Securing Information

Securing information not only concerns the proper handling and protection of information but also safeguarding information from creation and storage to disposal. Employees must protect all information, whether it is in a physical form or electronic form.

Do you...

• Store Protected or Classified information and departmental assets securely to ensure they are properly safeguarded?
• Adjust your computer screen or use a closed room when working with sensitive information?
• Understand the "Need-to-know principle"?
• Regularly review and update your user profile, passwords and access privileges?
• Know how to securely store, transmit and dispose of electronic information?

Do you know...

• The sensitivity level of the information you are creating/working with and how to classify that information?
• The type of approved containers to safeguard Protected or Classified information?
• Where and how to share information securely to ensure it is not at risk, including who is authorized to view the information and how it is to be shared?
• How to safely dispose of information based on its level of sensitivity?

Resource Corner

Guidelines and Directives

• For guidance on classifying, storing and transmitting information, consult the Information Categorization Tool
• To ensure you are using approved equipment to store, transport or destroy information or assets, consult the RCMP Security Equipment Guide
• Helpful tips on maintaining a secured workstation and applying sound security practices daily can be found in the Clean Desk Guidelines
• For details on where electronic information can be stored within or connected to the departmental electronic network, review the ESDC Storage of Electronic Information Directive (PDF, 321 KB).

Dos and Don’ts

• Protected Information Sent Via Email

Communications Security (COMSEC)
The COMSEC group provides training, guidance, support and information on secure communications. The department currently uses a shared protected domain that enables users to send and receive Protected fax communications.

Instructions for Secure Fax

• Secure Fax
• CERTIFAX/ADMIRAL Operating Instructions

Frequently Asked Questions

General

• What should I do if I think the security of information or my IT equipment is being compromised?

  If you believe that the security of your data or your IT equipment has been jeopardized and could result in unauthorized access to ESDC systems and/or information, inform your manager and follow the guidelines provided here.

• Why are Security policies and directives more stringent in ESDC than in other government departments?

  All departments must comply with Government of Canada IT Security policy, standards, procedures, directives and guidelines. The nature of the work that we do in ESDC means that we manage valuable assets, i.e. Canadians personal information. Because of that, additional security measures must be in place to ensure that information is protected.

Taking Work Home

For a simple guide on taking work home, follow the Decision Making Flowchart (PDF, 321 KB) .

• I have a deadline to meet and I don’t want to cart my laptop home as it is too heavy to carry around. Can I email the documents to my home computer to work on after hours?

  No. E-mailing work-related documents to your home e-mail address is considered a security violation (see Section 5.9 of the ESDC Network Use Directive). Information traveling outside the departmental firewall is not secure or protected and could be compromised or lost if sent to the wrong e-mail address.

  If you are required to take work home, get your manager’s approval first and use a departmental-issued encrypted USB key (biometric or password) to transport the information.

  However, there is a risk in connecting even a work-issued USB key to your home computer.

  Before connecting any departmental-issued device, ensure that your anti-virus software is up-to-date and that you have recently scanned your computer for viruses. If your home computer is infected, you risk bringing a virus into the work environment.

  When you bring the departmental-issued encrypted USB key back to work and plug it into the network, it is automatically scanned. If a virus is detected - the document will be quarantined and may be unrepairable.

• I cannot easily read documents on my work BlackBerry because the screen is too small. Can I email information from my work BlackBerry to my home e-mail address to read?

  No, e-mailing work-related documents from your work BlackBerry to your home e-mail address is considered a security violation (see Section 5.9 of the ESDC Network Use Directive).

• I am in the middle of a big project and find that I have to work from home on a more regular basis both during and after work hours. Are there other solutions I should consider?

  Yes, you should speak with your manager about flexible work arrangements.

• Are there types of personal information that I am approved to email to my home account?

  Yes, please review the following table for examples of personal information that may be sent via email to your home account.

  Materials containing your personal information	Other personal materials
  Compensation and Benefits Forms, Pay Statements,T4 slips (provincial and federal)	Training, learning and/or study materials
  Resumes, Job Applications, Competition Materials	Work conference follow-up materials that were sent to you by conference organizers
  Security Clearance Forms	Job Postings
  Great-West Dental / Sun Life Financial Health Claims	Calendar Bookings (not work-related attachments contained in meeting invitations)
  Performance Agreements	Non-Work Related YouTube Links (to watch on your own time)
  Grievance Forms, Materials	Work Related YouTube Links (that you may not be able to watch if the internet is slow)
  Shared Travel Services - Travel Itineraries	News Article Links (external sites)