MITS as a matter of trust

Canadians expect privacy and secure transactions when conducting their government business online.

Ensuring that the Government of Canada has a consistent approach to IT security helps build trust in the overall system. This approach must link together the various programs and efforts of federal agencies and departments under a single framework.

The federal government is taking some important steps to provide guidance in the IT security area with the Management of Information Technology Security (MITS) standard. MITS is an operational security standard spearheaded by Treasury Board Secretariat that identifies a minimum baseline standard of care for IT security.

With high-level accountability and established security guidelines in place under the MITS standard, more and more Canadians will feel comfortable using the Web to conduct their government business. The result will be simpler, safer and better access for citizens, as well as a secure IT environment for departmental interaction and consolidated service delivery.

Essentially, the MITS standard is an extension of the Government Security Policy (GSP) and the Policy on the Management of Government Information. MITS itself is complemented with other operational security standards, as well as more detailed technical documentation available from other key departments and agencies such as the Communications Security Establishment and the Royal Canadian Mounted Police.

In September, federal departments had to submit a progress report to Treasury Board - the agency that is overseeing policy implementation around MITS compliance. All federal departments and agencies must comply with MITS by the end of the year. Treasury Board and a number of private sector organizations are helping federal departments and agencies prepare to meet this deadline. Ultimately, deputy ministers are responsible for IT security within their own departments and agencies, in accordance with the GSP, and the MITS standard should be viewed as a tool to help meet this obligation.

The MITS standard identifies over 120 mandatory requirements, but to help IT managers and other key stakeholders understand where security needs to happen, the specifications can be encapsulated by 20 technology categories, such as document management, risk assessment, identity management, vulnerability identification, disaster recovery and failover, and incident management.

The government is working with its partners in industry to achieve compliance both in terms of mapping the requirements of MITS to practical solutions as well as incorporating the lessons learned in implementing similar standards elsewhere.

Operationally, the standard helps government departments and agencies take a more complete view of their IT systems and assists in identifying the people, processes and technologies required to provide security and management across the board. There is great emphasis on understanding the lifecycle of IT systems and technology and how the way they are used changes over time.

It should be noted that MITS compliance is an essential step in the right direction, but additional guidance is expected to be shared in the future. For example, Treasury Board is working with several key departments and agencies to develop a federal IT security strategy as part of an overall approach to making government a safer place to conduct business.

Many of the government bodies will likely go beyond the MITS standard to address the needs of their departments and the users and citizens they serve. As a result, all Canadians can be assured that when communicating across various systems that each group has achieved compliance.

The information security landscape is continually changing, so it is important that the associated guidelines be both flexible and extensible. This ensures that the most effective and up-to-date guidance is being disseminated to those who need it.

A key driver for the MITS standard is the way in which Canadians use technology to connect with the government. Compliancy will be fundamental in providing Canadians with confidence about how departments protect our privacy and provide us with a secure way to conduct business across the government.

Bruce Cowper is senior program manager for Microsoft Canada's security mobilization initiative. He can be reached at bruce.cowper@microsoft.com