Statement of Sensitivity.

The Statement of Sensitivity records what the system does, what data it handles, and what would happen if that data were exposed, altered, or lost. Every other SA&A artifact inherits from the categorization declared here.

1 · System identification

Formal name, acronym, sponsor, service owner, and the SSP version this SoS supports. If this SoS is a revision, cite the prior revision and the reason for the change.

2 · Business context

The mission the system supports, the user populations it serves, and the business outcomes that would be affected by a security event. Two to four short paragraphs; no marketing prose.

3 · Information types and CIA

Each information type is rated for confidentiality, integrity, and availability, with a one-line rationale grounded in the injury it would cause if compromised.

4 · Aggregate categorization

The high-water mark from §3 becomes the aggregate categorization for the system. Departures from the high-water rule require an explicit justification.

5 · Injury assessment

Prose statements of the injury a security event would cause — to individuals, the department, the Government of Canada, and to the national interest. These statements must read like they would motivate the categorization on their own.

6 · Special information categories

Personal information, Cabinet confidences, cryptographic material, and other special categories that trigger additional obligations. Cite the PIA identifier if personal information is in scope.

7 · Downstream artifact map

Which artifacts inherit from this SoS — the TRA, the SSP, the SRTM, the PIA — and where each of them lives. This is the map an assessor uses to navigate the SA&A package.

Approvals

The signatures below confirm that the responsible parties have reviewed this document, that its contents accurately reflect the system, and that the recorded decisions are authorized.