Cyber and Infrastructure Resilience Assessments
The Regional Resilience Assessment Program
The Regional Resilience Assessment Program (RRAP) is a vulnerability and dependency assessment program for owners and operators of critical infrastructure (CI) facilities within the 10 CI sectors in Canada. This program involves site assessments to help organizations measure and improve their resilience to all hazards in Canada, such as cyber threats, accidental or intentional man-made events, and natural catastrophes.
Onsite assessments are voluntary, non-regulatory, free-of-charge and confidential. Participants are asked to complete three five-minute surveys on their experience with the program after the assessment is conducted.
An online resilience self-assessment will be made available in late 2023 to early 2024.
If you have general questions about our program or are interested in any of the assessments, please fill out our online form.
How it works
The RRAP is comprised of four tools:
Critical Infrastructure Resilience Tool (CIRT) (1 day to complete)
- An on-site, survey-based tool that measures the resilience and protective measures of a facility.
- Outputs include a report and interactive dashboards that provide scores and peer comparisons, and highlight dependencies and resilience enhancement options for physical security, resilience, and cyber security.
Critical Infrastructure Multimedia Tool (CIMT) (1/2 day to 1 day to complete)
- A virtual rendering of a facility based on floor plans. It features panoramic photographs of interior and exterior significant areas and can be shared with first responders and/or used in exercises.
- The CIMT output can be shared with first responders for training and tactical purposes.
Canadian Cyber Resilience Review (CCRR) (1 to 1.5 day to complete)
- An on-site, survey-based tool that measures the cyber security posture of an organization.
- Outputs include two reports (brief and comprehensive) with scores across the 10 domains of the NIST Cyber Security Framework, peer comparisons, and resilience enhancement options.
Resilience Online Self-Assessment (at least 1 hour to complete – will be available in late 2023 to early 2024)
- An online tool that measures the resilience and protective measures of a facility. Users are encouraged to consult the different key employees responsible for safety and planning in your facility while answering.
- Based on the CIRT methodology.
- Output is a report of options for consideration with a general and a section-specific color-score measuring your resilience level. The report you receive after completing the Resilience Online Self-Assessment should be considered with your threat profile and facility operations.
Both the CIRT and CCRR should be completed by individuals who are subject matter experts on facility security, IT, and facility management. Organizations can request each one of the tools individually or as a package. Use of all tools typically takes three days. Post-assessment check-ups may be conducted with your organization up to 24 months after the assessment.
Organizations may also signal interest in participating in a broader regional assessment. These projects typically involve Public Safety working with multiple organizations in a particular region. Examining a specific hazard, the objective is to help identify key interdependencies, as well as opportunities to individually and collectively minimize the impact and likelihood of a disruption. During a regional assessment, the individual assessment tools are deployed alongside modelling tools, workshops, stakeholder meetings, and subject matter expert interviews.
How it helps your organization
Results from all our assessments are intended to help owners and operators enhance their resiliency by identifying dependencies and vulnerabilities within their organization.
Assessments also identify a series of optional cost-effective measures to help owners and operators mitigate risks and improve their ability to respond to and recover from disruptions.
Specifically, the RRAP helps to enable:
- Better risk management
Increases an organization's understanding of its physical and procedural vulnerabilities.
- Strengthened government relationships
Enhances relationships with multiple government departments, including municipal level representatives such as first responders.
- Improved cyber security awareness
Identifies how well an organization is prepared for cyberattacks and other cyber threats.
Other key considerations for CI owners and operators:
- Minimal investment of time and resources
RRAP service is quick and is offered at no cost.
Public Safety Canada will protect the confidentiality of documents and information provided by owners and operators of CI
Implementation of any/all resilience enhancements options and observations provided following an assessment are at the discretion of the owner/operator.
If you have general questions about our program or you are interested in any of the assessment, please fill out our online form.
For more information or to request an assessment
For more information please see Frequently Asked Questions.
If you're a CI owner or operator, contact us to discuss the possibility of having an assessment of your facility. Members are also available to provide an interactive presentation to further explain the program and the products provided.
To start the assessment process, please fill out our online form.
Regional Resilience Assessment Program
- Date modified: