Summary

  • Departments must rank critical services by the harm their compromise could cause and submit the list to the Treasury Board of Canada Secretariat’s Enterprise Portfolio Management tool by 30 November.
  • Treasury Board, Shared Services Canada and the Canadian Centre for Cyber Security will use risk, dependencies and capacity to coordinate implementation priorities and support.

Analysis

The Government of Canada’s Security Policy Implementation Notice (SPIN), effective 1 October, turns a broad cyber-readiness programme into a service-level choice: which public services would be hardest to sustain if their supporting systems were compromised? Under action IDT-1, departments must review critical services and their supporting systems, rank them by potential operational, legal, financial or reputational impact, and submit a prioritized list in the Treasury Board of Canada Secretariat’s Enterprise Portfolio Management (EPM) tool by 30 November.

The notice says this will support central prioritization and Shared Services Canada planning; it does not say the lists will be public.

The ranking is meant to connect continuity planning with technical work. The notice also asks departments to keep application inventories current, map the systems and likely attack paths behind critical services, and maintain visibility into internet-facing assets. Those records can show which identity systems, networks, applications and external providers must work for a service to remain available or recover quickly. Its wider programme covers asset identification, vulnerability response, identity and network hardening, monitoring and recovery preparation.

The institutional division is explicit. Treasury Board of Canada Secretariat (TBS), Shared Services Canada (SSC) and the Canadian Centre for Cyber Security will set government-wide implementation priorities and SSC support using cyber risk, dependencies and delivery capacity. SSC is the common IT service provider, but departments remain responsible for government information and assets even when a third party or managed-service provider supports them. Security duties therefore need to carry through procurement, contracts and ongoing contract management; shared infrastructure does not transfer responsibility for the service.

Where capacity is insufficient to address every critical service at once, the notice recommends starting with no more than three of the highest-priority services and then expanding the same approach to the rest. This is a sequencing recommendation, not a permanent cap. The practical test is whether the first group is selected on defensible impact evidence and whether dependencies remain in view as coverage expands.

AI agents sit within this larger control agenda. HRD-6 explicitly includes them among non-person entities alongside service accounts, service principals and machine identities. It calls for clear ownership, a documented business purpose, lifecycle management and regular privilege reviews, while minimizing always-on access and static credentials. That makes agent governance part of ordinary service-continuity work: who owns an automated identity that can reach a critical system, who can revoke it, and how is its activity reviewed?

The Canadian Centre for Cyber Security’s frontier-AI guidance offers technical context on ownership, limits on autonomous action, access controls, logging, testing and intervention; it is not evidence of a department-specific incident.

TBS also says it will actively verify the government perimeter and publicly accessible systems, monitor departmental progress and engage senior officials as appropriate when required actions are unmet. Appendix A lists “notional” indicators, such as updated inventories or recorded ownership of non-person entities. It reports no current scores and proves no implementation. The first public checkpoint is therefore the 30 November deadline and later evidence of how the three central partners turn lists into priorities—not an assumed result.

Sources