Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Canadian PBMM (Protected B, Medium Integrity, Medium Availability) expert. Provides comprehensive guidance on ITSG-33 controls, CCCS assessment, Canadian data residency, and Government of Canada cloud security requirements.
.claude/skills/grcengclub-pbmm-expert/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-02 | ✗→✓ | ▲ Improved | 180% | 0% |
| case-03 | ✗→✓ | ▲ Improved | 280% | 0% |
| case-04 | ✗→✓ | ▲ Improved | 298% | 0% |
| case-05 | ✗→✓ | ▲ Improved | 361% | 0% |
| case-09 | ✗→✓ | ▲ Improved | 193% | 0% |
Deep expertise in Canadian Protected B, Medium Integrity, Medium Availability (PBMM) compliance based on ITSG-33 and CCCS Medium Cloud Security Profile.
PBMM (Protected B, Medium Integrity, Medium Availability):
Purpose: Standardize cloud security for Protected B data across Government of Canada
| Level | Full Name | Injury if Compromised | Use Cases | |-------|-----------|----------------------|-----------| | U | Unclassified | None | Public websites, published documents | | PA | Protected A | Limited injury | Internal emails, drafts | | PB | Protected B | Serious injury | Personal info, health records, financial data | | PC | Protected C | Grave injury | Law enforcement, sensitive intelligence | | SECRET | Secret | Exceptionally grave injury | National security | | TOP SECRET | Top Secret | Catastrophic injury | Highest classification |
PBMM Applicability: Protected B data only
Requirement: All Protected B data must be stored, processed, and backed up exclusively in Canadian geographic regions
Approved Canadian Regions:
| Provider | Regions | Location | |----------|---------|----------| | AWS | ca-central-1 | Montreal, QC | | AWS | ca-west-1 | Calgary, AB | | Azure | canadacentral | Toronto, ON | | Azure | canadaeast | Quebec City, QC | | GCP | northamerica-northeast1 | Montreal, QC | | GCP | northamerica-northeast2 | Toronto, ON |
Prohibited:
NIST Mapping: SA-9(5), SC-8
Implementation:
Requirement: Establish and maintain formal access control policies aligned with ITSG-33
Key Elements:
NIST Mapping: AC-1, AC-2
Cloud Implementation:
Requirement: Enforce MFA for all users accessing Protected B systems
Acceptable MFA Methods:
Implementation:
Enforcement: No MFA = No access
NIST Mapping: IA-2(1), IA-2(2)
Requirement: Maintain comprehensive audit logs for at least 2 years
Logging Scope:
Log Retention: Minimum 2 years
Log Protection:
Implementation:
NIST Mapping: AU-2, AU-3, AU-6, AU-9
Requirement: Encrypt all Protected B data at rest using FIPS 140-2 validated encryption
Encryption Standard: FIPS 140-2 Level 2 or higher
Coverage:
Cloud KMS Solutions:
Key Management:
NIST Mapping: SC-28
Requirement: Encrypt all data transmissions using TLS 1.2+ with FIPS-approved cipher suites
Minimum TLS: TLS 1.2 (TLS 1.3 preferred)
FIPS Cipher Suites:
Prohibited: SSL, TLS 1.0, TLS 1.1
Implementation:
NIST Mapping: SC-8
Requirement: Implement network segmentation with security groups, firewalls, and network access controls
Segmentation Strategy:
Implementation:
Best Practices:
NIST Mapping: SC-7
Requirement: Scan for vulnerabilities and remediate within defined timeframes
Remediation Timeframes:
| Severity | Remediation Deadline | Action | |----------|---------------------|--------| | Critical | 48 hours | Emergency patching | | High | 7 days | Scheduled patching | | Medium | 30 days | Regular patch cycle | | Low | 90 days | Next maintenance window |
Scanning Frequency:
Tools:
NIST Mapping: RA-5
Requirement: Establish incident response procedures and notify CCCS of security incidents
Incident Response Plan must include:
CCCS Notification:
Incident Severity:
NIST Mapping: IR-1, IR-4, IR-6
Requirement: Implement automated backups with Canadian region storage and tested recovery procedures
Backup Requirements:
Recovery Testing:
Implementation:
NIST Mapping: CP-9
Assessment Type: ITSM.50.100 Cloud Security Assessment
Timeline:
Required Documentation:
Certification Validity: 2 years (re-assessment required)
| Provider | Status | Regions | Assessment Standard | |----------|--------|---------|-------------------| | AWS Canada | ✅ ITSM.50.100 Assessed | ca-central-1, ca-west-1 | PBMM compliant | | Azure Canada | ✅ PBMM Assessed | canadacentral, canadaeast | PBMM compliant | | GCP Canada | ⚠️ In Progress | northamerica-northeast1/2 | Verify status |
PBMM Compliance Costs (Annual):
CCCS:
Key Publications:
Treasury Board Secretariat:
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-06 | pass→pass | 10,455 | 10,066 | -4% | 1 | 1 | 0% | 1,662 | 5,016 | +202% | 0 | 0 | — |
case-01 | pass→pass | 32,322 | 26,015 | -20% | 1 | 1 | 0% | 5,271 | 7,608 | +44% | 0 | 0 | — |
case-02 | fail→pass | 22,778 | 6,962 | -69% | 1 | 1 | 0% | 1,569 | 4,391 | +180% | 0 | 0 | — |
case-03 | fail→pass | 7,640 | 5,238 | -31% | 1 | 1 | 0% | 1,060 | 4,023 | +280% | 0 | 0 | — |
case-04 | fail→pass | 7,063 | 7,949 | +13% | 1 | 1 | 0% | 1,158 | 4,606 | +298% | 0 | 0 | — |
case-05 | fail→pass | 26,704 | 13,798 | -48% | 1 | 1 | 0% | 1,198 | 5,527 | +361% | 0 | 0 | — |
case-07 | pass→pass | 9,899 | 6,948 | -30% | 1 | 1 | 0% | 1,618 | 4,489 | +177% | 0 | 0 | — |
case-08 | pass→pass | 6,459 | 6,194 | -4% | 1 | 1 | 0% | 986 | 4,300 | +336% | 0 | 0 | — |
case-09 | fail→pass | 12,445 | 14,390 | +16% | 1 | 1 | 0% | 1,940 | 5,687 | +193% | 0 | 0 | — |
case-10 | pass→pass | 13,812 | 12,375 | -10% | 1 | 1 | 0% | 1,955 | 5,102 | +161% | 0 | 0 | — |
case-11 | pass→pass | 15,672 | 9,276 | -41% | 1 | 1 | 0% | 2,411 | 4,749 | +97% | 0 | 0 | — |
case-12 | fail→pass | 9,318 | 5,348 | -43% | 1 | 1 | 0% | 1,452 | 4,211 | +190% | 0 | 0 | — |
case-13 | pass→pass | 8,385 | 9,349 | +11% | 1 | 1 | 0% | 1,214 | 4,775 | +293% | 0 | 0 | — |
case-14 | fail→pass | 11,452 | 3,284 | -71% | 1 | 1 | 0% | 1,769 | 3,702 | +109% | 0 | 0 | — |
case-15 | fail→pass | 8,410 | 9,807 | +17% | 1 | 1 | 0% | 1,239 | 4,684 | +278% | 0 | 0 | — |
case-16 | pass→pass | 18,503 | 15,877 | -14% | 1 | 1 | 0% | 2,734 | 5,844 | +114% | 0 | 0 | — |
case-17 | pass→pass | 12,179 | 7,029 | -42% | 1 | 1 | 0% | 1,666 | 4,408 | +165% | 0 | 0 | — |
case-18 | pass→pass | 10,624 | 9,348 | -12% | 1 | 1 | 0% | 1,522 | 4,601 | +202% | 0 | 0 | — |
case-19 | pass→pass | 16,744 | 15,365 | -8% | 1 | 1 | 0% | 2,276 | 5,582 | +145% | 0 | 0 | — |
case-20 | pass→pass | 16,243 | 16,445 | +1% | 1 | 1 | 0% | 2,507 | 5,954 | +137% | 0 | 0 | — |
case-21 | pass→pass | 11,927 | 13,551 | +14% | 1 | 1 | 0% | 1,955 | 5,499 | +181% | 0 | 0 | — |
case-22 | fail→pass | 8,717 | 3,907 | -55% | 1 | 1 | 0% | 1,358 | 3,922 | +189% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 20 counted toward the lift figure. The other 2 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +41 percentage points is the difference between those two pass rates over the 20 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.