Specified Information is government of Canada information that must be protected when a non-government organization handles, processes, or stores it. That is PSPC’s definition in its Level 1 scoping guide. Which of your documents qualify is set by your contract, not by a general list.
The reasoning
The official pages don’t give a catalogue of document types. PSPC tells suppliers to use their contract, security clauses, and any handling instructions to confirm what counts, and then to identify every asset and environment that has it. So the work starts in the paperwork, not on the file server.
On the hub I describe it as sensitive but unclassified government information that a contract identifies as needing safeguarding on supplier systems. The usual candidates are drawings, statements of work, schedules, and technical data. That list is my experience, not PSPC’s wording, and the contract decides each case.
One drawing can be Specified Information on one job and ordinary correspondence on another. Two purchase orders for the same part can come out differently.
Where it ends up
PSPC’s scoping guide says in-scope assets are the ones that process, store, or transmit it. Its examples include computers, mobile devices, file shares, cloud storage, email, servers, backup media, and printers or scanners that can store information. The guide also describes information that is received, created, edited, printed, emailed, transferred, backed up, and destroyed.
That list matters because the copy you know about is rarely the only one. Echoes in backups, sync clients, and downloads folders count.
The same logic covers what you create. A routing sheet, a first-article inspection report, or a quote that restates details from a customer’s drawing can carry the same handling duty, depending on the clause. PSPC’s guide describes information that is created, edited, and generated by an automated system, not only information that arrives from outside.
Edge cases
If a clause is vague, ask the contracting authority or your prime what is meant. Get the answer in writing.
If you can’t tell, treat the material as Specified Information until you can. Wrongly protecting a file costs little, and wrongly ignoring one costs a lot.
Controlled Goods data is a separate regime. A drawing may be both, and meeting one doesn’t satisfy the other.
What to do this week
- Collect the security clauses and any handling instructions from every defence-related contract.
- Write down, per contract, what the paperwork says is Specified Information.
- Trace each item through 5 stages, from arrival to rest, work, leaving, and echoes.
- Mark every system it touches, which becomes your boundary.
The scoping page walks through the trace and the ways to shrink the footprint, and does it apply covers the yes-or-no test. CPCSC Bytes has shorter explainers.
If you would like help reading your clauses and mapping the data, book a scoping call.