Security Requirements Check List (SRCL)

The Security Requirements Check List (SRCL) is the Government of Canada form used to identify and document the security requirements that apply to a procurement. It covers the information and assets a supplier will handle, the access and personnel screening required, the safeguarding expected, and other security conditions attached to the work. It is associated with Treasury Board form TBS/SCT 350-103, as set out on the Treasury Board form page.

Government guidance states that requisitions and tender or contractual documents containing PROTECTED and/or CLASSIFIED requirements must be accompanied by a completed SRCL. In procurement, the form is administered by Public Services and Procurement Canada (PSPC) and by departmental security authorities. For a supplier, the SRCL is the document that tells you what security obligations come with a contract.

What the SRCL records

The SRCL captures the level and type of information a supplier will need to access. It can record Canadian classifications: PROTECTED A, PROTECTED B, PROTECTED C, CONFIDENTIAL, SECRET and TOP SECRET. It can also record NATO classifications: NATO UNCLASSIFIED, NATO RESTRICTED, NATO CONFIDENTIAL, NATO SECRET and COSMIC TOP SECRET.

• Whether the supplier or its employees will need access to PROTECTED and/or CLASSIFIED information or assets.
• Whether the supplier will need access to Controlled Goods.
• Personnel security screening and site access.
• Communications security and information technology security.
• Physical safeguarding of information and assets.

A sample form attached to a CanadaBuys tender shows these questions in practice in the SRCL appendix to a solicitation.

Who completes and approves the SRCL

Responsibility is split between several roles. The project authority arranges completion of the form. The organization security officer reviews and approves the security requirements identified in it. The contracting security authority then ensures that the supplier complies.

This sequence means the SRCL is settled by the buying organization before the solicitation reaches suppliers. Suppliers do not fill in the requirements. They respond to what the department has already determined.

Where the SRCL appears in Canadian procurement

The SRCL turns up across several kinds of federal buying.

• Centralized professional services: PSPC publishes common SRCLs for these procurements. The security clauses and electronic SRCL are forwarded to procurement for inclusion in the solicitation documents.
• Contracts and call-ups: The completed and signed SRCL and the security clauses are attached to the contract.
• Subcontracts: Subcontracts that contain protected or classified requirements must also include a completed SRCL.
• RCMP solicitations: CanadaBuys tender documents show the RCMP attaching an SRCL and a security guide to its solicitations.

Because the form can specify Canadian and NATO classifications, it is especially relevant to defence, military, controlled goods and secure information system procurements.

The SRCL compared with the NATO Security Requirement Statement

The SRCL is not the same as NATO's Security Requirement Statement (SRS). NATO security material describes an SRS, or a national equivalent, as a complete statement of the security principles and detailed security requirements for a system or project. The NATO directive on the SRS sets out that scope. The Canadian SRCL is the procurement form used to capture applicable requirements, including NATO-related ones where relevant.

What the SRCL means for a supplier

Read the SRCL and its security clauses as soon as they appear in a solicitation. Identify the organization, personnel, site, information, technology and asset safeguards they require. Then obtain or maintain the clearances and registrations needed before contract award or performance.

The timing matters. PSPC guidance states that the supplier must meet the security requirements before the procurement officer signs the SRCL and issues the call-up or awards the contract. A bid team that starts clearance work only after winning is already behind. Check any subcontractors against the same requirements, since the SRCL extends to subcontracts with protected or classified content.