What do you want to do with this information?
— Protected C

Avoid using speakerphone when discussing sensitive information; use earbuds or headsets to prevent an unauthorized disclosure of the discussion.

Ensure that any work that includes the discussion of sensitive information, over the phone, is conducted in such a way as to prevent the mention of this information within hearing distances of others and/or virtual assistant recording devices (e.g. Siri, Google Home, Amazon Alexa, etc.) as this could result in a security incident and/or possible privacy breach. Some examples include, but are not limited to, personal information such as the names, dates of birth, social insurance numbers, addresses and/or phone numbers of persons who are at risk of threats to personal harm, or corporate business information such as, but not limited to, trade secrets, commercial information supplied by a third party, etc.

** Important Note: Videoconferencing Not Permitted**

Marking

Top right-hand corner of each page.

E-Mail

ESDC employees send and receive thousands of e-mail messages; some of them sensitive. Within the ESDC electronic network, technology is in place to help keep information safe (including occasional prompts to consider encrypting certain emails). But there are always risks, which can be mitigated by employees understanding how to manage certain information.

If you receive by e-mail Protected C, Confidential or Secret information or attachments containing such sensitive information, immediately inform the team leader/manager, who will report the security incident to the Regional Security Office, complete and submit the Security Incident Report ADM 3061 (opens new window) as soon as possible.

By Mail

By Mail In Canada

Internal mail (ESDC Courier within local ESDC locations):

Double sealed envelope (no security markings on outer envelope) appropriately addressed. Warning on the inner envelope "To be open only by… (name or position)" and security markings.

ESDC Regions / other stakeholders (Federal Departments / Agencies, Provincial Governments or third party private sectors contracted by the department):

Double sealed envelope (no security markings on outer envelope) appropriately addressed. Warning on the inner envelope "To be opened only by … (name or position)" with security markings and include a transmittal note and receipt. The use of Priority mail, Xpresspost or messenger service is required as they are using a tracking and signature on reception process.

By Mail Outside Canada:

Note: The use of the Diplomatic Mail Services is strongly recommended. Contact Global Affairs Canada Diplomatic Mail Services for procedures. The DSO must approve any transmittal of Protected C information that is not sent by DFAIT Diplomatic Mail Services.

Diplomatic Mail Services

Plus

If approved by the DSO, double sealed envelope (no security markings on outer envelope) appropriately addressed. Warning on the inner envelope " To be opened only by… (name or position)" with security markings and include a transmittal note and receipt. The use of Priority mail, Xpresspost or messenger service is required as they are using a tracking and signature on reception process.

Fax

Secure Fax is required. Any of the following installations are authorized.

Viper phone, Secure Terminal Equipment (STE) phone, Sectera BDI Terminal, or Omni Secure Terminal used with Ricoh Secure Fax (COMSEC Equipment)

Transport

Transport In Canada

Transport by hand inside the department

Within restricted areas (Operation zone, Security zone, High Security zone):

Situation 1:

When transported by hand directly to the addressee, the Protected C blue folder must be delivered inside a sealed envelope. Please note that discretion is advice. (e.g. ADM to ADM, etc.).

Important: Both employees must have a Reliability Status (Enhanced status).

In

In

Situation 2:

When transported by hand to someone (not the addressee), the Protected C blue folder must be inserted inside a double sealed envelope with no security marking on the outer envelope, properly addressed and with a note on the inner envelope "To be opened by addressee Only". (e.g. ADM to ADM`s assistant, etc.).

In

In

Outside restricted areas (Reception zone, Public zone):

Protected C document must be transported inside a blue Protected C folder inside a double sealed envelope with no security markings on the outer envelope, properly addressed and with a note on the inner envelope: "To Be Opened by Addressee Only" The use of a secure briefcase or approved backpack is required.

Note: For the transport of several documents, it is highly recommended completing an inventory of the information being transported by the employee and providing a copy to the manager.

In

In

In

Or

Electronic format:

Encrypted USB keys and encrypted portable drives issued by the department can be used if permission is granted and transported inside the same containers.

In Canada

Transport outside department – In Canada

Protected C information must be transported in a double sealed envelope. No security markings on the outer envelope. Security markings on the inner envelope and properly addressed with warning "To Be Opened by Addressee Only" The use of a secure briefcase or approved backpack is required.

If traveling by personal motor vehicle, you must place Protected C information in an approved carrying case and lock it in the trunk or out of sight in a locked vehicle. Placement of the approved case is temporary and must be removed at destination. Stopovers are not permitted but if you require a stopover for an urgent matter, the case cannot be left unattended in the vehicle and must be in your possession at all times.

In

In

Or

Electronic format:

Encrypted USB keys and encrypted portable drives issued by the department can be used if permission is granted and transported inside the same containers.

Transport Outside Canada:

Transport outside department - Outside Canada

Protected C information must be transported in a double sealed envelope. No security markings on the outer envelope. Security markings on the inner envelope and properly addressed with warning "To Be Opened by Addressee Only" The use of a secure briefcase is required.

If traveling by personal motor vehicle, you must place Protected C information in an approved carrying case and lock it in the trunk or out of sight in a locked vehicle. Placement of the approved case is temporary and must be removed at destination. Stopovers are not permitted but if you require a stopover for an urgent matter, the case cannot be left unattended in the vehicle and must be in your possession at all times.

In

In

Electronic format:

Encrypted USB keys and encrypted portable drives issued by the department can be used if permission is granted and transported inside the same containers.

Electronic Storage

Electronic copy: Protected C electronic information can be stored on the Sensitive Document Collaboration Service (SDCS), or stored on departmental approved encrypted USB portable storage device and must be secured in an approved security cabinet or container. Electronic information cannot be stored on the Laptop's hard drives.

Note: Must be transported, transmitted and stored in the same manner as paper information, commensurate to the level of sensitivity of the information they contain. Any of the following cabinets are approved.

integral lock

Dasco (integral lock)

Safe (integral lock)

2 or 4 drawer

Locker Safe

IT Media Devices

Employees are responsible for the devices assigned to them. The most effective practice is to secure your mobile device (removing it from the docking station) in a locked cabinet or container at the end of the day, or when away from your workstation for an extended period.

Most Department-issued mobile devices are equipped with a Universal Security Slot (USS), and approved cables have a connector to use this slot. If not, a bracket is attached to the specific devices that will then enable the device to be secured using a cable lock docked to a desk, table or any fixed structure for security.

Note: If you require a locking cable for your mobile device, submit an online request to the National Service Desk.

File Store

Protected C information need to be inserted inside blue folder, properly marked and must be stored with the same safeguards as Secret information inside a Security Zone or a High Security zone.

Filing Cabinet (with integral lock):

Only approved filing cabinet, equipped with an integral lock, are approved for the storage of records classified up to Secret in a Security or high Security Zone (see definition below).

DASCO cabinet:

The use of a Dasco metal cabinet is approved for the storage of records classified up to Secret in a Security or high Security Zone when the tambour door is closed and the combination lock is set.

Electronic copy:

Store on network drive or department-approved and issued USB storage device in locked cabinet.

Definitions

Security Zone:

An area to which access is limited to authorized personnel and to authorized and properly escorted visitors. The zone must be monitored continuously 24 hours a day and 7 days a week. As for example: An area where secret information is processed or stored.

High Security Zone:

An area where access is limited to authorized appropriately screened personnel, authorized, and properly escorted visitors. The zone must be monitored continuously 24 hours a day and 7 days a week and where details of access are recorded and audited. As for example: An area where high-value assets are handles by selected personnel.

These are the approved secure cabinets that can be used with their respective locking mechanisms.

File Folder

integral lock

Dasco (integral lock)

Safe (integral lock)

2 or 4 drawer

Locker Safe

High density (Mobile) Shelving:

Commercial mobile shelving are approved for the storage of Protected C information if located in a Security Zone (for Non-Life threatening information) or High Security Zone (for Life threatening information) and within a Secure Storage Room (SSR).  Please note there is a fire safety requirement that mobile shelving units maintain at least a 100 mm separation between sections when closed.

Secure Storage Room (SSR):

A Secure Storage Room is intended to function as an approved storage container for open-shelf storage of a large amount of classified or highly sensitive non-national (Protected) information or assets. The SSR is designed for location in a Security Zone or High Security Zone in a federal government building.  The SSR is essentially a "security container" and its role is to primarily protect against surreptitious attacks but also detect and delay forced entry.

Note: As part of his oversight role, the Chief Security Officer (CSO) must assess the security measures in place to ensure they meet the minimum Security Requirements and approve the security measures in place.

Note:  For any additional information, please contact your Regional Security Office.

Print, Copy & Scan

Every ESDC employee is responsible for ensuring the protection of sensitive departmental information against loss or unauthorized disclosure and must follow the measures below based on the categorization of the information.

Protected C information must be treated using the same approach as Secret information and can be printed, scanned or photocopied using the following guidelines:

• Protected C documents cannot be printed, copied or scanned using a Network printer
• A stand-alone printer (Not connected to the Network) must be used for printing, copying or scanning
• The stand-alone printer must be located in a Security Zone ^{Footnote *}
• If available, a password function must be used for printing
• Protected C documents cannot be left unattended on printers

Downgrading, Declassification

Declassification is the decision, recorded in writing, of the originator of the protected information or an officer authorized by the Deputy Minister to remove the categorization level of the document. Redact (hide) all sensitive information that could identify an individual or have an impact on the Department is required.

Downgrading is the decision, recorded in writing, of the originator of the protected information or an officer authorized by the Deputy Minister to lower the categorization level of the document.

Downgrading at Protected B, A and Unclassified levels: Redact (hide) all information that qualify at Protected C level and the remaining information as required to the requirements for lower levels.

Information is to be identified as protected only for the period of time it requires safeguarding. After this period, the originator or the authorized officer is to have it declassified or downgraded, appropriately marked, and to inform all recipients of this action and its effective date. Whenever possible, originators are to provide, at the time the information is created or collected, a specific date or event at which time declassification or downgrading may occur.

As a minimum, an automatic expiry date of 10 years should apply to the categorization of most information; however, the automatic expiry date would not apply to information classified as Top Secret nor to information identified as particularly sensitive Protected B, (e.g. medical records) or extremely sensitive, Protected C, (e.g. witness protection information).

Destruction

Type II destruction equipment is defined as shredder or disintegrator approved for the secure destruction of Secret, Top Secret and Protected C information written on paper or other text based media.

Type II (Level 6): a special sub-category reserved for RCMP approved and SEG listed high security shredders which meet the NSA (USA) standard 02-01 for high security paper shredders. These exceed the security and performance requirements of the RCMP Destruction Standard and are recommended for cases where a TRA recommends a higher degree of security (e.g.: embassies, overseas deployments, smaller than 12 point font text size.)

RCMP Security Shredding Standards (Comparison relative to a 2 inch paper clip).

IT Media Devices

Optical: CD, DVD, Blu-Ray disks:

Reduce or shred the device to pieces, each with maximum area < 40 mm² (1/4 x 1/4 inch).

Solid –State Drives (SSD) and USB Flash Drives

Reduce or shred the device to pieces, each with maximum area < 40 mm² (1/4 x 1/4 inch).

Smartphones and Tablets

Destroy entire device or storage component to pieces < 40 mm² (1/4" x 1/4").

Destruction Facilities and Services 

The RCMP Technical Security Branch has a Destruction Equipment Guide, which is a comprehensive and completely revised quide to the selection of destruction equipment and services.  Please contact your local Regional Security Office RSO for guidance and details as Public Services and Procurement Canada (PSPC) need to be contacted for destruction service contracts or equipment purchases.

Retention