Security Requirement Check List (SRCL)

The Security Requirements Check List (SRCL) is the Government of Canada form used to identify and define the security requirements that apply to a contract or subcontract. It records the type and level of protected, classified, NATO or foreign information and assets a supplier may need to access, along with related personnel, site and safeguarding requirements. The standard form is designated TBS/SCT 350-103 and is published by the Treasury Board Secretariat on canada.ca.

The SRCL is a federal contracting-security instrument, not an internal checklist. Under the Contract Security Program administered by Public Services and Procurement Canada (PSPC), it is used at the start of the procurement process to establish the security requirements that must be reflected in the solicitation and the resulting contract.

What the TBS/SCT 350-103 form records

The form distinguishes between Canadian, NATO and foreign information. For Canadian information, it covers the levels PROTECTED A, PROTECTED B, PROTECTED C, CONFIDENTIAL, SECRET and TOP SECRET. For NATO information, it covers NATO UNCLASSIFIED, NATO RESTRICTED, NATO CONFIDENTIAL, NATO SECRET and COSMIC TOP SECRET. It also identifies release restrictions on that information.

• The type and level of information and assets the supplier may need to access
• Personnel security requirements for the people doing the work
• Site and safeguarding requirements for handling and storing the information

Because the form names NATO categories directly, it is the instrument used when a Canadian procurement involves access to NATO information or assets.

When an SRCL is required in federal procurement

The form itself states that all requisitions and subsequent tender or contractual documents containing protected or classified requirements must be accompanied by a completed SRCL. The Treasury Board Security and Contracting Management Standard requires departments to use the Security Requirements Checklist for contracts for which PSPC is the contracting authority. The requirement also applies to call-ups against standing offers when security requirements are present, and to supply arrangements and subcontracts.

PSPC also publishes common security requirement check lists for standardized professional-services procurements, which are numbered common PS SRCLs.

Who completes the SRCL and what it does not replace

The project authority completes the SRCL at the beginning of the procurement process to outline the contract's security requirements. The contracting authority then ensures that the approved security clauses and related remarks are included in the solicitation and contract. These security requirements form part of the legally binding contract documentation, as set out in the PSPC Contract Security Manual.

The SRCL does not replace the security clauses in the contract. Those clauses specify the security obligations. The SRCL supports the identification of the clauses and is accompanied by the applicable security guide and Contract Security Manual requirements.

For subcontracts with security requirements, the prime contractor's company security officer or alternate company security officer must complete an SRCL. It identifies the subcontract's requirements in relation to the prime contract. PSPC sets this out in its guidance on subcontracting security requirements.

What an SRCL means for a supplier bidding on Canadian public contracts

When a solicitation includes an SRCL, the security requirements are binding contract terms. A contractor or offeror must comply with the SRCL, the applicable security guide and the Contract Security Manual. Read the SRCL and security guide attached to the bid documents, such as an annex to the solicitation, before you decide to bid.

Your company security officer must ensure that the requirements are met throughout the contract lifecycle and before personnel access protected or classified information. If you plan to subcontract any part of the work that carries security requirements, your company security officer completes a separate SRCL for that subcontract.