CCCS Baseline Controls explained for Ontario small business

In short

• The CCCS baseline controls are 13 security measures the Canadian Centre for Cyber Security published for organizations with less than 500 employees. The current guidance is version 1.2.
• Since 1 January 2023, CyberSecure Canada audits use the national standard CAN/DGSI 104, which grew out of that guidance and added leadership, accountability, risk assessment, point-of-sale systems and log management.
• For an Ontario small business the controls are voluntary. They matter because clients, insurers and federal privacy law expect the same groundwork.

The CCCS baseline controls are the shortest official answer to a question Ontario owners hear from clients and brokers: what does reasonable cyber security look like at your size? The Canadian Centre for Cyber Security published them as Baseline Cyber Security Controls for Small and Medium Organizations. Below: the 13 controls, the national standard and certification built on them, and the Ontario obligations they meet. Facts were checked against primary sources on 24 October 2026.

What the CCCS baseline controls are

The baseline controls are a free federal guidance document listing 13 security measures sized for small and medium organizations. The current version is V1.2, last modified on 18 February 2020, and it is written for organizations "that have less than 500 employees", the definition it takes from Innovation, Science and Economic Development Canada.

The authors describe their approach as an attempt "to apply the 80/20 rule (achieve 80% of the benefit from 20% of the effort)". The guidance cites the National Cyber Threat Assessment 2018, which judged cybercrime the threat most likely to affect Canadian small and medium organizations, and says the controls were designed to be effective against it. Larger organizations, it says, "should invest in more comprehensive cyber security measures", such as the CIS Controls, the NIST Cybersecurity Framework, ISO/IEC 27001 or ITSG-33.

Five questions the guidance asks before any control

Before the first control, the guidance asks five planning questions that decide how much of the baseline applies:

• Assess organizational size: are you inside the small and medium definition?
• Determine what information technology is in scope: computers, phones, cloud services, websites.
• Determine the value of information systems and assets: what would hurt most if lost, leaked or locked.
• Confirm the cyber security threat level: the baseline assumes cybercrime.
• Confirm cyber security investment levels: the document cites spending of "up to 13% of their IT budget" and recommends that organizations "expend 4-7% of their IT budget on cyber security".

For a 15-person office, these answers fit on one page and keep effort on the systems that hold client files.

The 13 baseline controls, in plain words

The 13 controls cover planning, devices, people, data, networks, outsourced services and websites. Under their official titles:

• BC.1 Develop an Incident Response Plan: a written plan "that details who is responsible for handling incidents".
• BC.2 Automatically Patch Operating Systems and Applications: automatic patching for software and hardware, and a decision about devices that cannot update themselves.
• BC.3 Enable Security Software: anti-malware that updates and scans automatically, plus software firewalls.
• BC.4 Securely Configure Devices: "changing all default passwords, turning off unnecessary features, and enabling all relevant security features."
• BC.5 Use Strong User Authentication: "implement two-factor authentication wherever possible".
• BC.6 Provide Employee Awareness Training: password policies, malicious emails and links, approved software, Internet use and social media.
• BC.7 Backup and Encrypt Data: encrypted backups, ideally stored off-site, with long-term copies (weekly ones, for example) kept offline.
• BC.8 Secure Mobility: a chosen ownership model for phones and tablets, work data kept apart from personal data, apps from approved sources, sensitive data encrypted.
• BC.9 Establish Basic Perimeter Defences: firewalls at the Internet boundary, DNS filtering, a VPN with two-factor authentication for remote access, secure Wi-Fi, and DMARC on every email service.
• BC.10 Secure Cloud and Outsourced IT Services: cloud providers should share an AICPA SSAE 18 SOC 3 report, and you should know how a provider reports unauthorized access and destroys data at the end of a contract.
• BC.11 Secure Websites: websites should meet the OWASP ASVS Level 1 guidelines.
• BC.12 Implement Access Control and Authorization: the "principle of least privilege", with administrator accounts kept for administrative work only.
• BC.13 Secure Portable Media: only organization-owned, encrypted USB drives and similar media, wiped or destroyed before disposal.

Each control is familiar work. The hard part is running all thirteen at once and showing proof when asked.

How the baseline controls map to CAN/DGSI 104

CAN/DGSI 104 is the National Standard of Canada built on the CCCS guidance, and certification audits use it today. It was published in November 2021 as CAN/CIOSC 104:2021 by the CIO Strategy Council and the Government of Canada. A Standards Council of Canada (SCC) bulletin of 18 November 2022 told certification bodies that from 1 January 2023 all new clients must be audited against it, replacing the CCCS guidance V1.2. The Digital Governance Standards Institute now maintains it, and its scope covers "small and medium organizations which typically have less than 500 employees".

The standard keeps the 13 baseline controls and adds to them. The SCC bulletin lists:

• Organizational controls: leadership (new), accountability (new), cybersecurity risk assessment (new), and employee awareness training, which moves into this group.
• Two new baseline controls: point of sale and financial systems, and computer security log management.

The current edition is CAN/DGSI 104:2021 / Rev 1:2024. SCC bulletin 2025-14 (13 June 2025) says the revision adds four definitions and gives "additional clarity on Level 1 versus Level 2 requirements" for training, risk assessment, the incident response plan, secure configuration, backups, and cloud, outsourced IT and websites.

Where CyberSecure Canada fits

CyberSecure Canada is the certification program that audits a business against CAN/DGSI 104 and lets it display a certification mark. ISED created the program and stopped being its program authority on 31 March 2023; SCC now holds that role. SCC accredits certification bodies against ISO/IEC 17021-1, the international standard for management system audit and certification, and one of those bodies performs your audit and issues the certificate.

Our CyberSecure Canada certification guide walks through the steps, and the CyberSecure Canada readiness service covers the preparation. The certificate itself comes from a certification body holding SCC accreditation.

What an Ontario small business faces in practice

Ontario has no law that makes the baseline controls compulsory for a private business. The pressure comes from obligations that ask for the same groundwork:

• Federal privacy law. The federal privacy commissioner lists Alberta, British Columbia and Quebec as the provinces with private-sector laws substantially similar to the Personal Information Protection and Electronic Documents Act (PIPEDA). Ontario is absent from that list, so PIPEDA governs how Ontario businesses handle personal information in commercial activity. Its safeguards principle asks for "security safeguards appropriate to the sensitivity of the information". A breach creating a "real risk of significant harm" must be reported to the Office of the Privacy Commissioner of Canada and to the people affected, and records of all breaches kept for two years. See PIPEDA and Law 25.
• Health information. Clinics and other health information custodians also answer to Ontario's Personal Health Information Protection Act (PHIPA). See PHIPA security.
• Public-sector clients. Ontario Regulation 51/26, in force since 1 July 2026, requires school boards, colleges and universities, children's aid societies, public hospitals graded Group A, B or C and the University of Ottawa Heart Institute to run cyber security maturity assessments. Private businesses are outside that list, though a supplier to those organizations may hear questions about the data it handles. See O. Reg. 51/26.

Why a contracted team: the risks of working through it alone, with a chatbot or a freelancer

The free guidance dates from 2020 while the certification standard has moved through two editions, so an owner working alone, or a chatbot summarizing the web, easily prepares for a text the auditor no longer uses.

A chatbot sounds complete and carries no responsibility; it cannot check whether two-factor sign-in is enforced in your tenant or test a restore.

A freelancer can do excellent technical work, and the gap appears at handover: policies, evidence and open items often leave with the person.

A contracted team works under a scope letter with a fixed scope and price, checks each finding by hand, fixes what it finds or works with your IT provider, and hands you a report that belongs to you.

How we help Ontario businesses with the baseline controls

We start with a security audit that reads your setup against the baseline controls and sorts every gap into fix today, this month and later. We write information security policies for your organization in English or French, and our hardening work closes technical gaps, proven by a test restore and a second check.

itopsi is a brand of INNOVA CONSULT LTD., a federal corporation based in Ottawa. The price is fixed in a scope letter after a 30-minute conversation about your systems.

Questions Ontario owners ask about the baseline controls

What are the 13 CCCS baseline controls?

An incident response plan, automatic patching, security software, secure device configuration, strong user authentication, employee awareness training, encrypted backups, secure mobility, basic perimeter defences, secure cloud and outsourced IT services, secure websites, access control, and secure portable media, numbered BC.1 to BC.13 in the CCCS guidance V1.2.

Are the baseline controls mandatory in Ontario?

The CCCS baseline controls are voluntary guidance, and CyberSecure Canada certification is voluntary too; neither Ontario nor federal law makes them compulsory for a private business. They become expected when a client contract, an insurer's questionnaire or a customer's security review asks for them, and PIPEDA already requires safeguards suited to the personal information you hold.

What is the difference between the CCCS guidance and CAN/DGSI 104?

The CCCS document is free federal guidance listing 13 controls. CAN/DGSI 104 is the National Standard of Canada built from it, published in 2021 as CAN/CIOSC 104:2021 and revised in 2024. It adds leadership, accountability, risk assessment, point-of-sale systems and log management, and CyberSecure Canada audits use it.

Who is eligible for CyberSecure Canada?

The program is aimed at small and medium enterprises, and the national standard describes its audience as organizations "which typically have less than 500 employees". The certification body you choose confirms whether your organization and proposed scope fit before the audit begins, so ask when you request quotes.

How much should a small business spend on the baseline controls?

The CCCS guidance recommends 4 to 7 percent of the IT budget for cyber security and notes spending of up to 13 percent. Your real cost depends on your devices, accounts and cloud services and what is already in place. We quote a fixed price in a scope letter after a 30-minute conversation.

Leave your name and number on the contact page and a person calls you back the same business day, usually within an hour.

Sources, checked 24 October 2026: CCCS, Baseline Cyber Security Controls for Small and Medium Organizations V1.2 (modified 18 February 2020); SCC bulletins 2022-20 (18 November 2022) and 2025-14 (13 June 2025); SCC notice of intent, CAN/DGSI 104:2021 (Rev 2024); SCC CyberSecure Canada program page; ISED CyberSecure Canada page (modified 24 September 2025); OPC, PIPEDA in brief (modified 1 May 2024) and breach reporting guidance (modified 11 August 2025); PIPEDA Schedule 1, clause 4.7; O. Reg. 51/26, ss. 2 and 8.