A cyber security maturity assessment rates how well an organization manages cyber security today, area by area, and shows what to improve next. Ontario’s provincial tool is built on NIST Cybersecurity Framework 2.0 with Ontario-specific adaptations and rates more than 100 statements from Level 0 (non-existent) to Level 5 (optimized). Under O. Reg. 51/26, school boards, colleges, universities, children’s aid societies and covered public hospitals must complete one.
A maturity assessment looks at the way cyber security is run: who decides, which practices are written down, how consistently they are followed and whether anyone checks the result. A security audit looks at systems and finds specific weaknesses, such as an outdated plugin or an administrator account without a second login step. A vulnerability scan is narrower still, an automated search for known flaws.
O. Reg. 51/26 defines the assessment as an evaluation of an entity’s status or progress with respect to cyber security, carried out under industry standards or best practices endorsed by the Ministry’s Chief Information Security Officer. The answer it produces is a level, with the gaps between that level and the next one.
Cyber Security Ontario’s assessment tool uses outcome statements across the six functions of NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond and Recover. The rating approach is aligned with Capability Maturity Model Integration (CMMI) levels, and each statement is rated from Level 0, non-existent, to Level 5, optimized. The standard assessment holds more than 100 statements.
The tool produces a downloadable summary with a consolidated maturity rating and category ratings. Evidence stays with the organization: entries are limited to general descriptors, such as the roles consulted and where the evidence is stored. The tool is available in French and English.
The provincial tool separates the work into roles. A contact manager registers the organization’s contacts. An assessor gathers information, interviews subject matter experts, analyzes and enters the ratings. An approver reviews the result, gives internal approval and decides whether to submit the summary; Cyber Security Ontario suggests the approver be a manager who is not also the assessor.
That split is what makes a score defensible. A rating entered by the person who also approves it reads as a self-assessment, and the next review tends to find the difference.
Under O. Reg. 51/26, school boards, colleges and universities, Group A, B and C public hospitals, the University of Ottawa Heart Institute and children’s aid societies must complete a first assessment by 1 July 2027, then at least once in every two-year period. For organizations outside that list, Cyber Security Ontario says use of its tool is optional and recommends doing it at least once to set a baseline, then at least once every two years.
The regulation places no such duty on private businesses. The method still works for them as a baseline before an insurance renewal, a client’s security questionnaire or a certification effort, and our O. Reg. 51/26 page explains how we run the assessment for covered organizations.
When an organization asks us to prepare its maturity assessment, the work follows this order.
Approval and submission stay with your organization. The scope and a fixed price go into a scope letter after a 30-minute conversation.
Leave your name and your number. A person calls you back the same business day, usually within an hour, and talks through what an assessment would cover for you.