Actually, the criminality assessment is already passed.In the ATIP notes, there will be two section one is Security and the other Criminality. The security section is redacted and you can't read much into it for obvious reason. However, check your criminality section, does it say something like RCMP or Fingerprint screening required etc. If this is the case, then you know the hold up is receiving that fingerprint request email.
Hope this helps and all the best!
It is the security that is being stalled and processed by the CSIS.
I heard in PR applications people may get comprehensive security screening which is quite lengthy in time. I am afraid it is my case as well although I have not heard a case of citizenship application gets CSS...