Government IT Services Ottawa

Not departmental work above the trade threshold, and we'd rather say so than waste your procurement cycle. TBIPS is the mandatory method of supply there and qualifying requires a Designated Organization Screening granted by Public Services and Procurement Canada. We don't hold one today. Where we're useful is with the companies that sell into government and inherit its requirements through their own contracts.

It's the Government of Canada's framework for managing IT security risk across a system's lifecycle, published by the Canadian Centre for Cyber Security under the authority of the Chief of CSE. It works at two levels, departmental and information-system, and its control catalogue is organised into management, technical and operational classes with separate profiles for PROTECTED A, PROTECTED B and SECRET. It's guidance to departments, not a statute binding suppliers, which is why it usually reaches a supplier as a clause in somebody else's contract.

A threat and risk assessment asks what could go wrong with the system and how bad it would be. A privacy impact assessment asks what the system does to people's personal information and whether that's defensible. They overlap and they're often demanded together, but they answer to different people: a TRA to the security authority, a PIA to the privacy one. Doing one and calling it both is the most common way this goes wrong.

It's a sensitivity level, and it drives which ITSG-33 profile your controls have to meet rather than naming a specific product. The practical questions it forces are where the data rests, who can reach it, what's logged and who holds the keys. Any provider who answers "we're Protected B" without naming a profile and a hosting arrangement hasn't answered.

Screening is granted by Public Services and Procurement Canada, not claimed by a supplier, and the organisation has to be cleared before any individual can be. Tell us what your contract requires and we'll tell you plainly what we hold today, what we'd need to obtain and roughly how long it takes, including when the honest answer is that we're not the right supplier for that piece of work.

Less than on any other page we run. Screening is a federal process, a supply arrangement is a procurement instrument and a control mapping is a document. None of those has a drive time. What does need somebody present is the assessment walk and anything physical, which we book and quote.

Yes. Kanata, where the defence and aerospace cluster makes CPCSC land first, plus Nepean, Orleans, Barrhaven and across the river into Gatineau. A Gatineau address adds a Quebec privacy dimension worth raising at the start rather than at an audit.