This document provides an overview of an employee's responsibilities regarding information security as a government of Canada employee. It discusses classifying documents as protected or classified based on the potential harm if compromised. It also covers marking documents with security classifications, appropriate storage and handling of sensitive materials, distributing information on a need-to-know basis, removing classifications when no longer needed, and destroying materials securely. The document aims to ensure employees are aware of proper processes for managing sensitive information throughout its lifecycle within the government.

1. Information Security

2. Your responsibilities as a
Government of Canada employee

3. AT THE END OF THIS MODULE YOU WILL:
• Be aware of your responsibilities with respect to
information security.
• Be able to decide what protection or classification is
appropriate for your information.
• Understand how to mark sensitive documents.
• Be able to make appropriate choices for the storage of
sensitive materials.
• Know the appropriate methods of communication and
destruction of sensitive materials.
• Understand the importance of removing or changing
the level of protection or classification of information.

4. GENERAL RESPONSIBILITIES
• You must apply diligence and due care during
the:
– Creation or collection of sensitive
information;
– Use, distribution, storage and retention of
sensitive information;
– Declassification/change in classification or
protection of sensitive information;
– Disposal or destruction of sensitive
information.

5. IN OTHER WORDS…
You must apply
diligence and
due care during the
entire life cycle of
sensitive information.
ChooseChooseChoose Use, distribute,
share, store and
retain
Choose
Choose disposal
method
appropriate to
sensitive material
Establish
sensitivity at
point of
creation
Remember to
change
classification /
protection when
appropriate

6. SPECIFIC RESPONSIBILITIES
As the originator, or recipient, of sensitive documents you must:
1. Decide what level of protection or classification is
appropriate;
2. Mark the document(s) from draft to completion;
3. Ensure documents are processed and stored according to
the level of protection or classification assigned;
4. Distribute the information to others who are appropriately
screened and on a need to know, need to access basis;
5. Remove or change the level of protection/classification of
information when required;
6. Ensure the appropriate destruction of sensitive documents.

7. Responsibility #1
Deciding what level of protection or
classification is appropriate

8. SECURITY CATEGORIES
There are two main security categories that you
would apply, based on a document’s content:
Protected
• Protected C
• Protected B
• Protected A
Classified
• Top Secret
• Secret
• Confidential

9. CLASSIFIED PROTECTED
Classified refers to
information that, if
compromised, may cause
injury to the national
interest.
Protected refers to information
that is not related to the national
interest, but if compromised,
may cause injury to private or
other non-national interests.
This information
could cause injury
to the country.
This information could
cause injury to an
individual or to a
company.

10. CLASSIFIED PROTECTED
Top Secret
extremely sensitive information related to
international affairs, law enforcement
investigations and intelligence matters
(cause exceptionally grave injury)
Secret
trade talks, minutes and memos to
cabinet, enterprise planning, departmental
input to national budget, draft legislation
(cause serious injury)
Confidential
international affairs, administrative plans,
audits, negotiations between departments
and partners (cause injury)
Protected C
information about police agents and other
informants (cause life threatening and/or
extremely grave injury)
Protected B
law enforcement and medical records,
personnel evaluations and investigations,
financial records, solicitor-client
confidence (particularly sensitive, cause
serious injury)
Protected A
home addresses, dates of birth, SIN
numbers, other personal information
(low-sensitivity, could cause injury)
This information could cause injury
to the country. This information could cause injury
to an individual or to a company.

11. Responsibility #2
Marking your sensitive documents
from draft to completion.

12. MARKING SENSITIVE DOCUMENTS
1. You need to mark sensitive information at the
time it is created or collected.

13. MARKING SENSITIVE DOCUMENTS
2. You need to mark all material used in
preparing sensitive documents.

14. MARKING SENSITIVE DOCUMENTS
3. When marking you need to include,
where appropriate:
–The sensitivity level (CAPS);
–The date of creation; and
–The date or event when automatic
removal of designation or change in
the protection of information is to
occur.
Note: Top Secret documents require a
copy number and an indication of the
total number of copies (e.g. copy 1 of
6). All pages should be numbered and
the total number of pages shown on all
pages (e.g. 1 of 3).
SECRET
Created: Dec. 4, 1989
Declassify: Dec. 4, 2009

15. MARKING SENSITIVE DOCUMENTS
4. Indicate who may, or may not, have access to
the document. Access should be on a need to
know basis.
5. When you create cover letters or transmittal
forms you must indicate the highest level of
sensitivity of all of the attachments.

16. At the OIC, use annex B of the IM
Manual: Managing Sensitive
Records.

17. REVIEW: MARKING SENSITIVE DOCUMENTS
1. Mark sensitive information at the time it is created or
collected.
2. Mark all material used in preparing sensitive documents.
– Markings are to include, where appropriate:
– The sensitivity level;
– The date of creation;
3. The date or event when automatic removal of designation
or change in the protection of information is to occur.
4. Indicate who may, or may not, have access to the
document.
5. Cover letters or transmittal forms must indicate the highest
level of sensitivity of the attachments.

18. Don’t forget to
mark electronic media!

19. MARKING ELECTRONIC MEDIA
You should clearly record on the surface of electronic
media, the following information:
– Name of the organization
– Highest level of designation or protection
– Subject of the documents
– Team the documents belong to
– Custodian’s name.

20. Responsibility #3
Ensuring that documents are processed
and stored according to the level of
classification or protection assigned

21. ELECTRONIC PROCESSING OF SENSITIVE
MATERIALS
Non-Sensitive
Process, email, print
• Network PC
• Stand-alone PC
• Laptop
• Blackberry/cell
Protected A
Process, email, print
• Network PC
• Stand-alone PC
• Laptop
Protected B
Process, email, print
• Network PC
• Email (PKI only)
• Stand-alone PC
• Laptop
Protected C
Process, print (no
email)
• Stand-alone PC or
Laptop
Confidential
Process, print (no
email)
•Stand-alone PC or
Laptop
Secret
Process, print (no
email)
•Stand-alone PC or
Laptop
Top Secret
Process, print (no
email)
•Stand-alone PC or
Laptop

22. STORING ELECTRONIC SENSITIVE
MATERIALS
Non-sensitive
• RDIMS
• Shared drive
• Hard drive
• Removable media,
e.g., CD, jump drive
Protected A
• RDIMS
• Shared drive (limit
access)
• Removable media,
e.g., CD, jump drive
(labeled and locked in
an approved
container, when not in
use)
Protected B
• RDIMS
• Shared drive (limit
access)
• Removable media,
e.g., CD, jump drive
(labeled and locked in
an approved
container, when not in
use)
Protected C
Removable media,
e.g., CD, jump drive
(labeled and locked in
an approved container,
when not in use)
Confidential
Removable media,
e.g., CD, jump drive
(labeled and locked in
an approved container,
when not in use)
Secret
Removable media,
e.g., CD, jump drive
(labeled and locked in
an approved container,
when not in use)
Top Secret
Removable media,
e.g., CD, jump drive
(labeled and locked in
an approved container,
when not in use)

23. STORING NON-ELECTRONIC CLASSIFIED OR
PROTECTED MATERIAL
Protected A
Approved security
container, e.g., cabinet with
an approved lock in an
operational zone
Protected B
Approved security
container, e.g., cabinet with
an integrated lock in an
operational zone
Protected C
Approved security
container, e.g., cabinet with
an integrated lock in an
approved security zone
(enclosed office or room
with a door that can be
locked)
Confidential
Approved security
container, e.g., cabinet with
an integrated lock in an
operational zone
Secret
Dial safe in an approved
security zone
Top Secret
Dial safe in an approved
security zone

24. Responsibility #4
Distribute sensitive information to others
on a need to know, need to access basis

25. DISTRIBUTION OF SENSITIVE
DOCUMENTS
Access Criteria:
– Recipients have a requirement to know;
– Recipients hold an appropriate security
clearance.
It is your responsibility to verify that the
recipient of your sensitive document meets
access criteria.

26. COMMUNICATION MODES FOR SENSITIVE
DOCUMENTS
Non-sensitive
• Regular phone and
fax
• Email
• Blackberry and cell
phone
Protected A
• Regular phone and
fax
• Email
Protected B
• Regular phone and
fax
• Email (PKI only)
Protected C
• Regular phone
• Secure fax
(No email)
Confidential
• Secure phone
• Secure fax
(No email)
Secret
• Secure phone
• Secure fax
(No email)
Top Secret
• Secure phone
• Secure fax
(No email)

27. TRANSMITTAL OF SENSITIVE DOCUMENTS
Paper documents that are sensitive should be handled with
discretion and common sense applying such principles as:
– Markings and caveats should be used to caution others
about the sensitivity of the material;
– Mail should be addressed “to be opened only by…”;
– Double envelope with security markings on inner
envelope only – for Secret, Top Secret and Protected C;
– Phone ahead when sending sensitive faxes.

28. OIC NETWORK
Information with a designation higher than
Protected B should not be sent via email,
saved on network shared drives or in RDIMS.
Note: Protected B
information can be sent
over the network using
PKI

29. Responsibility #5
Removing or changing the level
of protection or classification of
information when required

30. DECLASSIFICATION VERSUS
DOWNGRADING
Declassification: removal
of sensitivity rating
Downgrading: reducing
level of sensitivity rating
(e.g. from Secret to
Confidential)
Confidential

31. DECLASSIFICATION AND DOWNGRADING
• Protected information will lose its sensitivity:
– over time; or
– with the occurrence of specific events (e.g. scientific data
when published loses its protected status).
• Declassification or downgrading can be effected through:
– date or special event triggers;
– an automatic expiry date; (Note: automatic expiry does not
apply to Top Secret or Protected C)
– originating authors;
– managers (in originating office).
• You should systematically review your sensitive materials with the
intent of declassifying or downgrading them as appropriate.

32. Responsibility #6
Ensure the appropriate destruction
of sensitive documents

33. DESTRUCTION OF SENSITIVE
DOCUMENTS
Paper Electronic
Protected A Classified waste disposal or
destroy in approved cross-
cut shredder
Delete from media
Protected B Classified waste disposal or
destroy in approved cross-
cut shredder
Delete from media and
re-format drive
Protected C Classified waste disposal or
destroy in approved cross-
cut shredder
Degauss media
Degauss: A process by which a
computer hard drive is
unformatted by randomly
scrambling the bits on the drive
Confidential,
Secret, Top Secret
Destroy in approved cross-
cut shredder
Degauss and physically
destroy media

34. REVIEW: INFORMATION SECURITY
As the originator of sensitive documents or the recipient of sensitive
documents sent by the public, you must:
1. Decide what level of protection or classification is
appropriate;
2. Mark the document(s) from draft to completion;
3. Ensure documents are processed and stored according to
the level of protection or classification assigned;
4. Distribute the information to others who are appropriately
screened and on a need to know, need to access basis;
5. Remove or change the level of protection and classification
of information when required;
6. Ensure the appropriate destruction of sensitive documents.

35. In closing…
Some guiding principles
of information security

36. GUIDING PRINCIPLES OF INFORMATION
SECURITY:
• Security classification flows with the information:
– Originator decides on level of security;
– Receiver must accept the assigned classification.
– Note: Information received from the public must
be assessed and assigned either a protected or
classified level where appropriate.
• When incorporating information into existing
classified/protected documents or other media –
ensure that the new document is also classified at
the level of the highest document in the file or
storage device.

37. GUIDING PRINCIPLES OF INFORMATION
SECURITY:
• A package of information is “marked” based on
the document with the highest classification.
• Sensitive information should be reviewed
periodically with the intent of “declassifying” or
“downgrading” when appropriate.
• Over-classification must be avoided – it is costly
and it minimizes the potential uses of the
information.

38. CONGRATULATIONS!
• You have just completed Information Security – an IM self-study
module.
– You may now:
– Test your knowledge with the following quiz.
• Review other IM self-study modules in this series:
• Information Management 101
• Managing Email Effectively
• Records Management and You!
• IM and the Departing Employee
• Privacy and Personal Information – What Canadians
Expect
• Understanding IM Within the Federal Government