N2SF adoption preparation checklist
Explore 15 preparation questions across five areas, with records to gather for each.
Expand the areas relevant to your institution. Start with the records you already have to support consultation and transition scoping.
Scope and visibility
- Have you distinguished areas that must retain network separation from those that could transition?
- Do you maintain and periodically review an inventory of externally exposed assets, services and ports?
- Are your network diagrams and information system inventories up to date?
Records to prepare
- Current network diagrams and system inventory
- Inventory of externally exposed assets, services and ports
- Areas retaining network separation and proposed transition scope
Classification preparation
- Do you have a business function hierarchy broken down to detailed activities?
- Have you documented relevant laws and information disclosure or nondisclosure grounds for each function?
- Can you access classified and restricted-information registers and lists of publicly disclosed information?
Records to prepare
- Business function hierarchy and information inventory
- Grounds for public or restricted information handling
- Relevant laws and internal policies by function
Governance and policies
- Is there a defined decision process for approving classifications and reporting to institutional leadership?
- Are classification and verification responsibilities separated?
- Do you map N2SF, ISMS-P and other assessment requirements to a common control register?
Records to prepare
- Organization chart and security responsibilities
- Classification, verification and approval procedures
- Current security controls and assessment criteria
AI use preparation
- Do you know how staff use generative AI, including personal accounts?
- Have you communicated rules on information that may be entered into external AI services?
- Have you identified AI use cases that affect decisions about people’s rights or eligibility?
Records to prepare
- Generative AI usage inventory and proposed use cases
- Rules for external AI inputs and internal approvals
- Review criteria for work affecting rights or eligibility
Zero Trust and operations
- Are you progressively introducing access controls that verify users and devices, such as multifactor authentication?
- Can you measure the time from security event detection to response?
- Do temporary transition exceptions have expiry dates and revocation procedures?
Records to prepare
- User and device access control status
- Security event response procedures and operating records
- Approval, expiry and revocation records for temporary exceptions
Discuss your institution’s preparations.
Email us the areas you would like to clarify. We can review transition scope and the records needed for your environment.