Verifying compliance with security requirements

Verifying compliance with security requirements is the step in Canadian federal contracting where a department confirms and documents that a supplier has put in place the security requirements that apply to a contract. It happens before contract award, before the government enters into an arrangement, and before anyone is given access to sensitive information, assets or sites.

The wording comes from the Government of Canada's Policy on Government Security and its Mandatory Procedures for Security in Contracts and Other Business Arrangements. Verification follows the risk-based approach set for the specific contract or arrangement, and it continues throughout the contracting process rather than ending at award. The requirement is set out in the Treasury Board policy text.

What the federal procedures require

The mandatory procedures cover security requirements for physical facilities, information systems, and administrative and operational controls. They also reach subcontracts, third parties, and certain international or defence arrangements. Departments must establish a process for verifying and monitoring continued compliance, including any permitted exceptions and the risk-mitigation measures that go with them.

Monitoring does not stop once a contract is signed. The procedures on security in contracts call for continued monitoring of supplier, partner and departmental compliance, with corrective action when there is non-compliance, a security incident or another security event.

The Security Requirements Check List and the Contract Security Program

A contract's security requirements are normally documented in a Security Requirements Check List (SRCL). Requisitions and amendments for contracts, standing offers or supply arrangements that contain security requirements must include an SRCL, the statement of work and the relevant security documents. The steps are described in the guide to completing the Security Requirements Check List.

Public Services and Procurement Canada (PSPC) carries out much of the verification through its Contract Security Program (CSP). In the federal responsibilities matrix between PSPC and clients, verifying compliance with security requirements is listed as a PSPC responsibility delivered through the CSP.

Verification before award

Before awarding a contract, the buyer must confirm that the offeror meets the security conditions in the solicitation. That includes verifying the offeror's security status through the CSP and ensuring that mandatory clearances are obtained before work begins. The elements to consider at award also state that where an offeror is foreign-based, or the contract involves foreign classified information or foreign sites, the buyer must verify compliance with Canada's international security obligations through the CSP.

For call-ups against standing offers and contracts against supply arrangements, the technical authority is responsible for verifying that the contractor meets the necessary security requirements. PSPC's common security checklists require the procurement officer to ensure the supplier meets all security requirements before signing the SRCL certification block and issuing a call-up or awarding the contract.

Verification during contract performance

Verification continues while the work is under way. Clients must confirm that contractor and subcontractor personnel who need access to protected or classified information, assets, sensitive sites, government systems or cloud portals have recognized contract-affiliate status and valid security statuses under the CSP. The contract management guidance on security sets out this obligation.

What this means for a supplier

• Check the solicitation for an SRCL and its security conditions before you bid.
• Confirm your organization's security status, and that of any personnel and subcontractors, is in place before work begins.
• Expect the buyer to verify your status through the CSP before award, and again when new personnel need access.
• Keep statuses valid for the full contract term, since monitoring and corrective action continue after award.
• If you are foreign-based, or the work involves foreign classified information or sites, expect additional verification under Canada's international security obligations.