Definitions
Risk
Potential adverse impact to an organization's operations, assets, or individuals resulting from a threat successfully exploiting a vulnerability.
Personally Identifiable Information
Personally Identifiable Information (PII) is any information that can be used to distinguish or trace an individual's identity.
Directive (PL-1 Planning)
GNB shall establish, implement, and maintain a formal planning directive to ensure that security considerations integrate into organizational planning activities, including strategic planning, enterprise architecture, system development, and lifecycle management.
Purpose
This directive establishes the foundational governance necessary to promote consistent, risk‑informed planning that embeds security into organizational strategies, investments, and system development activities.
The objective of the Planning Directive is the creation and lifecycle management of a Cybersecurity Policy and supporting directives, standards and Standard Operating Procedures that describe the security processes and controls to ensure:
- strategic alignment to the business of government
- effective management of Risks
- legality and compliance with existing legislation (i.e., Archives Act, Right to Information and Protection of Privacy Act)
- better value for information management and information technology investments
- appropriate protection of government and citizens’ information
