Organizational cyber security and privacy risk management activities - ITSP.10.036

September 2026 Practitioner series ITSP.10.036 September 2026 | Practitioner series Alternate format : Organizational cyber security and privacy risk management activities - ITSP.10.036 (PDF, # MB) --> Foreword Organizational cyber security and privacy risk management activities (ITSP.10.036) is an unclassified publication issued under the authority of the Head, Canadian Centre for Cyber Security (Cyber Centre). This publication supersedes IT security risk management: A lifecycle approach (ITSG-33), Annex 1 - Departmental IT security risk management activities. For more information or to suggest amendments, contact the Cyber Centre: by email: contact@cyber.gc.ca by phone: (613) 949-7048 or 1-833-CYBER-88 Effective date This publication takes effect on September 14, 2026. Revision history First release: September 14, 2026 Overview This publication is part of a series of guidelines published by the Cyber Centre, under Cyber security and privacy risk management: A lifecycle approach. This publication describes a cyber security and privacy risk management process that includes activities at the organizational level. This publication is a tool to assist security and privacy practitioner