Security Requirement

A security requirement is a formal, explicit statement of the security principles and detailed security measures that a system, contract, organization or individual must meet. The term is used across government, and its exact content depends on what is being secured and who set the requirement.

In Canadian federal contracting, a security requirement is the set of security conditions attached to a solicitation and the resulting contract. These conditions include organization and personnel security clearances, approved work locations, safeguarding of protected or classified information, and related reporting or access controls. In NATO information assurance, the term has a parallel meaning tied to the risks and objectives of a specific system.

What Canadian federal buyers attach to a solicitation

Federal buyers use the term in both solicitations and resulting contracts. A solicitation can state outright that it contains a security requirement. One Canadian federal request for proposal published on CanadaBuys requires the bidder, before contract award, to hold the organization security clearance specified in the resulting contract clauses. The bidder must also provide information about its proposed work-site and document-safeguarding locations.

The same RFP applies the requirement to people. Proposed individuals who need access to sensitive information, assets or sensitive work sites must meet the applicable security requirement.

The SRCL and Contract Security Program clauses

Canadian security requirements are commonly expressed through a Security Requirements Check List (SRCL) and associated Contract Security Program clauses. Procurement documents can state that the SRCL and related clauses apply to and form part of the contract. The Contract Security Program of Public Services and Procurement Canada (PSPC) supplies the SRCL and the clauses.

The cited RFP also addresses subcontracting. Where a subcontract contains security requirements, it cannot be awarded without prior written permission from the Contract Security Program.

The term alone does not establish a particular clearance level. In defence-related procurement, security requirements can reach weapon-related products and services, classified or protected information, sensitive work sites, personnel, facilities and subcontractors. The specific obligation comes from the SRCL and the clauses in the solicitation or contract.

How PSPC supply arrangements treat security requirements

PSPC applies security requirements at the contract level under its supply arrangements. The solutions-based supply arrangement states that each client RFP identifies the SRCL that applies to any resulting contract. Standardized SRCLs are available through the Centralized Professional Services System, although other SRCLs may also be used.

The Professional Audit Support Services Supply Arrangement follows the same approach. No security requirement applies to the arrangement itself, but resulting contracts may be subject to the SRCL requirements identified in individual RFPs.

The Security Requirement Statement in NATO systems

NATO uses the term for communications and information systems. Its documentation states that the security requirements for these systems must be formally captured by the appropriate authority. They are incorporated in a Security Requirement Statement (SRS), or an approved national equivalent. NATO defines the SRS as a complete and explicit statement of the security principles to be observed and the detailed security requirements to be met. The requirements derive from the risks and security objectives of the system. See the NATO directive on the management of security for communications and information systems.

What a security requirement means for a supplier

Read the security section of every solicitation and the attached SRCL before deciding to bid. Confirm whether the requirement applies at bid submission, before award or during performance. Then obtain or maintain the specified organization, personnel, facility, safeguarding or site clearances and approvals.

Check subcontracting plans against the security clauses, since a subcontract with security requirements needs prior written permission from the Contract Security Program. A supply arrangement with no security requirement does not mean the contracts under it will have none, so check each RFP.