Conduct an audit of cybersecurity practices at the CSA

The Audit and Evaluation Directorate (AED) of the CSA is requesting the services of a contractor to conduct an audit of cybersecurity practices at the CSA. The objective of the audit is to determine whether a management framework is in place at the CSA to identify cybersecurity threats and vulnerabilities, mitigate cybersecurity risks, and comply with relevant laws, policies, regulations and guidelines issued by the CSA and the central agencies.

The audit will cover all cybersecurity activities under the responsibility of the CSA with regard to planning, internal policies, roles and responsibilities, training and awareness, and key controls in the following areas:

• System access management
• Management of cybersecurity operations (fixes/patches, portable storage media, vulnerabilities, and incidents)
• Management of secure development and systems strengthening

The audit will also assess interactions with Shared Services Canada (SSC) and the Canadian Centre for Cyber Security (CCCS), although the activities of SSC or CCCS are not within the scope of the audit.