Skip to content

Latest commit

 

History

History
42 lines (33 loc) · 6.6 KB

00_Applicable-Scope.md

File metadata and controls

42 lines (33 loc) · 6.6 KB
Raw

Cloud Usage Profiles

(Back)

Overview

The following table outlines the cloud usage identifier, profiles, descriptions and cloud service models used in the GC.

Table 1: cloud usage identifiers, profiles and service models

Identifier (ID) Profile Characteristics Applicable Service Model
1 Experimentation or sandbox
  • Cloud-based services used for experimentation or sandbox
  • No direct system-to-system network interconnections required with GC data centres
 IaaS, PaaS, SaaS
2 Non-sensitive cloud-based services
  • Cloud-based services hosting non-sensitive GC content
  • No direct system-to-system network interconnections required with GC data centres
 IaaS, PaaS, SaaS
3a Sensitive (up to Protected B) cloud-based services
  • Cloud-based services hosting sensitive (up to Protected B) information
  • No direct system-to-system network interconnections required with GC data centres
 IaaS, PaaS, SaaS
3b Sensitive (up to Protected B) cloud-based services (hybrid IT – extension of GC data centres)
  • Cloud-based services hosting sensitive (up to Protected B) information
  • GC cloud-based systems required to interact with systems in GC data centres
  • Restricted environment for GC users only
  • No external user connections to or from GC cloud-based virtual private cloud and no publicly accessible services
 PaaS, SaaS
4a Sensitive (up to Protected B) cloud-based services for GC-wide SaaS solutions
  • Cloud-based services hosting sensitive (up to Protected B) information for GC-wide enterprise applications (SaaS)
  • No direct system-to-system network interconnections required with GC data centres
 SaaS
4b Sensitive (up to Protected B) cloud-based services for GC-wide SaaS solutions (hybrid IT – extension of GC data centres)
  • Cloud-based services hosting sensitive (up to Protected B) information for GC-wide enterprise applications (SaaS)
  • GC cloud-based systems required to interact with systems in GC data centres
  • Restricted environment for GC users only
  • No external user connections to or from GC cloud-based virtual private cloud and no publicly accessible services
 SaaS
5 GC to GC only (hybrid IT – extension of GC data centres)
  • Hybrid IT environment with an extension of the GC network to cloud-based virtual private cloud (up to Protected B) information
  • GC cloud-based systems required to interact with systems in GC data centres
  • Restricted environment for GC users only
  • No external user connections to or from GC cloud-based virtual private cloud and no publicly accessible services
 IaaS, PaaS
6 Cloud-based services with external user access and interconnection to GC data centres
  • Cloud-based services hosting sensitive (up to Protected B) information
  • GC cloud-based systems required to interact with systems in GC data centres
  • Environment accessible to GC users and external users and services
  • Solution implemented, managed, and operated by a GC department or agency
 IaaS, PaaS

Mapping guardrails to cloud usage profiles

The following table describes the applicability of the guardrails during the first 30 business days of departments getting access to their cloud account. Within each departmental cloud tenant, there will be various information systems being provided. Each cloud sub-account or resource group should be tagged with the relevant cloud usage profile to ensure that appropriate policies are applied and validation is performed.

Table 2: guardrail identifiers, service models and cloud usage profiles

Identifier (ID) Guardrail Applicable Service Models Profile 1: experimentation or sandbox Profile 2: non-sensitive cloud-based services Profile 3a and 3b: sensitive (up to Protected B) cloud-based services Profile 4a and 4b: sensitive (up to Protected B) cloud-based services for GC-wide SaaS solutions Profile 5: GC to GC only (hybrid IT – extension of GC data centres) Profile 6: cloud-based service accessible to external users (connections to GC data centres required)
01 Protect user accounts and identities IaaS, PaaS, SaaS Required (minimum for privileged users) Required Required Required Required Required
02 Manage access IaaS, PaaS, SaaS Required Required Required Required Required Required
03 Secure endpoints IaaS, PaaS, SaaS Recommended Required Required Required Required Required
04 Enterprise monitoring accounts IaaS, PaaS, SaaS Required (for billing) Required Required Required Required Required
05 Data location IaaS, PaaS, SaaS Recommended Recommended Required (in Canada for GC storage of Protected B information and above) Required (in Canada for GC storage of Protected B information and above) Required (in Canada for GC storage of Protected B information and above) Required (in Canada for GC storage of Protected B information and above)
06 Protection of data at rest IaaS, PaaS, SaaS Not Required Recommended Required Required Required Required
07 Protection of data in transit IaaS, PaaS, SaaS Recommended Required Required Required Required Required
08 Segment and separate IaaS, PaaS Required (network filtering at a minimum) Required Required Required Required Required
09 Network security services IaaS, PaaS, SaaS Recommended Required Required Required (Restrict to GC only) Required (Deny External Access policy, GC only) Required
10 Cyber defense services IaaS, PaaS, SaaS Not Required Required Required Required Required Required
11 Logging and monitoring IaaS, PaaS, SaaS Recommended Required Required Required Required Required
12 Configuration of cloud marketplaces IaaS, PaaS, SaaS Required Required Required Required Required Required
13 Plan for continuity IaaS, PaaS, SaaS Not required Required Required Required Required Required