Canada Controlled Goods Program (CGP)

The Controlled Goods Program (CGP) is a Canadian federal industrial security program managed by the Controlled Goods Directorate within Public Services and Procurement Canada (PSPC) under the authority of the Defence Production Act (DPA) and the Controlled Goods Regulations (Regs). It regulates the examination, possession, and transfer of controlled goods while in the custody of the Canadian private sector. Controlled goods are defined in the DPA. They refer primarily to goods, components and technical data that have military or national security significance, including United States International Traffic in Arms Regulations (ITAR) controlled items. You can find more information about the CGP on the PSPC website.

Google Cloud Canada Corporation is registered in the CGP and offers predefined control packages to help customer organizations meet their obligations under the CGP.

Assured Workloads for Controlled Goods

Google Cloud supports customers in meeting their CGP obligations through Assured Workloads, which automatically applies security and compliance settings necessary to support your use of the cloud that is consistent with the CGP. The Data Boundary for Canada Controlled Goods control package enforces the following core capabilities:

• Data Residency: Data location controls restrict storage and processing of customer workloads to servers located within Canadian borders, utilizing exclusively the northamerica-northeast1 (Montreal) and northamerica-northeast2 (Toronto) regions.
• Assured Support: Support cases are routed exclusively to verified Canadian citizens or permanent residents who are physically located in Canada and have been security-assessed and approved under the CGP.
• Encryption and Key Management: Google Cloud customers benefit from default encryption of data in transit and at rest that is FIPS 140-2 validated and are able to choose from a variety of key management options including Google Managed Keys, Customer Managed Encryption Keys, and External Key Management with the option to layer in runtime encryption with Confidential Computing.

Customers with CGP-regulated workloads are responsible for determining what steps (if any) are necessary to ensure that their use of the cloud is consistent with the CGP. If customers choose to deploy any of the above technologies to meet their CGP compliance requirements, customers have final responsibility to properly deploy and maintain them.