ITSG-33 alignment
Security control profile selection, threat assessment, and the documentation work that supports authorization to operate in a Government of Canada context.
// GOVERNMENT AND PUBLIC SECTOR · HANS STUDY
Federal, provincial, and municipal infrastructure
ITSG-33 alignment for federal organizations. GO-ITS standards work for Government of Ontario agencies. NIST SP 800-53 control selection. Public sector procurement realities. The advisory draws on direct federal infrastructure experience and a working understanding of how public sector technical decisions actually get made.
What is different about the public sector
Government technical work is shaped by frameworks the private sector can ignore. ITSG-33 sets out how federal departments are supposed to manage IT security risk. GO-ITS standards govern Ontario provincial agencies and sector partners. Municipal IT often has to bridge a federal funding requirement with a provincial standard with a vendor's enterprise platform that was not built for either. Procurement is a process with formal stages, not a phone call. RFPs are evaluated against documentation that has to be defensible to an oversight body, not just technically correct.
Doing this well requires more than knowing the standards. It requires knowing how the technical work fits into the broader process, what the procurement office actually needs from a technical specification, and how to write architecture documentation that survives both peer review and audit.
Where independent advisory adds value
GO-ITS standards work
Government of Ontario IT Standards architecture, network, and security alignment. For provincial ministries, agencies, and broader public sector organizations under GO-ITS scope.
NIST SP 800-53 control selection
Realistic control selection and tailoring for government environments. Architectural design that implements the controls, not just documentation that claims they are met.
Pre-RFP technical specification
Platform-neutral technical specification before the procurement goes out. Comparable vendor responses, an objective evaluation basis, and an integrator selection process that does not produce a single bidder.
Owner's representative services
Independent technical voice during integrator engagement. Submittal review, acceptance testing oversight, and the audit trail that protects both the integrator and the agency.
Federal infrastructure experience
Direct experience operating mission-critical federal networks where failure was not an option. That operational context shapes the advisory in environments where the same standards apply.
Standards and frameworks in scope
- ITSG-33, Government of Canada IT security risk management
- GO-ITS, Government of Ontario IT Standards
- NIST SP 800-53, security and privacy controls for information systems and organizations
- NIST SP 800-171, controlled unclassified information
- NIST SP 800-82, industrial control systems security
- ISO/IEC 27001, information security management
- TIA-942, data centre infrastructure standard
- CJIS, for environments handling criminal justice information
What field experience looks like
I have worked across federal infrastructure environments where mission continuity was the operating mandate, alongside provincial agency and municipal projects in Ontario. The work has covered network architecture review, ITSG-33 control profile selection, GO-ITS alignment, pre-RFP technical specification, and owner's representative oversight during integrator engagement. The advisory draws on direct public sector experience, not generic enterprise patterns reapplied to a government context.
For organizations early in a project, technical specification work before the RFP goes out is usually the right first engagement. For organizations already in delivery, owner's representative services are the right pattern.
Related
High security design →
Design for detention, borders, courts and utilities, where being mostly right is not a passing grade.
Independent technical voice in the room
Pre-RFP technical specification, design review, owner's representative engagement, and post-deployment audit are all available as discrete engagements, each scoped and quoted on its own. The earliest point of engagement is also the highest-impact point.
Related work: a three-site public institution platform rebuild.