiles that reflect their business context and risk environment and tolerance. This baseline is meant to be adapted and refined as part of the risk management process to create organization-specific profiles. When properly implemented, these profiles must be suitable for protecting the confidentiality, integrity and availability of organizational assets against identified threats that could cause injury to business activities.
Assessment of security and privacy controls and assurance activities (ITSP.10.033-02) provides guidance on assessing the effectiveness of security and privacy controls and assurance activities. It supports authorization decisions and enables continuous monitoring and improvement by helping organizations determine whether implemented controls and activities are operating as intended and managing risk appropriately.
Calculating robustness for boundary controls (ITSP.10.032) presents criteria for selecting both the assurance and strength-of-mechanism requirements of cryptographic, authentication and cross-domain security mechanisms. It also provides guidance on determining robustness for physical and personnel security controls.
4 Benefits of using this series
The various publications in this series are intended to be used together to support a consistent and lifecycle-based approach to cyber security and privacy risk management. They are designed to be adaptable and can be applied in a variety of organizational and system contexts. Organizations can apply the guidance to:
- establish new programs
- improve existing practices
- support system development and operations
- prepare for assessment and authorization activities
By leveraging the process defined within the Cyber security and privacy risk management: A lifecycle approach series, organizations will be able to implement a consistent and structured approach to cyber security and privacy risk management. The benefits of this approach include:
- ensuring consistent and cost-effective management of cyber security and privacy risks
- increasing security maturity
- improving communication among all security and privacy stakeholders by using a common terminology
- considering business owners’ (authorizers) requirements at the organizational level, during the development of threat assessments, control and activity requirements as well as during the implementation of systems
- integrating cyber security and privacy considerations within a unified risk management framework
- promoting accountability and clear roles and responsibilities across governance and implementation functions
- describing a common set of controls and assurance activities to support consistent selection, allocation, tailoring and implementation
- enabling informed authorization decisions through structured and repeatable assessment and assurance activities
- supporting continuous monitoring and improvement of an organization's cyber security and privacy posture
- enhancing transparency and comparability across programs, services and systems
GC-specific note
The publications support alignment with GC legislation, policies, directives, Orders in Council and standards.
By adhering to this process, GC departments and agencies are aligning with the overall risk management strategy and objectives established by the Treasury Board of Canada Secretariat (TBS). This includes implementing key policy requirements on cyber security and privacy risk management.
Effective date
This publication takes effect on October 29, 2026.
The Overview – Cyber security and privacy risk management: A lifecycle approach is an unclassified publication issued under the authority of the Head, Canadian Centre for Cyber Security (Cyber Centre).
This publication supersedes the Overview to IT security risk management: A lifecycle approach (ITSG-33).
For more information or to suggest amendments, contact the Cyber Centre:
- by email: contact@cyber.gc.ca
- by phone: 613-949-7048 or 1-833-CYBER-88 (1-833-292-3788) (toll-free)
Revision history
- First draft: October 29, 2026