Loss Prevention

Loss prevention means measures intended to prevent losses or reduce the likelihood that they occur. The measures can be engineered or automated processes and systems, such as intrusion detection and access control. They can also be simple, such as wide-angle mirrors that help prevent vehicle collisions while reversing.

The term appears in Canadian public-sector risk-management guidance, and it shows up in solicitations in more than one form. Buyers use it for physical and inventory protection, and they use the related phrase data loss prevention for software that protects information. Which meaning applies depends on the solicitation in front of you.

Loss prevention as a risk control in CanadaBuys guidance

CanadaBuys places loss prevention under "Risk control" within its guidance on liability and risk management. It is a preventive control that buyers can consider when planning a procurement and managing operational risks. The guidance gives intrusion detection and access control as examples of loss-prevention measures. You can read the full text in the CanadaBuys liability and risk management guidance.

Inventory loss prevention in the DND and CANEX audit

A Department of National Defence audit uses the term in the context of CANEX purchasing and inventory management. It treats loss prevention as an enterprise-wide activity aimed at reducing merchandise inventory shrinkage. The audit names theft, fraud, fire, flooding and power outages as causes of that shrinkage.

The audit also refers to a Loss Prevention Incident Report (LPIR), which is used to document and report incidents of loss. It states that CANEX had no overarching loss-prevention policy guidance in place at the time of the audit. The details are in the DND audit of CANEX.

Data loss prevention in federal software buying

Many federal solicitations use the term for software. Shared Services Canada ran a procurement for an Enterprise Data Loss Prevention (E-DLP) solution for the Canada Revenue Agency and the Canada Border Services Agency under solicitation BPM008529 / Event 4. The required solution was intended to protect sensitive and protected information, cover files and data, and integrate with existing security tools. The CRA posts related material on its E-DLP fairness monitor page.

Public Services and Procurement Canada lists "Data loss prevention software" as category 1214 in its Software Licensing Supply Arrangement. The category covers software that identifies, monitors and protects data in use, in motion and at rest through content inspection and contextual analysis. The PSPC software categories description sets out the full category wording.

Other buyers purchase the same capability. CanadaBuys records a Business Development Bank of Canada procurement titled "Symantec - License subscription Data Loss Prevention package". You can find records like it by searching the CanadaBuys tender opportunities list.

What loss prevention means for a supplier bidding on Canadian public contracts

• Read the term in context. A solicitation may mean physical controls, inventory-loss controls or data-loss-prevention software.
• Expect the obligation to come from the solicitation itself. No universal Canadian procurement clause requires loss-prevention controls on every contract.
• Match your response to the stated scope. The E-DLP procurement, for example, asked for coverage of files and data and integration with existing security tools.
• For software bids, check whether your product fits PSPC category 1214 and how it protects data in use, in motion and at rest.
• Where a buyer is managing operational risk, describe your preventive controls, such as access control and intrusion detection, in terms the buyer's risk guidance recognizes.