Prepare for ITSP.10.171 with evidence collected automatically
ITSP.10.171 is the Canadian Centre for Cyber Security's publication "Protecting specified information in non-Government of Canada systems and organizations", a Canadian version of NIST SP 800-171 Rev. 3. It sets out security requirements that federal departments and agencies place in contracts to protect the confidentiality of specified information held by suppliers. It took effect on 2 April 2025 and keeps the same technical content and numbering as the US publication.
Is ITSP.10.171 right for your organisation?
ITSP.10.171 applies to organizations whose systems handle, process, store or transmit Government of Canada specified information under a contract or other agreement. It matters most to defence suppliers, as the Canadian Program for Cyber Security Certification builds on it, but any federal contract can call it up. Organizations usually start when a contract or request for proposals names it.
It is usually required by customers, partners or schemes rather than by law.
- Full title
- Protecting specified information in non-Government of Canada systems and organizations
- Issued by
- Canadian Centre for Cyber Security (Cyber Centre)
- In effect since
- 2 April 2025 (second release 28 October 2025)
- Based on
- NIST SP 800-171 Rev. 3, adapted to Canadian laws and policies
- Structure
- 98 requirements in 17 families
- How it applies
- Through contracts and agreements with Government of Canada departments and agencies
- Assessment guide
- ITSP.10.171-01, in effect since 20 April 2026, based on NIST SP 800-171A Rev. 3
- Type
- Guidance (contractual)
- Region
- Canada, Canada
- In OneClickComply
- Supported today
OneClickComply makes it simple
OneClickComply supports ITSP.10.171 today. Because its requirements share their structure with NIST SP 800-171, evidence you already collect for frameworks such as ISO 27001 or NIST can count towards it through control mapping. Automated evidence collection, policy generation and continuous monitoring then keep your system security plan and plan of action current.
Requirements covered
98 security requirements across 17 families (03.01 Access control to 03.17 Supply chain risk management), keeping NIST SP 800-171 Rev. 3 numbering with withdrawn items marked "not allocated" and adding 03.14.09 Dedicated administration workstation.
Manual ITSP.10.171 vs. OneClickComply
- Reading 98 requirements and their organization-defined parameters line by line in a long government document
- Collecting screenshots and exports from every system that holds specified information
- Writing a system security plan and policies for 17 families from blank templates
- Tracking gaps and plans of action in spreadsheets that fall out of date
- Repeating the same work for ISO 27001, NIST or customer questionnaires
- Each requirement is mapped to clear controls with the evidence it needs
- Evidence is collected automatically from connected tools and logged as you go
- Policies are generated from your environment, ready for review and approval
- Gaps and remediation are tracked in one place with monitoring that flags drift
- Evidence collected once counts towards every framework it maps to
Everything you need for ITSP.10.171
All 98 ITSP.10.171 requirements mapped to controls in one library
Automated evidence from cloud, identity and device tools for access, logging and configuration requirements
AutoComplete policies covering all 17 requirement families, built from your real environment
System security plan and plan of action support, with gaps tracked in one place
Continuous monitoring that alerts you when a control drifts out of compliance
Supply chain and vendor risk management for the 03.17 requirements
Three steps to ITSP.10.171 compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against ITSP.10.171 and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates ITSP.10.171-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
ITSP.10.171 requirements
All 98 allocated ITSP.10.171 security requirements in their 17 families, with the requirements marked "not allocated" (withdrawn in NIST SP 800-171 Rev. 3) left out.
| Reference | Requirement |
|---|---|
| 03.01.01 | Account management |
| 03.01.02 | Access enforcement |
| 03.01.03 | Information flow enforcement |
| 03.01.04 | Separation of duties |
| 03.01.05 | Least privilege |
| 03.01.06 | Least privilege: privileged accounts |
| 03.01.07 | Least privilege: privileged functions |
| 03.01.08 | Unsuccessful logon attempts |
| 03.01.09 | System use notification |
| 03.01.10 | Device lock |
| 03.01.11 | Session termination |
| 03.01.12 | Remote access |
| 03.01.16 | Wireless access |
| 03.01.18 | Access control for mobile devices |
| 03.01.20 | Use of external systems |
| 03.01.22 | Publicly accessible content |
| 03.02.01 | Literacy training and awareness |
| 03.02.02 | Role-based training |
| 03.03.01 | Event logging |
| 03.03.02 | Audit record content |
Always check the official ITSP.10.171 text for the exact wording.
ITSP.10.171 FAQs
What is ITSP.10.171?
ITSP.10.171 is a Canadian Centre for Cyber Security publication titled "Protecting specified information in non-Government of Canada systems and organizations". It is a Canadian version of NIST SP 800-171 Rev. 3 and lists 98 security requirements in 17 families. Government of Canada departments and agencies use it in contracts to require suppliers to protect the confidentiality of specified information held on the supplier's own systems.
Who needs to comply with ITSP.10.171?
Organizations need to comply with ITSP.10.171 when a Government of Canada contract or agreement requires it. It applies to the parts of a supplier's systems that handle, process, store or transmit specified information, and to the components that protect them. Defence suppliers are the main group affected, because the Canadian Program for Cyber Security Certification builds on these requirements, but other federal contracts can use it too.
What is the difference between ITSP.10.171 and NIST SP 800-171?
There is no substantial technical difference. The Cyber Centre states that ITSP.10.171 adapts NIST SP 800-171 to Canadian laws, policies and standards without changing the underlying technical content. It uses "specified information" instead of "controlled unclassified information", keeps NIST Rev. 3 numbering with withdrawn items marked "not allocated", and adds one requirement, 03.14.09 Dedicated administration workstation.
What is specified information?
Specified information is any information, other than classified information, that a Government of Canada authority identifies in a contract as needing safeguarding. It replaces the US term "controlled unclassified information". Protected information and its handling rules are defined by Treasury Board of Canada Secretariat policy, and ITSP.10.171 sets the security requirements for protecting that information on non-government systems.
How does ITSP.10.171 relate to the CPCSC?
ITSP.10.171 is the requirement set behind the Canadian Program for Cyber Security Certification (CPCSC) for defence suppliers. The higher CPCSC levels are based on its requirements, and the level a supplier needs is set contract by contract in requests for proposals and contract clauses. Check the current CPCSC guidance from Public Services and Procurement Canada for levels and timelines.
How is ITSP.10.171 assessed?
ITSP.10.171 is assessed using the companion publication ITSP.10.171-01, which took effect on 20 April 2026 and is based on NIST SP 800-171A Rev. 3. It sets out assessment procedures for each requirement, so organizations can produce evidence that the requirements in their contracts are met. Whether you self-assess or need a third-party assessment depends on your contract.
What happens if a supplier does not meet ITSP.10.171?
The main consequence is commercial: a supplier that cannot show it meets the ITSP.10.171 requirements in a contract may not qualify for that contract or may be in breach of it. ITSP.10.171 itself sets no fines. The exact obligations, reporting duties and remedies depend on the security clauses in each contract or agreement.
Does OneClickComply support ITSP.10.171?
Yes. OneClickComply supports ITSP.10.171 today. Because it shares its structure with NIST SP 800-171, controls and evidence you manage in OneClickComply for other frameworks are mapped to its 98 requirements. Automated evidence collection, policy generation and continuous monitoring keep your records current, and our audit team can advise through Ask an Auditor.
Related standards
All standards- OSFI Cyber Security Self-AssessmentGuidance · Canada
- OSFI Guideline B-13: Technology and Cyber Risk ManagementGuidance · Canada
- PIPEDA (Personal Information Protection and Electronic Documents Act)Law · Canada
- NIST SP 800-82 Rev. 3Guidance · US
- IRS Publication 1075Guidance · US
- NIST SP 800-171A Rev. 3Guidance · US
- NIST SP 800-82 Rev. 3 High OT OverlayGuidance · US
- NIST SP 800-82 Rev. 3 Moderate OT Overlay BaselineGuidance · US
Get ITSP.10.171 ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.