GCPSG-024 (2026)
Document Sanitization Guide

1.1. Purpose

The purpose of this document is to serve as a guide for sanitizing building plans and documents prior to releasing them to third party contractors. Before sharing documents and facility drawings with external contractors, consultants, or the public, all sensitive information (technical and security related content) should be sanitized in accordance with information management policies contained in the Policy on Government Security (PGS) and their individual department or agency.

Security requirements are outlined below for removing or obscuring content such as, architectural, structural, electrical or mechanical design elements and security related information. Key objectives of this security practice are to:

• Protect sensitive information - Prevent the unauthorized disclosure of details that could compromise safety, security, or business interests.
• Control access to sensitive information - Ensure only relevant information is shared based on the recipient's role and need-to-know.
• Apply consistency to ensure compliance - Align with department/agency's security policies, legal obligations, and contractual security clauses within a Security Requirements Check List (SRCL) or Non-Disclosure Agreement (NDA).

1.2. Applicability

This guide applies to GC employees and is applicable to individuals who are responsible for the creation, distribution, and modification of construction documents and facility drawings and, when required, the necessary sanitization of those documents.

1.3. Equity, Diversity, and Inclusion in physical security systems

All employees of the Government of Canada (GC) have a responsibility to safeguard persons, information and assets of the GC. It is important that security policies and practices do not serve as barriers to inclusivity, but instead support and respect all GC personnel while ensuring appropriate security measures are maintained for the protection of GC personnel, assets, and information.

Initiatives to promote equality and inclusion among the diverse communities and heritages within the GC, should be respected in the development and maintenance of physical security systems. Departments and agencies should follow all GC legislation, policy and directives on Equity, Diversity, and Inclusion (EDI) in the promotion of a fair and equitable work environment for all persons while ensuring they meet their mandated security responsibilities.

Departments and agencies should conduct a risk management exercise to ensure, that while the dignity of all is respected, the protection of GC information, assets, and personnel is maintained. All questions on EDI policies and directives should first be addressed to your responsible departmental authority.

1.4. Information Technology considerations

Information technology (IT) considerations may not always be necessary when formulating plans for physical security solutions. There is however, a constantly evolving threat regarding IT systems and with the convergence of physical and IT security, the requirement to assess the risk of IT applications and software connected to a network to operate and support equipment in GC controlled buildings is critical. Examples of these control systems could be for items such as, but not limited to, security lighting, perimeter gates, doors, HVAC, etc.

5.1. Preparation

Information within the project construction documents, including (but not limited to) design documentation, project correspondence, issued drawing sets, construction documentation, notices of change, addendums, project specifications, building information modeling (BIM) files and other documents must have common elements removed or obscured during sanitization. These include:

• Departmental or agency identifiers. Remove all references to the department or agency including (but not limited to):
  • Logos, insignias, or visual branding
  • Facility names, site addresses, and signage
  • Email domains and references to unit or team names
    Note: GC identifiers can be used
• Room names and functions:
  • Sensitive rooms (such as data centers, secure storage, interview rooms, and executive offices) are to be labeled numerically (Room 101, Room 202) without functional identifiers
    Note: Maintain a separate, access-controlled coded room list for internal reference.
• Security and sensitive assets - Do not depict or identify:
  • Physical security zones and classification levels
  • Firearms storage, vaults, evidence rooms, exhibit rooms
  • Security equipment such as safes, panic buttons, cameras, or biometric readers
• Security system infrastructure - Remove or isolate information within BIM software, as well as computer-aided design (CAD) layers that show:
  • Surveillance systems (CCTV camera locations)
  • Intrusion detection systems (motion sensors, door contacts)
  • Access control systems (card readers, turnstiles)
• Mechanical, electrical, and plumbing (MEP) Systems - Remove detailed schematics that may expose vulnerabilities such as:
  • Critical HVAC components tied to secure zones
  • Generator or emergency power layouts
  • Plumbing access points that could be exploited
• IT infrastructure - Sanitize:
  • Server room locations and data cabling routes
  • Telecommunications equipment and switchboard diagrams
  • Wireless access points and patch panels

5.2. Important considerations

There will be times when the function of a room will be self-evident, such as washrooms, private offices, or security areas, however sensitive system details associated with these spaces should be omitted.

Consider the cumulative sensitivity of multiple data points. Certain elements may become exploitable when combined, such as a safe location combined with a High Security zone label or signage. The identification of certain construction requirements, such as a secure demising wall (SDW), could indicate the room's purpose or indicate assets of interest.

It should be noted that various third parties, contractors, and sub-contractors will require different levels of information to complete their scope of work, including some that may be listed in section 5.1. The appropriate security screening for the contractor should be conducted for the level of information and the space they require access to on a case-by-case basis - however, any items not relevant to the completion of their work must still be considered for sanitization.

Reviewed and recommended for approval.

I have reviewed and hereby recommend, GCPSG-024 (2026) - Document Sanitization Guide, for approval.

Shawn Nattress
Manager, RCMP Lead Security Agency

Date: 2026-04-14

Approved

I have reviewed and hereby approve, GCPSG-024 (2026) - Document Sanitization Guide.

Gaetan Lafrance
Acting Director, RCMP Physical Security

Date: 2026-04-20