Using or providing cloud solutions for controlled goods technical data

Are you a registrant in the Government of Canada’s Controlled Goods Program that uses or provides cloud solutions to store data? If so, then you have a shared responsibility to ensure that controlled goods technical data is properly safeguarded in the cloud. 

For individuals and organizations registered in the Controlled Goods Program: 

  • Only use cloud solutions provided by cloud service providers registered with the Controlled Goods Program 
  • Inform your cloud service provider of your intention to use their cloud solutions for controlled goods technical data 
  • Encrypt your controlled goods technical data when uploading or transferring data to the cloud
  • Restrict access to your controlled goods technical data to individuals who have been security assessed under section 15 of the Controlled Goods Regulations
  • Report security breaches affecting your cloud-stored controlled goods technical data to the Controlled Goods Program

For cloud service providers: 

  • To store controlled goods technical data, cloud service providers must be registered with the Controlled Goods Program
  • Request that your clients disclose whether they intend to use your cloud solutions for controlled goods technical data 
  • Implement a security plan detailing the controls used to protect the physical assets and locations for your cloud solutions, as well as the cloud environment itself
  • When providing technical assistance, if access to a client’s controlled goods technical data is unavoidable, ensure that only employees who have been security assessed under section 15 of the Controlled Goods Regulations have access to this data 

Please see our communiqué for additional guidance on using or providing cloud solutions for controlled goods technical data.

For more information or questions

Learn more about the Controlled Goods Program, including how controlled goods are regulated and what this means for you or your organization.

If you have any questions, please contact the Controlled Goods Program.

Date modified: