Canadian small and medium organisations are increasingly asked by customers, insurers and public buyers to prove a basic level of cyber security, and CyberSecure Canada is the national certification built for exactly that. The programme certifies organisations against a baseline control set that started life as the Canadian Centre for Cyber Security (CCCS) Baseline Cyber Security Controls for Small and Medium Organizations and is now a National Standard of Canada, CAN/DGSI 104. This guide explains who runs the scheme today, what the standard asks for, how certification works and how to prepare without wasted effort. It is written for IT leads, managed service providers and owners of organisations with fewer than 500 staff, and for UK readers who know Cyber Essentials and want the Canadian equivalent.
Key takeaways
- The scheme is voluntary and run through accredited certification bodies. Organisations implement the controls, then a certification body accredited by the Standards Council of Canada (SCC) audits them.
- Programme authority moved in 2023. Innovation, Science and Economic Development Canada (ISED) states it stopped being the programme authority on 31 March 2023, and SCC now hosts current certification and recertification information.
- The standard has moved on from the original 13 controls. CAN/CIOSC 104:2021 replaced the CCCS v1.2 controls for new certifications from 1 January 2023 and added leadership, risk assessment, point of sale and log management controls. SCC now lists a 2024 revision.
- It is built for cybercrime, not targeted attacks. The CCCS baseline assumes all potential injuries are medium or lower and that the main threat is cybercrime. Higher risk organisations need more.
- Strong authentication and cloud admin separation carry the most weight. Two-factor authentication is required for financial, administrator, cloud admin, privileged and executive accounts, and cloud admin credentials must be separate from internal ones.
Who runs CyberSecure Canada now
The governance of the scheme has changed since its launch, and older blog posts still describe the original set-up. As of November 2026 the official position is as follows.
| Role | Body | What it does |
|---|---|---|
| Original scheme owner | Innovation, Science and Economic Development Canada (ISED) | Launched the programme and owned it until 31 March 2023. Its site still carries the certification mark display requirements and terms of use for marks |
| Current information host and accreditation body | Standards Council of Canada (SCC) | Accredits certification bodies under a programme based on ISO/IEC 17021-1 and SCC's own requirements for CyberSecure Canada certification bodies, and publishes programme bulletins |
| Standard developer | Digital Governance Standards Institute (DGSI) | Maintains the National Standard of Canada for baseline controls, published as CAN/CIOSC 104:2021 and now listed as CAN/DGSI 104:2021 (Rev 2024) |
| Control author and guidance | Canadian Centre for Cyber Security (CCCS) | Published the original Baseline Cyber Security Controls (v1.2) |
| Auditor | SCC-accredited certification bodies | Check readiness, quote a cost and audit implementation of the controls |
The ISED information sheet says the certification mark is valid for two years after it is issued. That sheet predates the 2023 handover, so confirm the current validity and recertification rules with SCC or your certification body.
Which standard you are certified against
Three versions of the control set appear in official material, and mixing them up is the most common source of confusion.
| Version | Status | What changed |
|---|---|---|
| CCCS Baseline Cyber Security Controls for Small and Medium Organizations v1.2 (February 2020) | Replaced for new certifications from 1 January 2023; still a useful free reference | Five organisational controls (OC.1 to OC.5) and 13 baseline controls (BC.1 to BC.13) |
| CAN/CIOSC 104:2021, National CyberSecure standard | Mandatory for new clients and recertifications from 1 January 2023, per SCC Bulletin 2022-20 | Adds organisational controls for leadership, accountability and cyber risk assessment, keeps awareness training, and adds baseline controls for point of sale and financial systems and for computer security log management |
| CAN/DGSI 104:2021 / Rev 1:2024 | Subject of SCC Bulletin 2025-14; SCC also lists a further amendment as proceeding to development | Confirm the detail against the standard itself before you plan an audit |
Organisations certified before 1 January 2023 had until their recertification audit to move to the 2021 standard. ISED operated an exception procedure that certification bodies could use in writing. If you are renewing, ask your certification body which edition it audits against and get the text from the standards developer.
The organisational controls: scope before safeguards
The CCCS baseline starts with decisions, not technology. These preliminary steps decide whether the baseline is even the right fit.
- Size (OC.1): the baseline targets organisations with fewer than 500 employees.
- Scope (OC.2): list the IT systems and assets in scope, including owned, contracted and otherwise used ones, and document the rationale and risk for any exclusion. Cloud tenants and outsourced websites belong in scope.
- Value and injury (OC.3): rate potential injury to confidentiality, integrity and availability from very low to high. The baseline suits cases where every injury is medium or below. If a breach could cause high injury, treat the baseline as a floor and add controls from a fuller framework such as the CIS Controls.
- Threat (OC.4): the baseline is designed mainly against cybercrime.
- Investment (OC.5): name a leader responsible for IT security, record IT and security spend and staffing, and commit to ongoing improvement. The 2021 standard strengthens this with explicit leadership, accountability and risk assessment controls.
The baseline controls in practice
The table below summarises the CCCS v1.2 controls with what auditors typically ask to see. The 2021 standard keeps these themes and adds point of sale and financial systems and log management, covered after the table.
| Control | Core requirement | Evidence to prepare |
|---|---|---|
| BC.1 Incident response plan | Written plan with roles, external contacts and regulator reporting, plus a hard copy | Dated plan, contact list, record of a tabletop exercise |
| BC.2 Automatic patching | Automatic updates on all software and hardware; assess replacing unsupported products | Update policy settings, list of end-of-life products and decisions |
| BC.3 Security software | Anti-malware that updates and scans automatically; host firewalls on unless alternatives are documented | Console screenshot showing coverage and update status |
| BC.4 Secure configuration | Change default passwords, disable unneeded features, enable security settings (CIS Benchmarks cited) | Configuration baseline and build checklist |
| BC.5 Strong authentication | Two-factor wherever possible; required for financial, administrator, cloud admin, privileged and executive accounts; change passwords only on suspected compromise | Conditional access or MFA policy export, password policy |
| BC.6 Awareness training | Training on passwords, malicious emails and links, approved software, internet and social media use | Training records and content outline |
| BC.7 Backup and encryption | Regular encrypted offsite backups, restricted access, tested restores; long-term backups offline | Backup schedule, restore test log, offline copy evidence |
| BC.8 Mobility | Choose company-owned or BYOD, separate work and personal data, encrypt devices, trusted app sources | Mobile policy, device management report |
| BC.9 Perimeter defences | Boundary firewall, DNS firewall, VPN with two-factor for remote access, WPA2 (Enterprise preferred), isolated point of sale, DMARC and email filtering | Firewall rule summary, DNS filtering config, DMARC record |
| BC.10 Cloud and outsourced IT | Provider assurance (the v1.2 text names an SSAE 18 SOC 3 report), encryption of sensitive data off-premises, two-factor on cloud admin with separate credentials, data residency evaluation | Provider assurance reports, cloud admin account list |
| BC.11 Secure websites | Sensitive sites meet OWASP ASVS (annexes also reference the OWASP Top 10), written into contracts for outsourced sites | Site list with required ASVS level, contract clause |
| BC.12 Access control | Least privilege, unique user accounts, admin accounts only for admin tasks, revoke unneeded accounts | Account list, leaver process records |
| BC.13 Portable media | Only organisation-owned encrypted media; sanitise or destroy before disposal | Media policy, disposal records |
Controls added in the 2021 standard
- Point of sale and financial systems: isolate payment terminals and finance systems from general office networks and restrict who can reach them. Card-accepting organisations should read it alongside PCI DSS. See the Point of Sale Security Guide.
- Computer security log management: collect and keep security logs from key systems so incidents can be detected and investigated. Small organisations can usually meet this with the logging built into their cloud productivity suite and firewall, retained centrally. See the Log Management and Retention Guide.
Use the wording of the standard edition you are audited against, not this summary, as the test of compliance.
Where identity fits
Most of the baseline is about accounts. BC.5, BC.10 and BC.12 together mean an auditor will look at every administrator, cloud admin and finance account and ask how it is protected. Three points catch small organisations out.
- Shared admin logins: BC.12 calls for unique accounts. A shared "admin" mailbox or firewall login used by an MSP fails this. Give each technician a named account.
- Cloud admin separation: BC.10 asks for cloud admin credentials separate from internal admin accounts. Use dedicated admin identities for the cloud tenant, protected with two-factor, not a daily-use mailbox.
- Service accounts and API keys: the baseline does not name them, but integrations with accounting, payroll and backup services hold standing access. List them in the OC.2 scope, store secrets in a password manager or vault, and remove ones you no longer use.
See the Small Business Identity and Access Security Guide and the MFA Guide.
CyberSecure Canada and Cyber Essentials
Readers who know the UK scheme will find the two similar in purpose but different in structure. This is a factual orientation, not a ranking. See the Cyber Essentials Guide for the UK detail.
| Aspect | CyberSecure Canada | Cyber Essentials (UK) |
|---|---|---|
| Basis | National Standard of Canada CAN/DGSI 104, derived from CCCS baseline controls | NCSC technical requirements, five control themes |
| Scope of controls | Organisational controls plus baseline controls covering incident response, training, backup, websites, cloud, mobile, logs and point of sale | Technical controls: firewalls, secure configuration, user access control, malware protection, security update management |
| Assessment | Audit by an SCC-accredited certification body under an ISO/IEC 17021-1 based scheme | Self-assessment questionnaire, or technical verification for Cyber Essentials Plus |
| Target | Organisations with fewer than 500 employees | Organisations of any size |
An organisation operating in both countries can reuse much of the evidence, but the Canadian standard asks for more documentation (incident plan, training, backups and risk assessment) than the UK technical controls.
How to get certified: a phased approach
- Confirm fit (week 1): work through OC.1 to OC.4. If any injury rates high, plan additional controls beyond the baseline as well.
- Get the right text (week 1): obtain the current edition of CAN/DGSI 104 and ask two or three SCC-accredited certification bodies which edition they audit against, what evidence they expect and for a quote.
- Gap assessment (weeks 2 to 3): score each control as met, partly met or not met, with the evidence you would show. Start with BC.5 and BC.10, then BC.7, because these carry the most risk.
- Remediate in pilot rings (weeks 3 to 8): roll out two-factor and device policies to IT staff first, then a pilot group, then everyone. Keep a rollback route for each change, for example a break-glass admin account excluded from new conditional access policies and stored offline.
- Test (week 8): run a restore test, a tabletop exercise on the incident plan and a check that logs reach the central store.
- Audit (week 9 onward): the certification body checks readiness, then audits. Track findings to closure.
- Maintain: diarise recertification and review the scope list when you add a cloud service or supplier.
Timings are NHI Mgmt Group suggestions for an organisation of around 50 staff with a managed service provider. Smaller firms with a single cloud suite often move faster, while organisations with on-premises servers and point of sale need longer.
Decision guidance
- Certify or just adopt? Certify when customers, public buyers or insurers ask for proof. If nobody asks, adopting the controls and keeping the evidence still delivers most of the security value at lower cost.
- Baseline or a fuller framework? Stay with the baseline if every injury is medium or below. Move to the CIS Controls (Implementation Group 1 is a natural next step) or ISO/IEC 27001 if you hold sensitive health or financial data at scale or face more than opportunistic crime. See the CIS Controls IG1 Rollout Plan.
- In-house or MSP? If an MSP runs your IT, the controls apply to its access too. Write named accounts, two-factor and log access into the contract. See Choosing an IT Support Provider or MSP Securely.
Measuring that it works
- Two-factor coverage: percentage of administrator, cloud admin, finance and executive accounts with two-factor enforced (target 100 per cent).
- Patch latency: share of devices with automatic updates on and current within your stated window.
- Restore success: date and result of the last restore test from offline backup.
- Account hygiene: number of shared or orphaned accounts found in the quarterly review (target zero).
- Log coverage: number of in-scope systems sending security logs to the central store.
Common failure patterns
- Preparing against the wrong edition: working from the 2020 CCCS PDF alone and missing the 2021 additions for log management, point of sale and risk assessment.
- Scope that leaves out the cloud: excluding the productivity suite or outsourced website from OC.2 without a documented rationale.
- Two-factor with gaps: enforced for staff but not for the MSP's admin accounts or the accounting platform.
- Untested backups: backups run nightly but nobody has restored from the offline copy.
- Paper incident plans: a plan with no current contacts and no exercise record.
Framework mapping
| Baseline theme | NIST CSF 2.0 |
|---|---|
| Leadership and accountability (OC.5, 2021 additions) | GV.RR-01 |
| Scope and asset list (OC.2) | ID.AM-01 |
| Strong authentication (BC.5) | PR.AA-03 |
| Access control (BC.12) | PR.AA-05 |
| Awareness training (BC.6) | PR.AT-01 |
| Backup and encryption (BC.7) | PR.DS-11, PR.DS-01 |
| Secure configuration and patching (BC.2, BC.4) | PR.PS-01, PR.PS-02 |
| Log management (2021 addition) | PR.PS-04 |
| Perimeter defences (BC.9) | PR.IR-01 |
| Cloud and outsourced IT (BC.10) | GV.SC-07 |
| Incident response plan (BC.1) | RS.MA-01 |
The mapping is ours, for orientation only.
Practitioner checklist
- Confirm with your certification body which edition of CAN/DGSI 104 it audits against.
- Complete and document OC.1 to OC.4, including the injury rating and any scope exclusions.
- Name the leader accountable for IT security and record spend and staffing.
- Enforce two-factor on every administrator, cloud admin, finance and executive account, including MSP accounts.
- Separate cloud admin identities from internal and daily-use accounts.
- Run and record a restore from offline, encrypted backup.
- Exercise the incident response plan and keep a hard copy.
- Isolate point of sale and finance systems and centralise security logs.
- Collect provider assurance reports for cloud and outsourced services.
- Diarise recertification and a quarterly account review.
Standards and references
- Standards Council of Canada: CyberSecure Canada accreditation programme
- Standards Council of Canada: Bulletin 2022-20, transition to CAN/CIOSC 104:2021
- Standards Council of Canada: Notice of intent, CAN/DGSI 104 Baseline cyber security controls for small and medium organizations
- Canadian Centre for Cyber Security: Baseline Cyber Security Controls for Small and Medium Organizations
- Innovation, Science and Economic Development Canada: CyberSecure Canada
- Innovation, Science and Economic Development Canada: CyberSecure Canada information sheet
Related NHI Mgmt Group resources: Cyber Essentials Guide · Small Business Cybersecurity Basics Guide · Canada Bill C-8 Guide · CIS Controls Guide. This guide summarises the CyberSecure Canada programme and is not legal advice.