Jurisdictions / Canada
Canada: CCCS ITSP.40.111
The Canada overlay carries 4 jurisdiction rules built on ITSP.40.111, the Canadian Centre for Cyber Security's catalogue of approved cryptographic algorithms for UNCLASSIFIED and PROTECTED information. The recommended Canadian activation layers it on the NIST channel; findings carry the ITSP-40.111 framework tag.
What ITSP.40.111 sets
- Approved algorithms, key lengths and usage periods for UNCLASSIFIED and PROTECTED information
- Alignment with the NIST algorithm baseline, with Canadian-specific scoping on top
- The premise that departments know their cryptographic inventory - which is what the CBOM delivers
Recommended configuration
The Canadian Government profile activates the NIST channel plus this overlay. Where ITSP guidance scopes an algorithm differently from the global baseline, both stances appear on the finding, and the CBOM gives assessors the inventory with file and line evidence.
Frequently asked questions
Which protection levels does the overlay address?
UNCLASSIFIED and PROTECTED information, following ITSP.40.111's scope. Classified systems carry requirements beyond a source-level scanner.
Why pair it with the NIST channel?
ITSP.40.111 tracks the NIST algorithm baseline closely; the overlay adds the Canadian scoping instead of duplicating the base rules, and both verdicts stay visible per finding.
How do updates arrive?
Through the same 24-hour signed update cycle as every other channel and overlay.