I am not sure whether this will help you Chuck.
Protected Information - Information, which lies outside the national interest that may qualify for an exemption or exclusion under the Access to Information Act or Privacy Act and requires safeguarding. There are three categories of Protected information. The category is determined and marked based on the degree of potential injury if the information is compromised ("Protected A" - low; "Protected B" - medium; "Protected C" - high.)
Confidentiality - the attribute that information must not be disclosed to unauthorised individuals, because of the resulting injury to national or other interests, with reference to specific provisions of the Access to Information Act and the Privacy Act.
Classified Information:
All information whose compromise or unauthorized disclosure could reasonably be expected to cause injury to the national interest must be identified, with reference to specific provisions of the Access to Information Act and the Privacy Act, by the author when created or collected. The appropriate category is determined based on the degree of potential injury: ("Confidential"- injury; "Secret" - serious injury; "Top Secret" - exceptionally grave injury.")
8. Protected Information:
All information whose compromise or unauthorized disclosure could reasonably be expected to cause injury to private, business and other non-national interests must be identified, with reference to specific provisions of the Access to Information Act and the Privacy Act, by the author when created or collected, and marked in accordance with details in Appendix A. The appropriate category is determined based on the degree of potential injury: ("Protected A" - low degree of potential injury; "Protected B," considered particularly sensitive, - where the degree of potential injury is medium; "Protected C," considered extremely sensitive - where the degree of potential injury is high.)
9. All classified or protected information must be declassified or downgraded when the respective level of protection is no longer necessary.
10. Only employees with the appropriate security screening level and a demonstrated need to know the information to perform their assigned duties are allowed access to classified and protected information and assets.
11. Other assets, especially those required to perform critical functions or provide critical services, must be identified and categorised based on the degree of injury (low, medium, high) that could reasonably be expected to result from compromise to their availability or integrity. Their value (e.g. monetary, cultural) must be considered in determining injury.
12. To the extent necessary, access to other assets requiring additional safeguarding for availability or integrity purposes will be limited to ensure that no one individual can independently control all aspects of a process or a system.
13. When Government of Canada or Agency information or assets will be shared with other government, foreign, international or private organizations, the Security, Risk Management and Internal Affairs Directorate must be consulted to ensure that appropriate security requirements for their protection are in place. Terms and conditions of Memoranda of Understanding or other sharing agreements must stipulate specific security responsibilities, safeguards, procedures and the security of methods by which the sharing will be carried out.
John
John A. Gervais
Program Manager
Policy and Guidelines Section
Information Policy and Governance Division
Statistics and Information Management Directorate
Corporate Strategies and Business Development Branch
Canada Revenue Agency
320 Queen St., Place de Ville, Tower A, 6th Fl.,
Ottawa, ON, Canada, K1A 0L5
Tel: 1-613-946-0245
Facsimile: 1-613-941-9649
E-mail: mailto:[log in to unmask]
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
|
