Cyber security directives

This directive establishes standardized access control requirements for government information systems.

This directive ensures a measurable approach to awareness and training is in place so that users have the skills and knowledge required to use government information systems in a secure and responsible manner.

This directive establishes the foundation for auditing and accountability practices that support incident detection, forensic analysis, policy compliance, and risk management across the organization.

This directive establishes the foundation for managing system‑level cybersecurity risk and ensures that systems operate only with approved, documented authorization.

The objective of the Configuration Management Directive is to ensure that all existing and future systems and components have a standardized secure configuration; a security impact analysis is included and recorded as validation.

The Contingency Planning Directive ensures the continued availability of essential services and the protection of organizational information and technology assets during disruptive events.

The Identification Authentication Directive establishes the foundational governance necessary to verify identity, prevent unauthorized access, and protect organizational systems and information.

The Incident Response Directive ensures that cybersecurity incidents are detected, reported, analyzed, contained, eradicated, and recovered from in a timely and coordinated manner.

The Maintenance Directive ensures that maintenance activities are performed securely, authorized appropriately, and controlled to protect the confidentiality, integrity, and availability of organizational information systems.

Government shall establish, implement, and maintain a formal Media Protection Directive to ensure that organizational information stored on any form of media is properly protected throughout its lifecycle.

The Physical Environment Protection directive ensures that a standardized approach is used for physical and environmental protection within government to limit physical access to information systems, equipment, and support infrastructure.

The Planning Directive concerns the creation and lifecycle management of a cyber security policy and supporting instruments for effective risk management, legal compliance, value, and appropriate protection of government and citizens’ information.

The Information Security Program Plan directive ensures the overarching governance framework for the Government of New Brunswick (GNB) Cyber Security Program.

Ensures that individuals accessing GNB information systems and facilities are properly vetted, trusted, and managed throughout their employment or engagement.

The Risk Assessment Directive ensures that a standardized approach is used for cyber security risk management on government information systems and assets.

The System and Services Acquisition Directive ensures that that systems and services meet organizational security needs, comply with applicable policies and regulations, and support secure, reliable, and resilient operations.

The Systems and Communications Protection Directive ensures that information systems and communications channels are protected against unauthorized access, data leakage, manipulation, and disruption.

The System and Information Integrity Directive ensures government shall establish a directive to ensure that organizational information systems are protected from unauthorized changes and malicious activity.

Whenever corporately owned or managed mobile devices are used for business purposes technical and administrative controls will be enforced to protect government data.

All users enrolled in the company’s Bring Your Own Device (BYOD) program must sign an agreement that the company has the authority to impose restrictions and require inspections as noted.

Employees in all parts of government who travel outside the workplace are responsible for safeguarding assigned government technology devices and information.

All users must restrict their use of government information technology systems to those activities deemed acceptable by management, which are those broadly defined as business use to further the interests of government.

Minimizing the risk of data corruption or loss.

The organization will control access to information systems and data, including any host computer, network server, networked personal computer and mobile device, by implementing password management policies and procedures.

Prohibitions on users of company-provided email.

Minimizing the risks to government and its information technology (IT) systems and networks from making Internet access available to IT users.

Users must lock computer screens when devices are unattended.

Use of company-approved removable data storage devices.

Security measures for government-owned portable computers off government premises or storing government-sensitive data.

Users who need remote access must have management approval to connect to the company’s IT facilities from an offsite location.

Preventing unauthorized access to confidential information and presenting a positive corporate image.