English: {\rtf1\ansi\deff0 {\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\fnil\fprq0\fcharset2 StarSymbol{\*\falt Arial Unicode MS};}{\f4\fnil\fprq2\fcharset0 Arial;}{\f5\fnil\fcharset2 Symbol;}} {\colortbl;\red0\green0\blue0;\red128\green128\blue128;} {\stylesheet{\s1\cf0{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\rtlch\af4\afs24\lang255\ltrch\dbch\af4\langfe255\hich\f0\fs24\lang4105\loch\f0\fs24\lang4105\snext1 Normal;} {\s2\sb240\sa120\keepn\cf0{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\rtlch\afs28\lang255\ltrch\dbch\langfe255\hich\f2\fs28\lang4105\loch\f2\fs28\lang4105\sbasedon1\snext3 Heading;} {\s3\sa120\cf0{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\rtlch\af4\afs24\lang255\ltrch\dbch\af4\langfe255\hich\f0\fs24\lang4105\loch\f0\fs24\lang4105\sbasedon1\snext3 Body Text;} {\s4\sa120\cf0{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\rtlch\af4\afs24\lang255\ltrch\dbch\af4\langfe255\hich\f0\fs24\lang4105\loch\f0\fs24\lang4105\sbasedon3\snext4 List;} {\s5\sb120\sa120\cf0{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\rtlch\af4\afs24\lang255\ai\ltrch\dbch\af4\langfe255\hich\f0\fs24\lang4105\i\loch\f0\fs24\lang4105\i\sbasedon1\snext5 caption;} {\s6\cf0{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\rtlch\af4\afs24\lang255\ltrch\dbch\af4\langfe255\hich\f0\fs24\lang4105\loch\f0\fs24\lang4105\sbasedon1\snext6 Index;} {\*\cs8\cf0\rtlch\af3\afs18\lang255\ltrch\dbch\af3\langfe255\hich\f3\fs18\lang4105\loch\f3\fs18\lang4105 Bullet Symbols;} } {\*\listtable{\list\listtemplateid1 {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9679 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li720} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9675 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li1080} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9632 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li1440} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9679 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li1800} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9675 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li2160} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9632 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li2520} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9679 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li2880} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9675 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li3240} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9632 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li3600} {\*\soutlvl{\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9679 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li3960}}\listid1} }{\listoverridetable{\listoverride\listid1\listoverridecount0\ls0}} {\info{ {\title Information Technology Security - Audit Guide} {\author TBS/SCT} {\company Government of Canada, Gouvernement du Canada} {\doccomm DocumentID: 12356; Language: en; VersionID: 1} }} {\header\pard\ql{\fs18 Treasury Board of Canada Secretariat \par}\brdrt\brdrs\brdrw10\brsp100{\fs18\b Information Technology Security - Audit Guide\b0\par}} {\footer\pard\qr\brdrt\brdrs\brdrw10\brsp100\fs18 {\field{\*\fldinst PAGE} {\fldrslt }} \par} {\field\fldedit{\*\fldinst {INCLUDEPICTURE "http://www.tbs-sct.gc.ca/pol/images/gcsig-wmms.gif" \\d }}\par\par}{\pard\fs48\qc\b Information Technology Security - Audit Guide\b0\fs24\par} {\par\pard \fs36\ql\b Preface\fs24\b0 \par\par} \pard \ql \sb100\sa100 {This guide was prepared by the Information, Communications and Security Policy Division, in consultation with the Evaluation, Audit and Review Group of the Finance and Information Management Branch, Treasury Board Secretariat.}\par \pard\ql Treasury Board Secretariat wishes to acknowledge the support, experience and ideas of the following organizations, without which the development of this guide would not have been possible:\par \pard{\pard{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Communications Security Establishment (CSE)}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{EDP Auditors Association (EDPAA)}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Government of Canada Informatics Organizations (representative departments)}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Government of Canada Internal Auditors (representative departments)}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Industrial & Corporate Security Directorate (ICSD) of PWGSC and}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{RCMP Security Evaluation and Inspection Team (SEIT).}\par }}{\par\pard \fs36\ql\b Introduction\fs24\b0 \par\par} {\pard \fs24\ql\b Background\fs24\b0 \par\par} \pard \ql \sb100\sa100 {In 1990, the (former) Office of the Comptroller General released an exposure draft on {\i Guide to the Audit of Security}.
French: {\rtf1\ansi\deff0 {\fonttbl{\f0\froman\fprq2\fcharset0 Times New Roman;}{\f1\froman\fprq2\fcharset0 Times New Roman;}{\f2\fswiss\fprq2\fcharset0 Arial;}{\f3\fnil\fprq0\fcharset2 StarSymbol{\*\falt Arial Unicode MS};}{\f4\fnil\fprq2\fcharset0 Arial;}{\f5\fnil\fcharset2 Symbol;}} {\colortbl;\red0\green0\blue0;\red128\green128\blue128;} {\stylesheet{\s1\cf0{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\rtlch\af4\afs24\lang255\ltrch\dbch\af4\langfe255\hich\f0\fs24\lang4105\loch\f0\fs24\lang4105\snext1 Normal;} {\s2\sb240\sa120\keepn\cf0{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\rtlch\afs28\lang255\ltrch\dbch\langfe255\hich\f2\fs28\lang4105\loch\f2\fs28\lang4105\sbasedon1\snext3 Heading;} {\s3\sa120\cf0{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\rtlch\af4\afs24\lang255\ltrch\dbch\af4\langfe255\hich\f0\fs24\lang4105\loch\f0\fs24\lang4105\sbasedon1\snext3 Body Text;} {\s4\sa120\cf0{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\rtlch\af4\afs24\lang255\ltrch\dbch\af4\langfe255\hich\f0\fs24\lang4105\loch\f0\fs24\lang4105\sbasedon3\snext4 List;} {\s5\sb120\sa120\cf0{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\rtlch\af4\afs24\lang255\ai\ltrch\dbch\af4\langfe255\hich\f0\fs24\lang4105\i\loch\f0\fs24\lang4105\i\sbasedon1\snext5 caption;} {\s6\cf0{\*\hyphen2\hyphlead2\hyphtrail2\hyphmax0}\rtlch\af4\afs24\lang255\ltrch\dbch\af4\langfe255\hich\f0\fs24\lang4105\loch\f0\fs24\lang4105\sbasedon1\snext6 Index;} {\*\cs8\cf0\rtlch\af3\afs18\lang255\ltrch\dbch\af3\langfe255\hich\f3\fs18\lang4105\loch\f3\fs18\lang4105 Bullet Symbols;} } {\*\listtable{\list\listtemplateid1 {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9679 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li720} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9675 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li1080} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9632 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li1440} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9679 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li1800} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9675 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li2160} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9632 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li2520} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9679 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li2880} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9675 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li3240} {\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9632 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li3600} {\*\soutlvl{\listlevel\levelnfc23\leveljc0\levelstartat1\levelfollow0{\leveltext \'01\u9679 ?;}{\levelnumbers;}\f3\fs18\f3\fs18\f3\fs18\f3\fi-360\li3960}}\listid1} }{\listoverridetable{\listoverride\listid1\listoverridecount0\ls0}} {\info{ {\title Sécurité des technologies de l'information - guide de vérification} {\author TBS/SCT} {\company Government of Canada, Gouvernement du Canada} {\doccomm DocumentID: 12356; Language: fr; VersionID: 1} }} {\header\pard\ql{\fs18 Treasury Board of Canada Secretariat \par}\brdrt\brdrs\brdrw10\brsp100{\fs18\b Sécurité des technologies de l'information - guide de vérification\b0\par}} {\footer\pard\qr\brdrt\brdrs\brdrw10\brsp100\fs18 {\field{\*\fldinst PAGE} {\fldrslt }} \par} {\field\fldedit{\*\fldinst {INCLUDEPICTURE "http://www.tbs-sct.gc.ca/pol/images/gcsig-wmms.gif" \\d }}\par\par}{\pard\fs48\qc\b Sécurité des technologies de l'information - guide de vérification\b0\fs24\par} {\par\pard \fs36\ql\b Préface\fs24\b0 \par\par} \pard \ql \sb100\sa100 {Ce guide a été mis au point par la Division de la politique de l'information, des communications et de la sécurité, en consultation avec le Groupe de l'évaluation, de la vérification et de l'examen du Secrétariat du Conseil du Trésor.}\par \pard\ql Le Secrétariat du Conseil du Trésor tient à remercier les organismes suivants, sans l'appui, l'expérience et les idées desquels ce guide n'aurait pas vu le jour :\par \pard{\pard{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Le Centre de la sécurité des télécommunications (CST)}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{L'Association des vérificateurs du traitement électronique des donnés (TED)}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Les organismes d'informatique du gouvernement du Canada (ministères représentatifs)}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{Les vérificateurs internes du gouvernement du Canada (ministères représentatifs)}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{La Direction de la sécurité industrielle et ministérielle (DSIM) de TPSGC}\par }{\pard\plain{\listtext\pard\plain}\ls0\li720\ri0\lin720\rin0\fi-360{L'Équipe d'inspection et d'évaluation de la sécurité (EIES) de la GRC.}\par }}\pard \ql \sb100\sa100 {{\b N.B. :}}\par \pard\ql {\b {\i Le masculin générique est utilisé sans discrimination et uniquement dans le but d'alléger le texte.}}\par \pard{\par\pard \fs36\ql\b Introduction\fs24\b0 \par\par} {\pard \fs24\ql\b Contexte\fs24\b0 \par\par} \pard \ql \sb100\sa100 {En 1990, l'ancien Bureau du Contrôleur général publiait un exposé-sondage sur le {\i Guide de la vérification de la sécurité}.