What do you want to do with this information?
— Confidential

Avoid using speakerphone when discussing sensitive information; use earbuds or headsets to prevent an unauthorized disclosure of the discussion.

Ensure that any work that includes the discussion of sensitive information, over the phone, is conducted in such a way as to prevent the mention of this information within hearing distances of others and/or virtual assistant recording devices (e.g. Siri, Google Home, Amazon Alexa, etc.) as this could result in a security incident involving the national interest of Canada. Some examples include, but are not limited to, private point of view of officials not intended for disclosure, funding proposals submitted by provinces/territories, information that could cause damage to diplomatic relations, etc.

** Important Note: Videoconferencing Not Permitted**

Marking

Top right-hand corner of each page.

E-Mail

ESDC employees send and receive thousands of e-mail messages; some of them sensitive. Within the ESDC electronic network, technology is in place to help keep information safe (including occasional prompts to consider encrypting certain emails). But there are always risks, which can be mitigated by employees understanding how to manage certain information.

If you receive by e-mail Protected C, Confidential or Secret information or attachments containing such sensitive information, immediately inform the team leader/manager, who will report the security incident to the Regional Security Office, complete and submit the Security Incident Report ADM 3061 (opens new window) as soon as possible.

By Mail

By Mail In Canada

Internal mail (ESDC Courier within local ESDC locations):

Double sealed envelope (no security markings on outer envelope) appropriately addressed and warning on the inner envelope "To be open only by… (name or position)" with the security markings.

ESDC Regions / other stakeholders (Federal Departments / Agencies, Provincial Governments or third party private sectors contracted by the department):

Double sealed envelope (no security markings on outer envelope) appropriately addressed. Warning on the inner envelope "To be opened only by … (name or position)" with security markings and include a transmittal note and receipt. The use of Priority mail, Xpresspost or messenger service is required as they are using a tracking and signature on reception process.

External mail (outside Canada):

Note: The use of the Diplomatic Mail Services is strongly recommended. Contact Global Affairs Canada Diplomatic Mail Services for procedures. The DSO must approve any transmittal of Confidential information that is not sent by DFAIT Diplomatic Mail Services.

Diplomatic Mail Services

Plus

If approved by the DSO, double sealed envelope (no security markings on outer envelope) appropriately addressed. Warning "To be opened only by… (name or position)" with security markings and include a transmittal note and receipt. The use of Priority mail, Xpresspost or messenger service is required as they are using a tracking and signature on reception process.

Fax

Secure Fax is required. Any of the following installations are authorized.

Viper phone, Secure Terminal Equipment (STE) phone, Sectera BDI Terminal, or Omni Secure Terminal used with Ricoh Secure Fax (COMSEC Equipment)

Transport

Transport In Canada

Transport by hand inside the department

Within restricted areas: (Operation zone, Security zone, high Security zone)

Situation1:

When transported by hand directly to the addressee, the Confidential green folder can be deliver without envelopes. Please note that discretion is advice. (e.g. ADM to ADM, etc.).

Important: Both employees must hold a Secret clearance.

In

Situation 2:

When transported by hand to someone (not the addressee), the Confidential green folder must be inserted inside a double sealed envelope with no security marking on the outer envelope, properly addressed and with a note on the inner envelope "To be opened by addressee Only". (e.g. ADM to ADM`s assistant, etc.).

In

In

Outside restricted zone (Reception zone, Public zone):

When transported outside a restricted zone, the Confidential green folder must be inserted into a double sealed envelope with no security markings on the outer envelope, properly addressed and with a note on the inner envelope: "To Be Opened by Addressee Only" The use of an approved backpack or a secure briefcase is required.

Note: For the transport of several documents, it is highly recommended completing an inventory of the information being transported by the employee and providing a copy to the manager.

In

In

In

Or

Electronic format:

Encrypted USB keys and encrypted portable drives issued by the department can be used if permission is granted and transported inside the same containers.

Transport In Canada

Transport outside department – In Canada

Confidential information must be transported in a single sealed envelope with no security markings and appropriately addressed with warning "To Be Opened by Addressee Only". The use of a secure briefcase is required.

If traveling by personal motor vehicle, you must place Confidential information in an approved carrying case and lock it in the trunk or out of sight in a locked vehicle. Placement of the approved case is temporary and must be removed at destination. Stopovers are not permitted but if you require a stopover for an urgent matter, the case cannot be left unattended in the vehicle and must be in your possession at all times.

In

In

Or

Electronic format:

Encrypted USB keys and encrypted portable drives issued by the department can be used if permission is granted.

Transport Outside Canada:

Transport outside department - Outside Canada

Confidential information must be transported in a double sealed envelope. No security markings on the outer envelope. Security markings on the inner envelope and properly addressed with warning "To Be Opened by Addressee Only". The use of a secure briefcase is required.

If traveling by personal motor vehicle, you must place Confidential information in an approved carrying case and lock it in the trunk or out of sight in a locked vehicle. Placement of the approved case is temporary and must be removed at destination. Stopovers are not permitted but if you require a stopover for an urgent matter, the case cannot be left unattended in the vehicle and must be in your possession at all times.

In

In

Electronic format:

Encrypted USB keys and encrypted portable drives issued by the department can be used if permission is granted and transported inside the same containers.

Electronic Storage

Electronic copy: Confidential electronic information can be stored on the Sensitive Document Collaboration Service (SDCS) or stored on the departmental approved encrypted USB portable device and secure in an approved security cabinet or container. Electronic information cannot be stored on the Laptop's hard drives.

Note: Must be transported, transmitted and stored in the same manner as paper information, commensurate to the level of sensitivity of the information they contain. Any of the following cabinets are approved.

Abloy or S&G Padlock

integral lock

Safe

2 or 4 drawer

Locker Safe

File Store

Confidential information need to be inserted inside a green folder, properly marked and must be secure cabinet or Open Shelving room in an Operations Zone (see definition below) which implies a work area where workers have a common need-to-know, visitors are properly escorted.

Adequate lock-up storage safeguards within an Operations Zone for Confidential depend on the monitoring and response characteristics of the environment, as well as on the difficulty for an adversary to access the documents. All lockable commercial office furniture are not suitable for this application and only certain commercial padlocks meet the ASTM F883-04 in an Operation Zone. Mobile shelving units are suitable for this application; however bulk (mobile) shelving units are subject to conditions.

Electronic copy:

Store on network drive or department-approved and issued USB storage device in locked cabinet.

Definition:

An Operation Zone is an area where access is limited to personnel who work there and properly escorted visitors. As for example: Typical open office area.

These are the approved secure cabinets that can be used with their respective locking mechanisms.

File Folder

Abloy or S&G Padlock

Dasco (integral lock)

Safe (integral lock)

2 or 4 drawer

Locker Safe

Secure Storage Room (SSR):

A Secure Storage Room is intended to function as an approved storage container for open-shelf storage of a large amount of classified or highly sensitive non-national (Protected) information or assets. The SSR is designed for location in a Security Zone or High Security Zone in a federal government building.  The SSR is essentially a "security container" and its role is to primarily protect against surreptitious attacks but also detect and delay forced entry.

Note: As part of his oversight role, the Chief Security Officer (CSO) must assess the security measures in place to ensure they meet the minimum Security Requirements and approve the security measures in place.

Note:  For any additional information, please contact your Regional Security Office.

Print, Copy & Scan

Every ESDC employee is responsible for ensuring the protection of sensitive departmental information against loss or unauthorized disclosure and must follow the measures below based on the categorization of the information.

Confidential information can be printed, scanned or photocopied using the following guidelines:

• Confidential documents cannot be printed, copied or scanned using a Network printer
• A stand-alone printer (Not connected to the Network) must be used for printing, copying or scanning
• The stand-alone printer must be located in an Operation Zone^{Footnote *}
• If available, a password function must be used for printing
• Confidential documents cannot be left unattended on printers

Downgrading, Declassification

Declassification is the decision, recorded in writing, of the originator of the protected or classified information or an officer authorized by the Deputy Minister to remove the categorization level of the document. Redact (hide) all sensitive information that could have an impact on an individual or on the Department is required. Once released to the public by an announcement, the information becomes unclassified.

Downgrading is the decision, recorded in writing, of the originator of the protected or classified information or an officer authorized by the Deputy Minister to lower the categorization level of the document.

Downgrading at Protected levels: Redact (hide) the information that qualify at the Confidential level and the remaining information as required to meet the requirements for lower levels.

Information is to be identified as protected only for the period of time it requires safeguarding. After this period, the originator or the authorized officer is to have it declassified or downgraded, appropriately marked, and to inform all recipients of this action and its effective date. Whenever possible, originators are to provide, at the time the information is created or collected, a specific date or event at which time declassification or downgrading may occur.

As a minimum, an automatic expiry date of 10 years should apply to the categorization of most information; however, the automatic expiry date would not apply to information classified as Top Secret nor to information identified as particularly sensitive Protected B, (e.g. medical records) or extremely sensitive, Protected C, (e.g. witness protection information).

Destruction

Type III destruction equipment is defined as shredders and disintegrators for paper and text based media that have been assessed as capable of reducing information classified Confidential and Protected B or lower to a size that, under the threat and risk conditions existing in urban Canada and with known reconstruction methodology, is deemed safe to dispose of or recycle as unclassified waste.

RCMP Security Shredding Standards (Comparison relative to a 2 inch paper clip).

IT Media Devices

Optical: CD, DVD, Blu-Ray disks:

Reduce or shred the device to pieces, each with maximum area < 40 mm² (1/4 x 1/4 inch).

Solid –State Drives (SSD) and USB Flash Drives

Reduce or shred the device to pieces, each with maximum area < 40 mm² (1/4 x 1/4 inch).

Smartphones and Tablets

Destroy entire device or storage component to pieces < 40 mm² (1/4" x 1/4").

Destruction Facilities and Services 

The RCMP Technical Security Branch has a Destruction Equipment Guide, which is a comprehensive and completely revised guide to the selection of destruction equipment and services.  Please contact your local Regional Security Office RSO for guidance and details as Public Services and Procurement Canada (PSPC) need to be contacted for destruction service contracts or equipment purchases.

Retention