Tools and Templates

Required OCIO-approved STRA tool(s) for core Government of British Columbia:

• Click here (IDIR restricted) 

Optional STRA / SoAR Word template for Broader Public Sector organizations:

• Broader Public Sector – STRA SoAR Template (DOCX)

Once an STRA is complete, residual risks which still require a treatment should be transferred to a risk register, tracked, and followed-up on until at an acceptable level to the accountable individual:

• Risk Register Template (Excel)

Other tools which can help when assessing security risk:

• Return on Security Investment (ROSI) Calculator (Excel)

• Web Application Vulnerability Assessment (IDIR restricted) 
  Note: A vulnerability assessment is not required when completing every STRA. In some cases, it may be helpful.