Preparation, before the 13:
- Contracts reviewed for Specified Information clauses
- Data flow mapped; system boundary drawn and dated
- Evidence folder started, one subfolder per requirement
- Results page with expiry date saved; result and expiry confirmed in the CanadaBuys profile; renewal calendared
Requirements and evidence:
- 03.01.01 Account management · account list with owners; inactivity and notification periods set; disabled accounts recorded
- 03.01.02 Access enforcement · group permissions on enclave shares; screenshots dated
- 03.01.20 Use of external systems · policy on personal and external systems; agreements where used
- 03.01.22 Publicly accessible content · review record of website and social posts
- 03.05.01 User identification and authentication · unique IDs; no shared logins; re-authentication rules
- 03.05.02 Device identification and authentication · device list; 802.1X or equivalent where used
- 03.05.03 Multi-factor authentication · MFA enrolment list covering privileged and non-privileged accounts
- 03.08.03 Media sanitization · sanitization and destruction log with evidence
- 03.10.01 Physical access authorizations · approved access list; review date; removals recorded
- 03.10.07 Physical access control · door control, visitor log, key control, output devices
- 03.13.01 Boundary protection · firewall rule set; managed interfaces; segmentation diagram
- 03.14.01 Flaw remediation · patch windows defined; patch reports
- 03.14.02 Malicious code protection · endpoint console screenshot: current, scanning, blocking