Full Report
The Canadian government’s security guidance for cloud environments outlines a standardized set of security controls to protect data and workloads in the cloud. The security guidance, known as the Security Control Profile for Cloud-based GC Services, also outlines security controls and profiles from a different publication, the IT Security Risk Management: A Lifecycle Approach (ITSG-33). The ITSG-33 publication has made Protected B Medium Integrity Medium Availability (PBMM) a key compliance measure for the Canadian government and crown corporations. As part of our commitment to serving the Canadian government with the security capabilities and controls they need, we’ve developed a set of open-source recommendations that map Google Cloud capabilities and security settings to Canadian Protected B regulatory requirements to help our customers place their sensitive data in the cloud. With the Google Cloud landing zones, we’re helping to ensure Canada has the easy-to-administrate, cost-effective, and more secure cloud environment needed for your biggest projects.Cloud environments built for CanadaGoogle Cloud’s Protected B landing zones are a set of codified recommendations focused on establishing Google Cloud projects, Identity Access Management (IAM), networking, naming schemes, and security settings in line with regulatory requirements and best practices. Using these as a baseline, Canadian public sector customers are better positioned to quickly meet their compliance requirements.Google Cloud has published a Terraform-based Infrastructure-as-Code (IaC) template on Github to ensure the foundational settings, policies, and folder structures are correctly configured in alignment with the Annex 4A - Profile 1 (PBMM and ITSG-33).Codified, built-in securityLanding zones enable a secure environment that is quick to deploy, easy to administer, and provides cost savings for organizations. To make our templates easily understandable, we’ve selected the open-source infrastructure-agnostic IaC tooling provided by HashiCorp’s Terraform. Terraform gives organizations the flexibility to adopt a DevSecOps methodology within their infrastructure. It also provides a security foundation by allowing the IaC to be modified, versioned, change controlled, and automatically provisioned. The template and instructions on how to use landing zones can be found on GitHub.Included security controlsThere are effectively three different types of security controls described in ITSG-33 documentation:Technical security controls implemented using technology, such as firewalls.Operational security controls implemented using human processes, such as manual procedures.Management security controls focused on the management of IT security and IT security risks.Within the landing zone template, we’ve focused on controls that can be represented via code. Addressed controls fall into these primary families:Access Control (AC)Audit and Accountability (AU)Configuration Management (CM)Contingency Planning (CP)Identification and Authentication (IA)Risk Assessment (RA)System and Services Acquisition (SA)System and Communications Protection (SC)System and Information Integrity (SI)How it worksThe landing zone deployment phases To deploy the landing zone, a user with Organizational Administrator privileges will need access to a shell terminal with the Google Cloud (gcloud) CLI, JSON Query (jq) and Terraform installed (which can be done in Google Cloud’s integrated terminal, Cloud Shell). As part of the initial bootstrap script, a single project will be created. This Google Cloud project will be used to set up the landing zone core infrastructure, network infrastructure, automated pipeline, code repository, logging and bunkering aggregation capabilities, and security policies via infrastructure as code automation. After deployment completes, workloads can be deployed in alignment with IT and regulatory policies. This can include leveraging the Cloud Build & Cloud Source Repo (CICD) pipeline established as part of the landing zone bootstrapping.Several Terraform modules are used to establish the required controls for meeting PBMM requirements: Landing Zone Modules The landing zone can be applied with either a Google Cloud organizational node (default and illustrated below), or with a folder as the root node of the landing zone. Organizational Structure How to deploy itHave a shell environment with the required prerequisites installed (Cloud Shell can be used for this)Clone repo from https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding Update the relevant .auto.tfvars files as indicated in the README.MD file within the repoFrom bash, run the bootstrap.sh script from the environments/bootstrap/ directory. The script will prompt for the domain and user that will be deploying the bootstrap resources.Committed to serving CanadaOur landing zone template extends upon our existing 30-day Guardrails created to meet Canadian Centre for Cyber Security requirements, allowing organizations to have a compliant landing area for production workloads quickly. Visit the Terraform-based Infrastructure-as-Code (IaC) template on GitHub for more detailed deployment instructions and to learn more about meeting CCCS requirements. References:Government of Canada Levels of securityGovernment of Canada Security Control Profile for Cloud-based GC servicesIT Security Risk Management Lifecycle Approach (ITSG-33)Annex 4A - Profile 1 - (PROTECTED B / Medium Integrity / Medium Availability) (ITSG-33)Terraform.ioCloud-ready in Under 30 Days: accelerate safe and efficient Cloud onboarding with guardrails from Google CloudGC Cloud Guardrails Checks for Google Cloud Platform (GitHub)PBMM on GCP Onboarding (GitHub)
Analysis Summary
# Regulation/Compliance: Canadian PBMM (ITSG-33) for Cloud Services
## Overview
The Canadian government has established a standardized set of security controls for cloud environments to ensure the protection of sensitive data. Central to this is the **Protected B, Medium Integrity, Medium Availability (PBMM)** profile, which is part of the broader **ITSG-33** risk management framework. It defines the mandatory security posture for government departments and crown corporations handling sensitive information that, if compromised, could cause serious injury to individuals or government interests.
## Key Details
- **Issuing Authority:** Canadian Centre for Cyber Security (CCCS) / Government of Canada (GC)
- **Effective Date:** In Effect (Article dated April 2022)
- **Jurisdiction:** Canada (Federal Public Sector)
- **Status:** Final / In Effect
## Requirements
### Mandatory Requirements
1. **Alignment with ITSG-33:** Adherence to the IT Security Risk Management Lifecycle Approach.
2. **PBMM Compliance:** Implementation of the "Annex 4A - Profile 1" security controls (Protected B / Medium Integrity / Medium Availability).
3. **Data Localization/Protection:** Ensuring sensitive workloads are placed in cloud environments that meet GC-specific security control profiles.
4. **Security Control Families:** Implementation of controls across primary domains including Access Control (AC), Audit (AU), Configuration Management (CM), and System Integrity (SI).
### Recommended Practices
1. **Infrastructure as Code (IaC):** Use of codified templates (e.g., Terraform) to ensure repeatable, version-controlled security configurations.
2. **Landing Zones:** Deployment of pre-configured "Landing Zones" to establish foundational IAM, networking, and logging before deploying workloads.
3. **DevSecOps:** Integration of security into the CI/CD pipeline (e.g., using Cloud Build and Cloud Source Repos).
4. **30-Day Guardrails:** Rapid adoption of CCCS-prescribed guardrails for initial onboarding.
## Affected Organizations
- **Industries:** Public Sector, Government Departments, and Crown Corporations.
- **Organization Size:** All sizes handling "Protected B" data.
- **Geographic Scope:** Canada (National).
## Compliance Timeline
- **April 2022:** Google Cloud released the Terraform-based PBMM Landing Zone to accelerate compliance.
- **Continuous:** Organizations must maintain alignment with ITSG-33 lifecycle updates.
- **Ongoing:** Security control profiles for cloud services are subject to periodic review by the CCCS.
## Implementation Guidance
### Assessment Phase
- Identify data sensitivity levels (e.g., Protected B vs. Protected A).
- Review current cloud architecture against the **Security Control Profile for Cloud-based GC Services**.
- Determine which ITSG-33 controls are currently met vs. gaps.
### Implementation Phase
- Deploy the **PBMM on GCP Landing Zone** via Terraform to establish a secure foundation.
- Configure organizational nodes, folders, and networking in alignment with Annex 4A.
- Use the `bootstrap.sh` script to automate core infrastructure setup (Logging, Bunkering, IAM).
### Validation Phase
- Leverage **GC Cloud Guardrails Checks** for Google Cloud (available on GitHub) to audit the environment.
- Verify technical controls through automated policy enforcement.
## Technical Requirements
- **Access Control (AC):** IAM policy enforcement and naming schemes.
- **System and Communications Protection (SC):** Firewalls and network segmentation.
- **Audit and Accountability (AU):** Centralized logging and bunkering aggregation capabilities.
- **Configuration Management (CM):** Infrastructure-as-Code versioning and change control.
- **Environment:** Requirement for Organizational Administrator privileges and gcloud CLI/Terraform tools.
## Penalties & Enforcement
- **Fines:** Not explicitly defined in this guidance; typically governed by the Financial Administration Act or specific department mandates.
- **Other Consequences:** Loss of Authority to Operate (ATO), data breaches involving sensitive citizen information, and reputational damage.
- **Enforcement:** Audits by the Canadian Centre for Cyber Security and Treasury Board of Canada Secretariat (TBS).
## Related Standards
- **ITSG-33:** The overarching lifecycle approach for IT security risk management in the GC.
- **Annex 4A - Profile 1:** The specific technical mapping for PBMM.
- **GC Cloud Guardrails:** Initial security requirements for onboarding cloud services.
## Resources
- **Official Documentation:** [ITSG-33 Guidance](https://cyber.gc.ca/en/guidance/it-security-risk-management-lifecycle-approach-itsg-33)
- **Guidance Documents:** [Security Control Profile for Cloud-based GC Services](https://www.canada.ca/en/government/system/digital-government/digital-government-innovations/cloud-services/government-canada-security-control-profile-cloud-based-it-services.html)
- **Tools:** [Google Cloud PBMM Onboarding GitHub](https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding)
## Practical Recommendations
1. **Adopt IaC:** Shift from manual console configuration to Terraform to minimize human error in security settings.
2. **Utilize Landing Zones:** Do not build from scratch; use the Google Cloud PBMM-codified recommendations as the baseline.
3. **Automate Auditing:** Integrate the GC Cloud Guardrails checks into your deployment pipeline to ensure continuous compliance.