itopsi
Pricing
About
Contact
FrançaisCall me back
Certification preparation

CyberSecure Canada certification readiness for small and medium organizations

CyberSecure Canada certification readiness is the work done before the audit: comparing your organization with the national standard CAN/DGSI 104, fixing the gaps and putting the evidence in order. An accredited certification body then audits you and issues the certificate.12 We do the preparation, so the audit finds what your documents describe.

Ask us to call you backBook the free audit
A small-business owner in his late fifties working on a laptop at a wooden table in his stockroom, plain cardboard boxes on metal shelves behind him
CyberSecure Canada is sized for businesses like this one: a few people and the laptop the business runs on.

A person here calls you back the same business day, usually within an hour.

  • Written permission first
  • A report in plain words
  • Checked again after the fix

What CyberSecure Canada certification checks

CyberSecure Canada certification checks one national standard, CAN/DGSI 104:2021 / Rev 1: 2024, Baseline cyber security controls for small and medium organizations. The standard sets a minimum set of controls for organizations that typically have less than 500 employees.1 Its own notes add that an organization handling personal, financial or sensitive information, or supplying a high-risk sector, may need controls beyond it.1

The program is voluntary.5 Certified organizations can show the CyberSecure Canada mark on their website and as decals on their premises, which lets customers, investors, partners and suppliers see that the business has acted to protect itself from cyber threats.65

CyberSecure Canada at a glance, checked against the program's official pages
PointWhat the source saysSource
Standard auditedCAN/DGSI 104:2021 / Rev 1: 2024, current edition1
Intended forSmall and medium organizations, typically less than 500 employees1
Requirement levelsLevel 1 and Level 2; the 2024 revision clarified the difference in six areas7
Who audits and certifiesA certification body accredited by the Standards Council of Canada25
Program information since 31 March 2023Standards Council of Canada; ISED is no longer the program authority4
Next editionCAN/DGSI 104:2021 / Rev 2: 2026, listed as proceeding to development9

Who runs CyberSecure Canada since 31 March 2023

Since 31 March 2023, Innovation, Science and Economic Development Canada is no longer the program authority for CyberSecure Canada, and it sends organizations to the Standards Council of Canada (SCC) for current program information, certification and recertification.4 The SCC accredits the certification bodies, on the basis of ISO/IEC 17021-1, the international standard for bodies that audit and certify management systems.2

The SCC's directory of accredited organizations lists the certification bodies under the specialty area CyberSecure Canada Certification Scheme (CSC).3 The certification body is the one that confirms you are ready, gives you its cost estimate and audits how you implemented the controls.5 Our role sits before that audit.

Baseline cyber security controls for small and medium organizations, and what the national standard adds

The baseline cyber security controls for small and medium organizations began as 13 controls published by the Canadian Centre for Cyber Security, version 1.2, from an incident response plan to secure portable media.10 Since 1 January 2023, accredited bodies certify new clients to the national standard, first issued as CAN/CIOSC 104:2021, which replaced version 1.2 as the basis of the audit.8

The SCC's transition bulletin describes the national standard in two parts. Its organizational controls are leadership, accountability and a cyber security risk assessment, all new, plus cyber security and employee awareness training; its baseline controls are the other twelve CCCS controls plus two new ones, point of sale and financial systems, and computer security log management.8 The table shows our readiness work for each area; the CyberSecure Canada certification guide explains the controls themselves in plain words.

Control areas of CAN/DGSI 104 and our readiness work on each
Control areaOur readiness work
Leadership, accountability, cyber security risk assessment, awareness trainingWe run the risk assessment with management, name an owner for each control and record who approves what.
BC.1 Develop an incident response planA plan written for your organization, with the contacts of your insurer, the Cyber Centre and police, walked through in a tabletop exercise.
BC.2 Patching, BC.3 Security software, BC.4 Secure configurationEvery device listed; automatic updates and security software confirmed; default settings closed; fixes done under hardening.
BC.5 Strong user authentication, BC.12 Access controlMulti-factor sign-in on email, remote access and admin accounts; separate admin accounts; access removed the day someone leaves.
Employee awareness training (BC.6 in the CCCS list)Short training in plain language, with a dated attendance record; phishing simulations if you want them.
BC.7 Backup and encrypt dataEncrypted copies kept apart from the network, and a restore test with its date and result on file (backup and recovery).
BC.8 Secure mobility, BC.13 Secure portable mediaRules for phones and USB drives that match how people work, applied in the device settings.
BC.9 Perimeter defences, BC.11 Secure websitesFirewall, guest Wi-Fi and remote access reviewed; DMARC on the mail domain (email security); the website checked.
BC.10 Secure cloud and outsourced IT servicesA list of cloud and IT providers, what each one protects, and contract points for your lawyer (vendor risk).
Point of sale and financial systems, log managementCard terminals and accounting systems separated from everyday use; logging turned on for the systems that matter, with a review you can show.

CyberSecure Canada requirements: what is ready before the audit

To meet the CyberSecure Canada requirements on audit day, an organization needs the controls running and the records that show it. The written record is often the larger half of the work, and the part a small business has never collected in one place. Our deliverables are built for that moment, and they all belong to you.

  • The scope of certification and the requirement level, agreed with you and confirmed with your certification body
  • A gap review against CAN/DGSI 104, each gap ranked fix today, this month or later
  • Policies and procedures written for your organization, with a security policy for each area the standard covers
  • A risk register and the risk assessment record
  • The technical gaps fixed, by us or with your IT provider, each with a date
  • An evidence folder organized by control, and an internal audit report
  • A short list of what is left before the certification audit

How the readiness work runs, step by step

Readiness work runs in five steps under one scope letter, and it ends where the certification body begins. A 30-minute conversation sets the scope: which part of the organization is certified, which level applies, and whether we fix the gaps or your IT provider does.

We then review each control area, fix or coordinate the fixes, write the documents and run an internal audit the way an auditor would read your evidence. You choose the certification body; parts of its audit can run online when you both agree, under the international rules accredited bodies apply since 30 January 2026.11 We answer its questions about the evidence during the audit when you ask us to.

With us Certification body Scope and requirement level Gap review against CAN/DGSI 104 Fixes and written evidence Internal audit, list of what is left You choose an accredited body Certification audit Certificate and mark, then recertification 1 2 3 4 5 6 7
From scope to certificate: five readiness steps we do with you, then the accredited certification body's part.

CyberSecure Canada certification cost: what you pay for

CyberSecure Canada certification cost has two parts: the preparation and the certification body's fee. The certification body gives its own cost estimate after it consults with your organization.5 Our preparation is priced in the scope letter, as a fixed amount agreed before work starts.

  • Size and locations: how many people, sites and devices fall inside the scope
  • Starting point: which controls already run and how much is written down
  • Level: Level 1 or Level 2 requirements
  • Outside providers: cloud services, hosting and an IT contractor all count
  • Fixes: whether we close the technical gaps or report them to your IT provider

Why a contracted team: the risks of doing it alone, with a chatbot or a freelancer

A small business preparing alone usually gets the technology close and the records thin: updates run, yet nobody can show the restore test, the training record or the risk assessment the national standard added. Those gaps then surface in front of the certification body, and the timeline slips.

A chatbot confuses the 13 CCCS controls with the national standard, misses the two added controls and writes policies for an imaginary company. A freelancer can configure a firewall, though rarely writes the incident plan, keeps the evidence folder in audit order or stays on hand for recertification.

A contracted team works under a signed scope letter, dates each fix, hands every document to you and answers for its part. INNOVA CONSULT LTD. carries commercial general liability insurance, and the price of the preparation is fixed before it starts.

Five plain reasons to trust us with this

  • A registered Canadian company

    INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.

  • In practice since 2013

    The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.

  • We run servers of our own

    Our own servers and more than 80 websites are checked for known vulnerabilities every day.

  • Insured

    Commercial general liability insurance of CAD 1 million is in force.

  • Your scope, your report

    A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

  1. Step 1

    We agree what to check

    A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

  2. Step 2

    You sign the scope letter

    It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

  3. Step 3

    We check, and write it down

    One report in plain words for you, with the technical detail attached for whoever looks after your systems.

  4. Step 4

    We fix it

    We make the repairs ourselves, or together with your current IT provider or web developer.

  5. Step 5

    We check again

    A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

  • A fixed quote once the scope is agreed
  • The price in writing before work starts
  • A second check after the fixes
Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

What is CyberSecure Canada?
CyberSecure Canada is a voluntary federal certification program for small and medium organizations in Canada. An organization implements the controls of the national standard CAN/DGSI 104, then a certification body accredited by the Standards Council of Canada audits it. Certified organizations can display the CyberSecure Canada mark on their website and premises, which tells clients, partners and suppliers that their security was independently checked.
Who is eligible for CyberSecure Canada certification?
The program is designed for small and medium-sized enterprises and other organizations in Canada. The national standard behind it targets organizations that typically have less than 500 employees, and its notes say larger organizations can use it as a starting point. Organizations that handle sensitive information or supply high-risk sectors may need controls beyond the standard, so a client's request should be read closely first.
How long does CyberSecure Canada certification last?
Innovation, Science and Economic Development Canada's information sheet describes the certification mark as valid for two years. Since 31 March 2023, certification and recertification are handled through the Standards Council of Canada and the accredited certification bodies, so your certification body confirms the current cycle when it quotes. Keeping the controls running between audits makes recertification a repeat of records you already keep.
Can the certification audit be remote?
Parts of it can be, when you and the certification body agree. The Standards Council of Canada requires accredited management system bodies that use remote or online techniques to apply IAF MD 4:2025 from 30 January 2026, and that document makes the use of such technology a mutual decision with security and privacy measures in place. Ask the certification body how much of your audit it plans to do online.
How much does CyberSecure Canada certification cost?
The total has two parts. The certification body sets its own fee and gives you a cost estimate after reviewing your organization. Our preparation depends on the number of people, sites and devices in scope, how many controls already run and are documented, the requirement level and whether we fix the gaps. After a 30-minute conversation you receive a scope letter with a fixed price for our part.
Do you issue the CyberSecure Canada certificate?
The certificate comes only from a certification body accredited by the Standards Council of Canada; the SCC directory lists them under the CyberSecure Canada Certification Scheme. Our part is readiness: the gap review, the fixes, the documents, the evidence folder and an internal audit. You choose and contract the certification body, and we can answer its questions about the evidence during the audit.
CyberSecure Canada or ISO 27001: which comes first?
For most small Canadian businesses, CyberSecure Canada comes first: the standard is written for organizations that typically have less than 500 employees and the audit is lighter. ISO/IEC 27001 requires a full information security management system and suits firms whose larger or foreign clients name it in contracts. Much of the CyberSecure Canada evidence carries over, so the second certificate builds on the first.

Read this next

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

  • Same day callback
  • Written permission first
  • Fixed quote

Ask us to call you back

Leave your name and number. A real person calls you back the same business day, usually within an hour.

We use your number to call you back about your request. Nothing else.

Call me back