In short
- CyberSecure Canada is the national cybersecurity certification for small and medium organizations. It checks a baseline set of controls written into the national standard CAN/DGSI 104.
- Since 31 March 2023 the program runs through the Standards Council of Canada. An accredited certification body audits you and issues the certificate.
- Most of the work is ordinary housekeeping done properly and written down: updates, backups, sign-in, access, training, and a plan for a bad day.
More and more Canadian businesses hear the same question from a client, an insurer or a larger company they want to sell to: can you show us that you take security seriously? A certificate answers that in one line. For a business with a handful of people and no security department, CyberSecure Canada is usually the certificate that fits.
This guide explains what it is, what the audit looks at, how the process runs, and how to prepare. The facts here were checked on 11 October 2026 against the program pages of Innovation, Science and Economic Development Canada, the Standards Council of Canada and the Canadian Centre for Cyber Security.
What CyberSecure Canada is
CyberSecure Canada is a certification program for small and medium organizations. Innovation, Science and Economic Development Canada (ISED) launched it, and on 31 March 2023 ISED stopped being the program authority. Certification, recertification and the list of certification bodies now sit with the Standards Council of Canada (SCC).
A certified organization can display the CyberSecure Canada mark under the program's display rules. The mark tells clients and partners that an independent auditor checked your controls against the national standard.
The standard behind it: CAN/DGSI 104
The audit checks one national standard: CAN/DGSI 104:2021 / Rev 1:2024, Baseline cyber security controls for small and medium organizations. It started in 2021 as CAN/CIOSC 104:2021 under the CIO Strategy Council and is now maintained by the Digital Governance Standards Institute. New certifications have been issued against the 2021 standard since 1 January 2023.
The standard targets organizations that typically have fewer than 500 employees. It sets a minimum. If you handle health records, financial data or supply a high-risk sector, your clients or regulators may ask for more than this baseline.
The 2024 revision clarified the difference between Level 1 and Level 2 requirements in areas such as training, risk assessment and incident response. Ask your certification body which level applies to you before you start.
What the controls cover
The standard grew out of the Canadian Centre for Cyber Security's public guidance, Baseline Cyber Security Controls for Small and Medium Organizations. Its thirteen control areas are a good map of what the audit will ask about:
- An incident response plan. Who does what in the first hour when something goes wrong, written down and known.
- Automatic patching of operating systems and applications.
- Security software turned on and kept current on every device.
- Securely configured devices: default passwords changed, unneeded services off.
- Strong sign-in, with the second sign-in step on accounts that matter.
- Staff awareness training, so people recognize a fake invoice or a fake sign-in page.
- Backups, encrypted, and tested by restoring them.
- Secure mobile devices, including phones that read company email.
- Basic perimeter defences: a firewall, a separate guest Wi-Fi, safe remote access.
- Secure cloud and outsourced IT, with clear contracts on who protects what.
- Secure websites, built and maintained against the well-known classes of web attack.
- Access control: each person can open what their job needs, and leavers lose access the day they go.
- Secure portable media such as USB drives.
All of this is ordinary work. The audit asks two questions about each area: do you do it, and can you show that you do it.
How certification works
Step one: read the standard and pick your scope. Decide which part of the organization is being certified. For most small businesses this is the whole company.
Step two: close the gaps. Compare what you do today with each control. Fix what is missing, and write down how you do what you already do. The written record is often the larger half of the work.
Step three: choose an accredited certification body. The SCC accredits the bodies allowed to audit against the program. Get quotes from more than one: price and audit format differ.
Step four: the audit. The certification body reviews your documents and evidence and asks questions. Gaps it finds have to be closed before the certificate is issued.
Step five: keep it. Certification is maintained through recertification. Treat the controls as a routine, so the next audit finds the same picture as the first.
CyberSecure Canada or ISO/IEC 27001?
CyberSecure Canada checks a baseline set of controls sized for small and medium organizations. The audit is lighter, the preparation is shorter, and it answers the usual client question well.
ISO/IEC 27001 is the international standard for running a complete information security management system. It asks for a formal risk process, a Statement of Applicability, internal audits and management review, and its audit is heavier. Large clients, especially outside Canada, often ask for it by name.
A reasonable path for a growing firm is CyberSecure Canada first and ISO/IEC 27001 later. Most of the evidence you build for the first carries over to the second.
Mistakes that cost time
- Treating it as paperwork. The auditor asks for evidence: the backup you restored, the account you removed when someone left. Policies with nothing behind them fail.
- Forgetting the outsourced parts. Your website host, your email provider and your IT contractor are part of your security. You need to know what each one protects.
- Leaving the incident plan for last. It is short to write and auditors look at it closely.
- Leaving it without an owner. One named person keeps the controls running between audits. Without that person, the routine fades after the certificate arrives.
Free help worth using
The Canadian Centre for Cyber Security's Learning Hub offers a free course, Cyber Security for Small and Medium Organizations (Course 625). It is a good way for the person who will own the program to learn the vocabulary before the work starts.
Where this sits in the rest of your setup
Several controls are covered in our other guides. The invoice scam guide covers sign-in, mail rules and staff awareness. The infrastructure checklist covers patching, backups and devices. If you want to know where you stand today, a security check of your website and server sorts every gap into fix today, this month, and later.
Have someone prepare it with you
We prepare small businesses for CyberSecure Canada and ISO/IEC 27001: the policies, the risk register, the Statement of Applicability, an internal audit, and a list of what is left before the certification audit. We fix the technical gaps ourselves or with your IT provider. The certificate itself comes from an accredited certification body.
Leave your name and number on the contact page and a person calls you back the same business day, usually within an hour.
Sources: ISED, CyberSecure Canada program page (modified 24 September 2025); Standards Council of Canada, standards database entry for CAN/DGSI 104:2021 / Rev 1:2024; Canadian Centre for Cyber Security, Baseline Cyber Security Controls for Small and Medium Organizations V1.2 and Learning Hub Course 625.
