Protected B

Protected B is a Canadian government security designation for information and assets. It applies when compromise could cause serious injury to an individual, organization or government. It is a designation, not an abbreviation, and it belongs to the Government of Canada's Protected classification system. The definition appears in the Public Services and Procurement Canada (PSPC) levels of security guidance.

Protected B is not a NATO classification. In federal contracting it appears in the security requirements attached to solicitations and contracts, where it tells a supplier how sensitive information must be handled, who may see it and where it may be kept. Suppliers meet it through screening, secure facilities and prescribed handling controls.

Where Protected B sits among the Protected levels

Protected B is one of three levels in the Protected series, alongside Protected A and Protected C. The level reflects the potential harm from compromise, not the subject matter of the information. Protected B signals a need for safeguards beyond basic protection. The Government of Canada's industrial security manual sets out this injury-based approach.

Because the designation is tied to injury, two documents on very different topics can carry the same level. What matters is the consequence if either is disclosed, altered or lost.

Screening and worksite requirements linked to Protected B

PSPC's security-level table connects Protected B to three requirements:

• An operations-zone worksite
• Designated Organization Screening (DOS) for the supplier organization
• Reliability Status for personnel

The Contract Security Manual states that Protected A and Protected B information and assets should be processed, stored and destroyed in an operations zone or higher. The exact requirement still depends on the solicitation and the contract.

Handling controls for Protected B information

PSPC publishes work site security requirements that set out specific controls. They include locked-cabinet storage in an operations zone for paper and certain electronic media, approved encryption or public-key-infrastructure encryption for email, and destruction methods that meet applicable standards.

An RCMP security guide published on CanadaBuys adds requirements for electronic transmission. These include approved portable storage, encryption at rest and in transit, and access controls. The same guide's information-level table maps Canadian Protected B to NATO Restricted.

Where Protected B appears in federal procurement

Protected B shows up across several federal buyers and vehicles:

• PSPC uses it in security requirements for contracts involving sensitive government information or assets.
• PSPC offers a Protected B Software as a Service supply arrangement for cloud services that handle Protected B information. It is listed on the PSPC software acquisitions page.
• The Canada Revenue Agency's procurement security clauses state that information, assets and services under specified contracts may be classed as CRA Protected A or Protected B, or both.
• The RCMP applies the designation in its security guides, as noted above.

What Protected B means for a supplier bidding on Canadian public contracts

Check the security requirements section of every solicitation before you commit to bid. If it names Protected B, confirm that your organization holds the required organization screening and that the staff who will touch the information hold Reliability Status. Confirm also that your premises and systems can store, transmit and destroy the information as the contract prescribes. Gaps in any of these areas can rule out a bid or delay contract start, so address them early. For software and cloud services, check whether the Protected B Software as a Service supply arrangement is the intended route to market.