<?xml version="1.0" encoding="iso-8859-1"?><doc title="Directive on Security Management - Appendix I: Standard on Security Event Reporting" documentID="32613" versionID="1" language="en" space="preserve" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="G:\web\xml\pols\PolicyInstrumentSchema.HTML5.xsd"><notetoreader>The Standard on Security Event Reporting took effect on March 1, 2024.</notetoreader><chapters><chapter anchor="Appendix I" title="Standard on Security Event Reporting"><chapter anchor="I.1" title="Effective date"><clauses><clause anchor="I.1.1">This standard takes effect on March 1, 2024.</clause><clause anchor="I.1.2">This standard replaces the <em>Standard on Security Event Reporting</em> dated July 1, 2019.</clause></clauses></chapter><chapter anchor="I.2" title="Standards"><clauses><clause anchor="I.2.1">This  standard provides details on the requirements set out in section 4.1.7.</clause><clause anchor="I.2.2">Procedures  are as follows:
    <clauses><clause anchor="I.2.2.1"><strong>National  security concerns: </strong>National  security concerns, including those related to terrorism or controlled goods, must  be reported to <strong>all</strong> of the following: 
     <ol class="lst-lwr-alph"><li>Canadian  Security Intelligence Service (CSIS) by telephone at 613-993-9620; </li><li>Royal  Canadian Mounted Police (RCMP) National Operations Centre (NOC) by telephone at  613-993-4460; and </li><li>Office  of the Chief Security Officer, Privy Council Office (PCO) </li></ol></clause><clause anchor="I.2.2.2"><strong>Security  incidents and other security events: </strong>Security incidents and other security  events that will have, or are likely to  have, a significant impact on federal departments or agencies, or that require  an immediate or coordinated government-wide  response, must be reported without delay to the Government Operations Centre (GOC)  by telephone at 613-991-7000 or by e-mail at <a href="mailto:GOC-COG@ps-sp.gc.ca">GOC-COG@ps-sp.gc.ca</a> and to the Office of the Chief Security Officer, PCO by telephone at  613-960-4000 or by e-mail at <a href="mailto:CMC-CGC@pco-bcp.gc.ca">CMC-CGC@pco-bcp.gc.ca</a>. </clause><clause anchor="I.2.2.3"><strong>Cyber  security incidents and events:</strong> Cyber  security incidents and other security events related to information technology  (IT) must be reported in accordance with the <a href="https://www.canada.ca/en/government/system/digital-government/online-security-privacy/security-identity-management/government-canada-cyber-security-event-management-plan.html">Government of Canada Cyber Security Event Management Plan</a> (GC  CSEMP). </clause><clause anchor="I.2.2.4"><strong>Suspicious activity:</strong> Suspicious activity or behaviour that has a  possible nexus to national security or that may be an indicator of serious  criminal activity must be reported to the RCMP National Critical  Infrastructure Team (NCIT) by email at <a href="mailto:SIR-SIS@rcmp-grc.gc.ca">SIR-SIS@rcmp-grc.gc.ca</a></clause><clause anchor="I.2.2.5"><strong>Readiness  levels:</strong> Departmental decisions to activate higher  levels of readiness and to return to lower levels of readiness must be reported  without delay to the Office of the Chief Security Officer, PCO, by telephone at  613-960-4000 or by email at <a href="mailto:CMC-CGC@pco-bcp.gc.ca">CMC-CGC@pco-bcp.gc.ca</a>.</clause><clause anchor="I.2.2.6"><strong>Breach of trust:</strong> Security  events related to alleged breach of trust must be reported to the RCMP Federal  Policing Intake Unit by email at <a href="mailto:Federal_Policing_Intake_Unit@rcmp-grc.gc.ca">Federal_Policing_Intake_Unit@rcmp-grc.gc.ca</a> (reports  or calls may be redirected to local law enforcement organizations, as  appropriate).</clause><clause anchor="I.2.2.7"><strong>Other  criminal activity:</strong> Security events related to other potential criminal activity (for example,  physical thefts of government assets) must be reported to the local police.</clause><clause anchor="I.2.2.8"><strong>Controlled  goods and contractors:</strong> Incidents related to controlled goods and that involve contractors must be  reported to Public Services and Procurement Canada’s Controlled Goods Program by email  at <a href="mailto:dmc-cgd@tpsgc-pwgsc.gc.ca">dmc-cgd@tpsgc-pwgsc.gc.ca</a>. </clause><clause anchor="I.2.2.9"><strong>Accountable  COMSEC material:</strong> Incidents  that involve accountable communications security (COMSEC)  material must be reported to the chief security officer of the department where  the COMSEC incident occurred.</clause><clause anchor="I.2.2.10"><strong>Cabinet confidences:</strong>All security incidents  and other security events of significance  involving Cabinet confidences must be reported to the Office of the Chief Security  Officer, PCO by telephone at 613-960-4000 or by email at <a href="mailto:CMC-CGC@pco-bcp.gc.ca">CMC-CGC@pco-bcp.gc.ca</a>.</clause><clause anchor="I.2.2.11"><strong>Privacy breaches:</strong> Material privacy breaches must be  reported in accordance with the <a href="https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=18309&amp;section=procedure&amp;p=B">Directive on Privacy Practices, Appendix B: Mandatory Procedures for Privacy Breaches</a>.</clause><clause anchor="I.2.2.12"><strong>Policy monitoring:</strong> Security incidents and other security  events of significance must be reported to the Treasury Board of Canada Secretariat by email at <a href="mailto:SEC@tbs-sct.gc.ca">SEC@tbs-sct.gc.ca</a> on a cyclical basis or on request,  for the purposes of government-wide policy monitoring.</clause><clause anchor="I.2.2.13"><strong>Criminal  record information:</strong> Issues  related to criminal record information by law enforcement agencies must be directed  to the RCMP Canadian Criminal Real Time Identification Services by email at <a href="mailto:CCRTIS-SCICTR@rcmp-grc.gc.ca">CCRTIS-SCICTR@rcmp-grc.gc.ca</a>.</clause></clauses></clause></clauses></chapter></chapter></chapters></doc>