Canadian Centre for Cyber Security (CCCS) Cloud High and Cloud Medium Assessments
Overview
The Canadian Centre for Cyber Security (CCCS) is Canada’s authoritative source of cyber security expert guidance for Canadian government, industry, and the public. Public and commercial sector organizations across Canada rely on the CCCS’s Cloud Service Provider (CSP) Information Technology Security (ITS) Assessment Process in their decision to use Amazon Web Services (AWS).
CCCS’s Cloud High and Cloud Medium assessment process determines if the Government of Canada (GC) ITS requirements for the Cloud High and Cloud Medium profiles are met. These profiles are based on the Security and privacy controls and assurance activities catalogue (ITSP.10.033). The Cloud High (PBHH) profile includes all controls and enhancements contained within the Cloud Medium profile (PBMM), with additional controls and enhancements to address higher integrity and availability requirements. The Cloud High and Cloud Medium profiles establish baseline security requirements for cloud services. These services support GC workloads and information processing up to the Protected B level. In addition, CCCS’s ITS assessment process is a mandatory requirement for AWS to provide cloud services to Canadian federal government departments and agencies.
As of September 18, 2026, there are a total of 172 AWS services and features that were assessed by the Canadian Centre for Cyber Security (CCCS) under Cloud High security assessment. The assessment covers services and features that are available in both the Canada (Central) and Canada West (Calgary) AWS Regions.
On a periodic basis, CCCS assesses new or previously unassessed services and re-assesses the AWS services that were previously assessed to verify that they continue to meet the GC requirements. CCCS prioritizes the Cloud High and Cloud Medium assessments of new AWS services based on their availability in Canada, and/or customer demandfor the AWS services.
FAQs
Open allThe Cyber Centre’s Cloud Service Provider (CSP) Information Technology Security (ITS) Assessment of AWS is relied on by public and commercial sector organizations across Canada in their decision to use the CSP services. The assessment process determines if the ITS requirements for Cloud High (PBHH) and Cloud Medium (PBMM) profiles are met as described in Security and privacy controls and assurance activities catalogue (ITSP.10.033). Meeting the high and medium cloud security profile is required to host workloads that are classified up to and including the high and medium categorization.
The CCCS currently offers three levels of formal cloud assessments , either Cloud Low Profile (previously known as Protected A, Low, Low), Cloud Medium (previously known as Protected B, Medium, Medium) and Cloud High (previously known as Protected B, High, High). AWS is currently assessed to process, transfer and store data up to both high and medium categorization of information and services.
As of September 18, 2026, there are a total of 172 AWS services and features that were assessed by the CCCS under Cloud High and Cloud Medium security assessments. The assessment covers services and features that are available in both the Canada (Central) and Canada West (Calgary) AWS Regions. The AWS services that are in scope of the assessments can be found within Services in Scope for CCCS Assessment page.
Yes. The assessment covers services and features that are available in both the Canada (Central) and Canada West (Calgary) AWS Regions. These services are eligible for use up to Cloud High and Medium level categorization.
Yes. The summary report is available on AWS Artifact. AWS Artifact is a self-service portal for on-demand access to AWS compliance reports. Sign in to AWS Artifact in the AWS Management Console, or learn more at Getting Started with AWS Artifact.
The security control profiles are published by the Canadian Centre for Cyber Security (CCCS) profiles and are based on the Security and privacy controls and assurance activities catalogue (ITSP.10.033).
For a service to be assessed by the CCCS, it must be in the Canadian regions [Canada (Central) and/or Canada West (Calgary)] and/or customer demand for the AWS services. However, the Cloud High and Cloud Medium assessment applies to AWS services and/or features, regardless of the region. Customers must individually assess if utilization of an AWS service outside the Canadian Region meets their compliance requirements.
The Global Security & Compliance Acceleration (ATO on AWS) team provides informal advisory services at no cost for compliance frameworks across healthcare, privacy, national security, financial sectors, and more. Our Global Security & Compliance Acceleration (ATO on AWS) Partners help you navigate, automate, and accelerate building compliant workloads on AWS and reduce time and cost. Please fill out our registration form and our team will help you connect with the right Partner for your specific consulting, deployment, and integration needs.
If you are not already registered as an AWS Partner, we offer a broad set of Partner programs to help you innovate, expand, and differentiate your offerings.