OCAP® (First Nations)

The First Nations principles of OCAP® (Ownership, Control, Access and Possession) are a trademark of the First Nations Information Governance Centre, not a statute. First Nations "should own, protect, and control how this information is used."

Possession "refers to the physical control of data" and "is the mechanism by which ownership can be asserted and protected." Data held by any outside vendor, Canadian or not, is not in the Nation's possession, which is why self-hosting on Nation-controlled or Canadian-owned infrastructure comes up in First Nations reviews.

One First Nation's written vendor-security review in 2026 asked every vendor for Canadian-owned hosting or customer-held encryption keys, a SOC 2 Type II report and a penetration test, mandatory multi-factor sign-in for administrators, and a commitment that the Nation's data is never used to train AI models.