What do you want to do with this information?
— Protected A

Avoid using speakerphone when discussing sensitive information; use earbuds or headsets to prevent an unauthorized disclosure of the discussion.

Ensure that any work that includes the discussion of sensitive information, over the phone, is conducted in such a way as to prevent the mention of this information within hearing distances of others and/or any virtual assistant recording devices (e.g. Siri, Google Home, Amazon Alexa, etc.) as this could result in a security incident and/or possible privacy breach. Some examples include, but are not limited to, personal information such as names, dates of birth, or business information such as contracts, standing offers, etc.

Use Video Conferencing Systems securely when discussing sensitive information; use earbuds or headsets to prevent an unauthorized disclosure of the discussion.

Ensure that any work that is carried out by videoconferencing including discussions and/or visual displays of sensitive information/assets, is conducted in such a way as to prevent the mention of this information within hearing distance of others, and/or any virtual assistant recording devices (e.g. Siri, Google Home, Amazon Alexa, etc.) as well as a visual display of this information, as this could result in a security incident and/or possible privacy breach. Some examples include, but are not limited to, personal information such as names, dates of birth, or business information such as contracts, standing offers, etc.

Top right-hand corner of first page.

Protected A information can be sent through departmental E-Mail system to internal or external parties (Federal Departments/Agencies, provincial Governments or third party private sectors contracted by the department). Skype for Business can be used for internal transmission.

By Mail In Canada

---

By Mail Outside Canada:

A commercial regular fax can be used to send Protected A information within an Operation Zone.

Definition: An Operation Zone is an area where access is limited to personnel who work there and properly escorted visitors. As for example: Typical open office area.

Transport In Canada

Transport by hand inside the department

Within restricted areas (Operation zone, Security zone, High Security zone):

Protected A information must be transported in a Protected A blue folder or a single sealed envelope with no security markings and appropriately addressed. Commercial briefcase, approved backpack, approved bags (with Arcolock-7) or secured briefcase can replace the envelope. These carrying cases must have departmental-issued tags attached.

In

Or

Or

Or

Or

Or

Transport In Canada

Transport by hand inside the department

Outside restricted areas (Reception zone or Public zone):

Protected A information must be transported in a blue folder inserted in a single sealed envelope with no security markings and appropriately addressed. Commercial briefcase, approved backpack, approved bags (with Arcolock-7) or secure briefcase can replace the envelope. These carrying cases must have departmental-issued tags attached.

In

In

Or

Or

Or

Electronic format:

Encrypted USB keys and encrypted portable drives issued by the department can be used if permission is granted.

Transport In Canada

Transport outside department – In Canada

Protected A information must be transported in a single sealed envelope with no security markings and appropriately addressed. Commercial briefcase, approved backpack, approved bags (with Arcolock-7) or secure briefcase can replace the envelope. These carrying cases must have departmental-issued tags attached.

If traveling by personal motor vehicle, you must place Protected A information in an approved carrying case and lock it in the trunk or out of sight in a locked vehicle. Placement of the approved case is temporary and must be removed at destination. Stopovers are not permitted but if you require a stopover for an urgent matter, the case cannot be left unattended in the vehicle and must be in your possession at all times.

Electronic format:

Encrypted USB keys and encrypted portable drives issued by the department can be used if permission is granted.

Transport Outside Canada

Transport outside department - Outside Canada

Protected A information must be transported in a single sealed envelope with no security markings and appropriately addressed. Commercial briefcase and secure briefcase can be used as an enhanced security measure. The use of the approved backpack or approved bags are not allowed outside Canada. These carrying cases must have departmental-issued tags attached.

If traveling by personal motor vehicle, you must place Protected A information in an approved carrying case and lock it in the trunk or out of sight in a locked vehicle. Placement of the approved case is temporary and must be removed at destination. Stopovers are not permitted but if you require a stopover for an urgent matter, the case cannot be left unattended in the vehicle and must be in your possession at all times.

Electronic format:

Encrypted USB keys and encrypted portable drives issued by the department can be used if permission is granted.

Electronic Storage

Electronic copy: Protected A electronic information can be stored on the network drive or on a Departmental approved encrypted USB storage device and must be stored in an approved security cabinet. Electronic information cannot be stored on the hard drive of a laptop.

Note: The information must be transported, transmitted and stored in the same way as the paper information, depending on its sensitivity level. The following cabinets and containers are approved.

Protected A information need to be inserted inside a blue file folder, properly marked and secured in locked cabinet or Open Shelving room in an Operations Zone (see definition below) which implies a work area where workers have a common need-to-know, visitors are properly escorted.

Adequate lock-up storage safeguards within an Operations Zone for Protected A depend on the monitoring and response characteristics of the environment, as well as on the difficulty for an adversary to access the documents. All lockable commercial office furniture, commercial door locks and mobile shelving units are suitable for this application; however bulk (mobile) shelving units are subject to conditions.

Please note that many commercial workstations are sold with low security cam locks with similar or identical keying. In an open office environment this could give some employees access to the desks or containers of other workers in the office. As people move from one location to another, keys tend to be acquired and kept, which may create an opportunity for inappropriate access. Care should be taken to ensure this situation does not arise in the workspace.

Electronic copy:

Store on network drive or department-approved and issued USB storage device in locked cabinet.

Definition:

An Operation Zone is an area where access is limited to personnel who work there and properly escorted visitors. As for example: Typical open office area.

These are the approved secure cabinets that can be used with their respective locking mechanisms.

High density (Mobile) Shelving

Specially modified commercial mobile shelving equipped with additional components for each carriage set ( Hasp, padlock, side astragals, perforated top astragal and backing plate) are approved for the storage of Protected A information if secured with a SEG padlock or commercial padlock meeting ASTM F883-04 in an Operation Zone. Please note there is a fire safety requirement that mobile shelving units maintain at least a 100mm separation between sections when closed. As part of his oversight role, The Chief Security Officer (CSO) must assess the security measures in place to ensure these meet the minimum Security Requirements and approve the security measures in place.

Note: For any additional information, please contact your Regional Security Office.

Preparation and processing: In a Reception Zone (Where the transition from a public zone to a restricted-access area is demarcated and controlled).

Every ESDC employee is responsible for ensuring the security of departmental information. Therefore, employees must use the "Secure Print (Print to PIN)" function for printing protected documents. When you select this function from your computer, the document will only start printing when you enter a passcode (PIN) at the printer, preventing others from viewing the document.

Tips for using Secure Print: If you have multiple documents to print and you cannot get to the printer right away, the Secure Print feature lets you send them to print all in one place. These will remain waiting to print, one after the other, in the order of sending, until you have entered your password. You only need to enter your password once and all pending documents will print. Note that documents that are not in print are deleted automatically at the end of each day, so that you will not have to worry about the information being compromised.

This security and protection of departmental information applies equally when scanning documents. Employees must scan and transmit protected documents through email while keeping with policies and directives.

Declassification is the decision, recorded in writing, of the originator of the protected or classified information or an officer authorized by the Deputy Minister to remove the categorization level of the document.

Downgrading is the decision, recorded in writing, of the originator of the protected or classified information or an officer authorized by the Deputy Minister to lower the categorization level of the document.

Information is to be identified as protected only for the period of time it requires safeguarding. After this period, the originator or the authorized officer is to have it declassified or downgraded, appropriately marked, and to inform all recipients of this action and its effective date. Whenever possible, originators are to provide, at the time the information is created or collected, a specific date or event at which time declassification or downgrading may occur.

As a minimum, an automatic expiry date of 10 years should apply to the categorization of most information; however, the automatic expiry date would not apply to information classified as Top Secret nor to information identified as particularly sensitive Protected B, (e.g. medical records) or extremely sensitive, Protected C, (e.g. witness protection information).

Type III destruction equipment is defined as shredders and disintegrators for paper and text based media that have been assessed as capable of reducing information classified Confidential and Protected B or lower to a size that, under the threat and risk conditions existing in urban Canada and with known reconstruction methodology, is deemed safe to dispose of or recycle as unclassified waste.

Approved Office Category Paper Shredders and Disintegrators Selection Guide

Classification	Type	Shred Size (Maximum)	Disintegrator Screen Size Footnote 3	Comments
Protected B (General office use) (where a TRA recommends the use of approved equipment)	Type IIIA	2mm x 15mm	10mm	See Note OneFootnote 1
Protected B (Bulk destruction) (where a TRA recommends the use of approved equipment)	Type IIIB	6mm x 50mm	13mm	Type IIIB equipment is approved for bulk destruction only and must not be used for periodic destruction.

RCMP Security Shredding Standards (Comparison relative to a 2 inch paper clip).

IT Media Devices

Optical: CD, DVD, Blu-Ray disks:

Cut or break optical disks into pieces and/or severely damage the information-bearing layer of the disc by scraping or scoring.

Solid –State Drives (SSD) and USB Flash Drives

Reduce or shred the device to pieces, each with maximum area < 40 mm² (1/4 x 1/4 inch).

Smartphones and Tablets

Destroy entire device or storage component to pieces < 40 mm² (1/4" x 1/4").

Destruction Facilities and Services

The RCMP Technical Security Branch has a Destruction Equipment Guide, which is a comprehensive and completely revised quide to the selection of destruction equipment and services. Please contact your local Regional Security Office RSO for guidance and details as Public Services and Procurement Canada (PSPC) need to be contacted for destruction service contracts or equipment purchases.