Selling to the government of Canada means meeting cloud security requirements spread across different areas. None of which are centrally explained very well. Nonetheless the GC Cloud Guardrails were set in 2019 and became mandatory in May 2022, so they are now the minimum security controls necessary to implement within 30 days of a cloud account. They apply across IaaS, PaaS, SaaS. If you want government customers, this is the lowest bar you must clear.
Data residency requirement
This is where Canner's mission aligns with the hard requirements of working with government. Protected B data - personal information, confidential material, internal government ops - all have to sit in a GC-approved data centre. This means more than just located in Canada, but that is part of it. The next part is that it's not exposed to foreign government access orders. This is literally laws designed like the CLOUD Act and another key element in why Canner is not just Canadian-based but Canadian owned and controlled. The full breakdown of why a Canadian region isn't Canadian jurisdiction is on the CLOUD Act post.
Protected B and PBMM
Most data a vendor would touch is protected B. This is the nature of government work. This requires a PBMM (Protected B, Medium Integrity, Medium Availability) profile defined in the GC's Security Control Profile. Check ITSG-33 for details. In practice what this means is encryption at rest and in transit, role-based access with MFA, logged and monitored admin actions, network segmentation and patch cadence, and incident response with defined SLAs. No specific certification is actually required here, which is interesting, but SOC 2 and ISO 27001 essentially cover them while providing third-party evidence.
Getting on the procurement list
This is why you're here. Here's how it's done: ProServices (BuyandSell.gc.ca), SSC Approved Cloud Broker status (specifically for platforms like Canner), standing offers, and supply arrangements. Supply arrangements and standing offers are a core offering on the ProServices site already.
Where Canner stands
We satisfy the location, control, and architecture guardrails. We have nothing to account for in foreign jurisdiction risk, we have TLS 1.3, encrypted at rest env vars, tenant isolation, audit logging, MFA — the day-to-day mechanics are documented on the security page, and the structural case is on the sovereignty page. SOC 2 Type I is on the roadmap for 2027. We're effectively at the bat, but the expensive pieces in terms of accreditation need to be put in place before we can crack our way into one of Canada's many walled gardens.
Frequently asked questions
Can a department use a US cloud provider for Protected B data?
Yes. AWS Canada and Microsoft Azure are both approved for Protected B workloads under GC supply contracts. However, the department's risk assessment must account for CLOUD Act exposure, and additional controls (customer-managed encryption keys, for example) may be required.
Does a vendor need SOC 2 to sell to the government?
No, but it helps significantly. SOC 2 provides independent evidence of security controls that reduces the burden of the department's own security assessment. Without it, departments must conduct a more thorough evaluation, which slows procurement.
What's the difference between the GC Cloud Guardrails and PBMM?
The guardrails are the minimum baseline that must be met in the first 30 days. PBMM is the full security profile for Protected B workloads. Think of the guardrails as the entrance exam and PBMM as the ongoing certification.