Annex C: Guidelines for safeguarding information and assets

A. Records office security

For protected and classified information and assets, registries, or parts of it, must follow these procedures:

• be managed according to the highest security category of information being stored
• ensure records employees hold the appropriate security status or clearance
• file and circulate information in file jackets that indicate the contents and are marked according to the highest security category of information kept in it
• manage areas where mail is opened as a security zone or high-security zone
• limit the release of files to employees with the appropriate level of security status or clearance and a need-to-know
• identify personnel with authorized access on an access list approved by the responsible manager (such as the project manager)
• deliver mail marked "to be opened only by the addressee" to the intended recipient directly
• ensure classified mail is opened only by the appointed authority within the facility responsible for its registration
• protect foreign classified information in the same way as Canadian information of equivalent classification and store in a separate container. Contact PSPC’s CSP for further advice and assistance by email at tpsgc.dgsssiprojetintl-dobissintlproject.pwgsc@tpsgc-pwgsc.gc.ca
• implement special precautions to prevent unauthorized disclosure or access to non-Canadian nationals. Foreign classified information and information with restrictive markings such as “for Canadian eyes only” cannot be released to such persons without approval of PSPC’s CSP
• Contact PSPC’s CSP by email at tpsgc.dgsssiprojetintl-dobissintlproject.pwgsc@tpsgc-pwgsc.gc.ca for assistance on any further restrictions regarding international and multinational contracts, programs or projects

A. Protected and classified information

The following markings must be used for original documents and copies:

• Protected A, B, or C must be written in the upper right corner of the face of the document
• Confidential must be written in the upper right corner of the face of the document. Number each copy, show the copy number on the face of each copy, and maintain a distribution list
• Secret must be written in the upper right corner of each document page. Number each copy, show the copy number on the face of each copy and maintain a distribution list
• Top Secret must be written in the upper right corner of each page and show the total number of pages on all pages (for example, page 2 of 10). Assign a unique whole number to each copy, mark the copy number on each page and maintain a distribution list
• Foreign government, European Union (EU), European Space Agency (ESA), North Atlantic Treaty Organization (NATO) Classified information must be marked with both the foreign classification marking and the annotation to be treated as its Canadian equivalent. More information can be found in Chapter 9: International security of this manual and by contacting PSPC’s CSP by email at dgsssiprojetintl-dobissintlproject@tpsgc-pwgsc.gc.ca.

B. Microforms

Microform is a generic term for any storage medium that contains micro-images. Organizations must implement the following procedures:

• Assign the highest designation or categorization of the information contained on the microform
• Mark protected or classified on microforms containing protected or classified information in eye-readable form, with the microform number and the total number of microforms

C. Electronic storage material

Electronic storage material includes items such as CDs, USB drives, removable hard drives, SD cards, microSD cards, phones, tablets, laptops.

Organizations must implement the following procedures:

• Assign the highest designation or categorization of the information contained on the electronic storage material
• Where possible, the security marking should be in both eye-readable and machine-readable form. If this is not possible, the security marking should be machine-readable
• Removable storage material should bear standard labels. Where bypass label processing is allowed, procedures are needed to ensure that the proper item is loaded into the computer
• Store material in the same manner as paper documents, when not in use

Refer to Chapter 7: Information technology security of this manual for further information.

PSPC’s CSP can provide specific advice on how to mark various forms of electronic storage material by email at ssi-iss@tpsgc-pwgsc.gc.ca.

A. Keys for containers

Keys (devices such as cards, combinations and code numbers used to open and close containers) must be safeguarded at the highest security category of the information or assets to which they provide access. This also applies to recorded information that would allow a key to be produced. The company security officer (CSO) must control access to keys, combinations and code numbers, and keep distribution records.

Assigned keys should be changed at least every 12 months and when those with access to the container are transferred, released or no longer require access. The organization's security office must maintain a record of the dates of, and reasons for, all key changes.

B. Precautions

When protected and classified information and assets are removed from approved storage containers, organizations must ensure that they are not left unattended and that they cannot be viewed, or a discussion of it overheard, by persons not possessing the appropriate level of personnel security clearance or without a need-to-know.

For further advice and assistance, contact PSPC’s CSP by email at tpsgc.ssidie-issiid.pwgsc@tpsgc-pwgsc.gc.ca.

C. Equipment

Organizations required to store protected and classified information and assets are permitted to purchase approved security equipment through PSPC. In consultation with PSPC’s CSP, the CSO or Alternate Company Security Officer (ACSO) should determine the required equipment and submit the equipment purchase form. After PSPC’s CSP endorses the request, it will be processed, however, the invoicing and delivery for the equipment is between the purchaser (the CSO) and the supplier. Examples of the most requested equipment available through this procedure are: