Using or providing cloud solutions for controlled goods data

Are you a registrant in the Government of Canada’s Controlled Goods Program who uses or provides cloud solutions to store data? If so, then you have a responsibility to ensure that controlled goods data is properly safeguarded in the cloud.

Individuals and organizations registered in the Controlled Goods Program should: 

• only use cloud solutions provided by cloud service providers registered with the Controlled Goods Program 
• encrypt their controlled goods data when uploading or transferring data to the cloud
• restrict access to their controlled goods data to individuals who have been security assessed under section 15 of the Controlled Goods Regulations
• report security breaches affecting their cloud-stored controlled goods data to the Controlled Goods Program

Cloud service providers should: 

• register with the Controlled Goods Program to be able to store controlled goods data
• implement a security plan detailing the controls used to protect the physical assets and locations for their cloud solutions as well as the cloud environment itself
• ensure that only employees who have been security assessed under section 15 of the Controlled Goods Regulations have access to a client’s controlled goods data when providing technical assistance  

Please see our communiqué for additional guidance on using or providing cloud solutions for controlled goods data.

For more information or questions

Learn more about the Controlled Goods Program, including how controlled goods are regulated and what this means for you or your organization.

If you have any questions, please contact the Controlled Goods Program.