CAN CSA ISO IEC TS 33052-18: Process Reference Model for Information Security Management – Scope, Requirements, and Compliance

Introduction

The CAN CSA ISO IEC TS 33052-18 standard, officially designated as CAN/CSA-ISO/IEC TS 33052:18, is the Canadian adoption of ISO/IEC TS 33052:2016, Information technology — Process assessment — Process reference model (PRM) for information security management. Published by the Canadian Standards Association (CSA) in 2018, this Technical Specification provides a structured framework for assessing the capability of processes used to manage information security within an organization. It aligns with the ISO/IEC 33000 series on process assessment and complements the ISO/IEC 27000 family of standards for information security management systems (ISMS). This article examines the standard’s scope, technical requirements, practical implementation considerations, and compliance notes.

1. Scope of CAN CSA ISO IEC TS 33052-18

The standard defines a process reference model (PRM) for information security management. The PRM identifies a set of processes that are essential for the effective planning, implementation, operation, monitoring, review, maintenance, and improvement of an ISMS. The scope includes processes such as information security policy management, asset management, human resource security, access control, incident management, and business continuity management related to information security.

The intended users are organizations performing process assessments of their own information security management activities, as well as external assessors seeking a common basis for evaluating ISMS process capability. The PRM is designed to be used in conjunction with the measurement framework provided in ISO/IEC 33020 and the assessment process described in ISO/IEC 33001 and ISO/IEC 33002.

2. Technical Requirements: The Process Reference Model

2.1 Structure of the PRM

The PRM establishes a set of processes, each defined by its purpose and outcomes. A process may also be broken down into sub-processes. Each process is assigned to a category based on its domain (e.g., planning, operation, support) within the information security context. The standard includes processes that correspond to the clauses of ISO/IEC 27001:2013 (and later editions) but reorganizes them into a format suitable for capability measurement.

2.2 Process Categories

The processes are grouped into the following categories:

• Sec – Security Governance and Planning: Processes related to setting security policy, objectives, and strategic direction.
• Sec – Security Implementation and Operation: Processes that implement and execute security controls.
• Sec – Security Performance Evaluation: Processes that monitor, measure, analyze, and evaluate security performance.
• Sec – Security Improvement: Processes that manage corrective actions and continual improvement.

2.3 Process Definitions

Each process is defined by:

• Purpose: high-level objective of the process.
• Outcomes: observable results that indicate successful achievement of the purpose.
• Base practices: activities or tasks that contribute to achieving the outcomes (though these are typically detailed in a process assessment model (PAM) rather than the PRM).

An example of a process from the standard is “Information Security Incident Management.” Its purpose is to ensure a consistent and effective approach to managing information security incidents. Outcomes include timely detection, reporting, response, and resolution of incidents.

2.4 Process Reference Model Overview Table

3. Implementation Highlights

Implementing the PRM for assessment typically involves the following steps:

1. Understand the context: Map your current ISMS processes (based on ISO/IEC 27001) to the processes listed in the PRM.
2. Define assessment scope: Determine which processes will be assessed and to which capability level (e.g., Level 1 (Performed) through Level 5 (Optimizing) per ISO/IEC 33020).
3. Select an assessment model: Use a process assessment model (PAM) consistent with the PRM, such as ISO/IEC TS 33072 (for security) or develop an organization-specific model.
4. Conduct assessment: Gather evidence using interviews, document reviews, and observations to rate base practices and outcomes.
5. Analyze results: Identify strengths and gaps, and plan improvement actions based on capability profiles.

4. Compliance and Alignment with ISO/IEC 27001

CAN CSA ISO IEC TS 33052-18 is intended to complement, not replace, ISO/IEC 27001. While ISO/IEC 27001 specifies requirements for an ISMS and provides controls, the PRM focuses on the capability of the processes that implement those requirements. An organization can achieve certification to ISO/IEC 27001 and also perform a process assessment using this standard to gain deeper insight into process maturity.

Key points regarding compliance:

• The PRM is not a conformity assessment standard; it does not provide pass/fail criteria. It measures capability on a continuous scale.
• Assessments according to ISO/IEC 33001, using this PRM, can support process improvement programs and provide input for internal audits.
• Many national accreditation bodies recognize process assessments as part of overall ISMS evaluation, especially when integrated with management system auditing.
• The Canadian adoption (CAN/CSA-ISO/IEC TS 33052:18) carries the same technical content as the international version, with editorial adjustments to reference Canadian standards when applicable.

Frequently Asked Questions

This article provides general guidance and does not constitute legal or certification advice. Always consult the official published standard for the complete requirements.

Footer year: 2026