ITSP.10.171 is the Canadian Cyber Centre's adaptation of NIST SP 800-171 Revision 3, and the government says plainly that it doesn't change the technical content in any substantive way. It has 98 requirements. NIST's Revision 3 has 97. The 1 extra is 03.14.09, dedicated administration workstation.
It is the only requirement in the Canadian standard that isn't in the American one. It comes from the Canadian control catalogue, source control SI-400 in the ITSG-33 lineage, and nobody who has only worked from 800-171 will have seen it.
What it asks for
Three things.
- Administrative and superuser actions are done from a physical workstation dedicated to that work and isolated from all other functions and networks, especially the internet.
- Remote connection from that workstation to the network it administers runs over a carrier private network, such as VPLS or MPLS, with VPN encryption on top.
- The workstation is a hardened, single-purpose machine or thin client that isn't shared between security realms.
The discussion text goes further than most shops expect. The workstation isn't domain-joined. It doesn't download patches from the internet. It carries no office tools. It isn't used to update documentation in networked applications.
What it looks like in a 20-person shop
Smaller than you'd fear. 1 admin machine, kept off the internet, patched from media you bring to it, and used for nothing but administering the enclave. Admin accounts work from that machine and from nowhere else. Nobody reads email on it or browses from it.
That pairs with a habit the maintenance and access control requirements already push you toward: nobody works under an admin account day to day. The person who administers the enclave has an ordinary account for email and a separate admin account that only functions from the dedicated machine.
For a shop that runs its own IT, this is a procurement item and a change of habit. Annoying, and nothing more.
Where it gets hard
The second clause is the problem. An MSP administering your enclave from its own office over an internet VPN doesn't meet the requirement as written, which is why it belongs on the list of questions to ask your provider. A carrier private network to every client is not how most MSPs are built, so the clause lands on a business model, not only on a configuration.
Their obvious question is whether this is a requirement or an aspiration. It is a Level 2 requirement, it is new, and the assessment method for it hasn't been published. Nobody can say today how an assessor will score it.
What I tell clients
Read the text yourself rather than relying on a summary. The standard's wording is the authority.
Keep administrative work inside the enclave wherever you can. The less administration crosses a network you don't control, the less the remote clause has to carry.
Get your assessor's reading in writing before you buy circuits. A carrier private network is a real recurring cost, and buying one against an interpretation that turns out to be softer is wasted money. Skipping one against an interpretation that turns out to be strict is worse, so the written reading matters in both directions.
Put the question in the MSP relationship now, not at assessment time. If administration is an MSP deliverable, the responsibility matrix has to say how they will meet 03.14.09, or whether the client takes administration in-house. Some MSPs won't be able to support this work. Better to learn that in 2026 than mid-assessment.
This is a Level 2 item, so it doesn't touch a Level 1 attestation. Level 2 is planned for select contracts from spring 2027, and 03.14.09 deserves a line in the plan now.
