Canada ITSP.50.105 — Guidance on Cloud Security Assessment and Authorization

Why does it matter?

ITSP.50.105 makes one point central: the shared responsibility model lets an organization delegate some controls to the cloud provider, but it stays responsible for determining and managing the residual risk under which the service operates (section 1). The guidance shows how to reach that decision on evidence.

Key benefits include:

• Evidence replaces vendor claims

The organization reviews formal third-party attestations and certifications because it cannot directly assess controls the provider runs (section 2.1).

• Responsibility varies by model

In IaaS the organization assesses more components directly, while in PaaS and SaaS it relies more on independent assurance (section 2.2).

• One decision, whole service

Authorization covers the entire cloud-based service, both the provider's cloud services and the organization's service hosted on them (section 4.3.2).

• Gaps get a plan

Findings feed a plan of action and milestones that sets how the provider and the organization will correct deficiencies within an agreed timeline (section 4.3.2.1).

• Authorization stays alive

Authorization is maintained through periodic review and can be revoked if residual risk becomes unacceptable (section 4.3.4).

How does it work?

The guidance is organized in two assessments and a decision. Section 3 covers assessing the controls the provider implements, led by a CSP assessment committee of a security assessor, a cloud security architect, an IT practitioner and a compliance officer. Section 4 covers assessing the controls the organization itself implements, then authorizing, monitoring and maintaining the authorization.

Before a provider assessment starts, the organization confirms or establishes an NDA with the provider, determines the target security categorization, selects the cloud service model and cloud security control profile, and procures current independent third-party reports (section 3.2). The assessment then runs in five phases: determine applicable reports, confirm attestation scope and period, review detailed evidence, prepare the CSP assessment report, and perform continuous monitoring.

The control profiles come from Annex 4 baseline profiles of ITSG-33 and show which controls the provider, the organization or both implement for each deployment model. The guidance names SOC reports, ISO 27001, 27017 and 27018, CSA STAR and FedRAMP as third-party assurance sources (section 2.3).

Key Elements

• Cloud control profiles (section 2.1)

Cyber Centre cloud security control profiles, based on the ITSG-33 Annex 4 baselines, list the recommended controls for the assessed security category and cloud deployment model. They also say who is responsible for each control and form the basis for assessing it.

• Third-party assurance (section 2.3)

The organization reviews SOC reports, ISO 27001, 27017 and 27018 certifications, the CSA Security Trust and Assurance Registry and FedRAMP packages. The assessment confirms the scope and period of each report before relying on it.

• CSP assessment report (sections 3.2 and 3.3.1)

The report records the scope of the assessment, the evidence reviewed, gaps in the provider's controls, dependencies on controls the cloud consumer must implement, and recommendations. It feeds the organization's authorization package.

• Continuous monitoring and stacked services (sections 3.3.2 and 3.3.3)

Cloud contracts should require continuous coverage by third-party assessments, typically yearly. When a software provider runs on another provider's infrastructure, assessments are stacked so inherited controls are accounted for.

• Organizational controls and beta services (sections 4.1 and 4.2)

The organization assesses what it configures and operates on the service, with attention to automation, DevSecOps and vulnerability assessments. Beta or preview cloud services should never be used for production workloads, because they carry no security compliance or privacy commitments.

• Authorization package and decision (section 4.3.2)

A senior official reviews the final package, which includes the assessment results, the plan of action and milestones and the authorization letter, and makes a risk-based decision to authorize and accept residual risk.

What does it cover?

ITSP.50.105 applies to private and public sector organizations and to cloud-based services regardless of the cloud service or deployment model (section 1.2). It addresses the cloud consumer organization and the cloud service providers it depends on, and it covers both the provider's controls and the consumer's own.

What are its objectives?

The guidance exists so that cloud services are authorized on assessed risk rather than assumption.

Provide a repeatable process for assessing the controls a cloud provider implements.

Make the split between provider and consumer controls explicit for each cloud service model.

Reuse independent third-party assurance when its scope and period match the service.

Document gaps in a plan of action and milestones and the residual risk accepted by an authorizing official.

Continue monitoring and maintaining the authorization after approval.

Framework in Context

ITSP.50.105 is part of the Cyber Centre's cloud security publication suite and supports ITSM.50.062 Cloud Security Risk Management. ITSP.50.103 covers security categorization of cloud-based services and ITSP.50.104 covers defense in depth for cloud-based services. It builds on ITSG-33 IT Security Risk Management and cites the CSA Security Guidance, the NIST Risk Management Framework and the Treasury Board's cloud direction as references.

Common Framework Mappings

ITSP.50.105 is mapped to the cloud assurance programs and control catalogs that providers already hold, so assessments reuse existing evidence.

Mapped frameworks include:

FedRAMP Rev. 5

CSA STAR

CSA CCM v4

ISO 27001:2022

ISO 27017

ISO 27018

NIST 800-53 Rev.5

NIST 800-37 Rev.2