O. Reg. 51/26 · child welfare

Cyber security maturity assessment for children’s aid societies

Children’s aid society cyber security in Ontario is now a legal duty: O. Reg. 51/26 names every society and asks for a cyber security program, two senior contacts, critical incident reports within 72 hours and a first cyber security maturity assessment no later than 1 July 2027.¹ We prepare that assessment with your team.

Ask us to call you back Book the free audit

A manager in her late fifties working on a laptop in a small office, closed archive boxes on the white shelves beside her — Case files, laptops and after-hours access are where a society’s cyber risk sits.

A person here calls you back the same business day, usually within an hour.

Written permission first
A report in plain words
Checked again after the fix

Which societies O. Reg. 51/26 covers, and what it asks of them

Every children’s aid society in Ontario is a prescribed public sector entity under section 2 of O. Reg. 51/26, the cyber security regulation made under the Enhancing Digital Security and Trust Act, 2024. The rules have applied since 1 July 2026.¹ The Government of Ontario’s summary adds that Indigenous child and family well-being agencies are in scope as well.²

The regulation is short and practical. It sets out seven duties, listed below with the section that creates each one. The O. Reg. 51/26 page covers the regulation for every sector; this page looks at what those duties mean for a society that holds child protection files, works after hours and often runs with a small administrative team.

What O. Reg. 51/26 asks of a children’s aid society
Duty	What the regulation says	Where
Cyber security program	Develop and implement a program that meets, at a minimum, the requirements of the regulation	s. 3 ¹
Two named contacts	A primary point of contact and an alternate, both employees in senior management with decision-making authority on cyber security	s. 4 (1)–(2) ¹
Contact details to the Ministry	Name, title, phone and email sent to the Ministry’s Chief Information Security Officer; changes reported within 10 business days	s. 4 (4) ¹
First maturity assessment	Completed no later than one year after the regulation first applies, which means by 1 July 2027	s. 5 (1) (a) ¹ ³
Repeat assessments	By the second anniversary of the first one, then at least once in every two-year period	s. 5 (1) (b) ¹
Assessment summary	Within 30 business days: method, framework name, overall score, areas to improve; approved by the primary contact	s. 6 ¹
Critical incident report	To the Ministry’s Chief Information Security Officer no later than 72 hours after the society confirms the incident	s. 7 (3) ¹

One incident, two reporting tracks: the Ministry and Part X of the CYFSA

A cyber incident at a children’s aid society can trigger two separate reports: one to the Ministry under the cyber security regulation, and privacy notices under Part X of the Child, Youth and Family Services Act, 2017. The regulation asks for a report to the Ministry’s Chief Information Security Officer within 72 hours of confirming a critical cyber security incident, and section 7 (5) says this leaves the society’s other legal obligations in place.¹

Under section 308 of that Act, a service provider, which includes a society, must take reasonable steps to protect personal information against theft, loss and unauthorized use or disclosure. When that information is stolen, lost or wrongly used or disclosed, the society notifies the people it relates to at the first reasonable opportunity, and notifies the Information and Privacy Commissioner and the Minister when the prescribed circumstances are met.⁴ The Commissioner publishes guidance on Part X for service providers.⁵

An incident counts as critical under the cyber regulation when it has affected the security, continuity, confidentiality, integrity or availability of the society’s digital information, or the infrastructure holding it, and meets at least one of these tests:¹

a significant adverse impact on the delivery of public services, such as intake or after-hours response;
a risk to public safety;
significant recovery effort, or activation of the society’s cyber security incident response plans;
a significant risk of harm to the society’s reputation and to public confidence in it.

What the 72-hour report must contain

The report names the primary contact and the alternate, the society, the ministry that oversees it, when the incident happened and when it was confirmed, a general description with the reason it counts as critical, and the type of information affected or stolen, if any.¹ We help the society decide in advance who confirms an incident, who writes the report and where these facts come from, so the clock does not start on an empty page.

How we assess a society’s cyber security maturity

We assess a children’s aid society against NIST Cybersecurity Framework 2.0, the framework the Ministry’s Chief Information Security Officer has approved for these assessments. The Ministry’s own CMA Tool uses the same framework, with more than 100 statements rated across six functions, and an outside provider may carry out the assessment as long as it follows a framework the Ministry’s CISO endorses, such as NIST CSF 2.0.¹³ The six functions are Govern, Identify, Protect, Detect, Respond and Recover.⁶

The work starts with a signed scope letter. It names the systems in scope, the people we interview, the dates, and what we will leave untouched.

A scope built around how a society works

A society’s risk sits in a few places: the case management system, email and file sharing used with courts, police, schools and foster families, the phones and laptops of workers in the field, after-hours access, and the outside providers who host or support these systems. The scope letter lists each one by name, so the assessment covers what holds child protection information.

Interviews with the people who run the work

We talk with the executive director or the senior manager named as primary contact, whoever runs IT (staff or an outside provider), and the people responsible for intake, records and after-hours service. Each answer is rated against the framework and backed by a note on where the evidence lives.

Evidence stays with the society

The Ministry’s tool asks for general descriptions only, such as which roles were consulted and where the evidence is stored locally; documents are not uploaded.³ We follow the same rule. We look at settings, policies and how access is granted, and we work without copying case records out of your systems.

Entering the results

In the Ontario CMA Tool, the contact manager and the approver use email addresses on the organization’s own domain, so those roles stay with the society’s staff.⁷ The society’s assessor and approver enter or submit the results; we hand them a finished assessment and a draft summary that follows section 6 of the regulation.

From naming the two contacts to the summary sent to the Ministry: the path to a society’s first assessment.

What the board and the primary contact receive

At the end of the engagement the society holds a written assessment it owns and can submit, plus the material its leadership needs to act on it. The primary point of contact approves the summary that goes to the Ministry, so that person gets a version written in plain language first.¹

a maturity report in plain language for the executive director and the board, with the overall score and the scores by function;
a technical appendix for whoever runs IT, with each finding and the evidence location;
a list of gaps ranked by priority: fix now, fix this year, plan for the next assessment;
a work plan that names an owner and a target date for each gap;
a draft of the assessment summary with the four elements section 6 requires, ready for the primary contact to review and approve;
a short note on incident roles for the 72-hour report and the Part X notices.

A small society with no IT staff can still meet the 2027 deadline

A society without in-house IT staff can meet the 1 July 2027 deadline. The Ministry’s FAQ says cyber security knowledge is an asset for the people completing the assessment, without making it a requirement.³ What a small society needs is a few hours from the people who know how the work is done, and a provider that knows the framework.

Timing depends on how fast interviews can be booked and how many outside providers hold your systems. The scope letter fixes the dates before work begins. A society that completed an assessment between 1 July 2025 and 30 June 2026 may count it as its first one, and should check whether it followed a framework the Ministry accepts.¹ ³

Why a contracted team: the risks for a society going it alone, with a chatbot or a freelancer

A society that rates itself alone tends to score what it hopes is true. The summary sent to the Ministry carries the primary contact’s approval, and an optimistic score sets a baseline that the next assessment, two years later, has to explain.

A chatbot can draft text that sounds right and still cite the wrong section, the wrong deadline or a framework the Ministry never approved. Pasting descriptions of case systems into a public tool can also count as a disclosure the society must account for under Part X.

A freelancer can be skilled and still leave the society with no signed scope, no insurance and no one to call when a question comes back from the Ministry. A contracted team works under a written scope letter, keeps the report in the society’s hands, and stays available for the follow-up.

Five plain reasons to trust us with this

A registered Canadian company
INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.
In practice since 2013
The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.
We run servers of our own
Our own servers and more than 80 websites are checked for known vulnerabilities every day.
Insured
Commercial general liability insurance of CAD 1 million is in force.
Your scope, your report
A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

Step 1

We agree what to check

A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

Step 2

You sign the scope letter

It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

Step 3

We check, and write it down

One report in plain words for you, with the technical detail attached for whoever looks after your systems.

Step 4

We fix it

We make the repairs ourselves, or together with your current IT provider or web developer.

Step 5

We check again

A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

Ask for a quote →

A fixed quote once the scope is agreed
The price in writing before work starts
A second check after the fixes

Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

Ask on a call

Are children's aid societies covered by O. Reg. 51/26?

Yes. Section 2 of O. Reg. 51/26 lists a children's aid society as a prescribed public sector entity, alongside school boards, colleges and universities, Group A, B and C public hospitals and the University of Ottawa Heart Institute. The Government of Ontario adds that Indigenous child and family well-being agencies are in scope. The rules have applied since 1 July 2026.

When is the first cyber security maturity assessment due for a society?

The first assessment must be completed no later than one year after the regulation first applies, so by 1 July 2027. The summary goes to the Ministry's Chief Information Security Officer within 30 business days of completion. After that, a society repeats the assessment by the second anniversary of the first one and at least once in every two-year period.

How do you protect case files during an assessment?

We assess systems, settings and practices, and we work without copying case records out of the society's systems. The scope letter names what we look at and what stays untouched. Findings refer to where the evidence is kept, the same approach the Ministry's CMA Tool uses, and everything we see is covered by a confidentiality agreement.

Can a small society meet the deadline with no IT staff?

Yes. The Ministry's own FAQ says cyber security knowledge is an asset for the people doing the assessment, without making it a requirement. We bring the method and the framework; the society brings a few hours from the people who run intake, records and after-hours work, and from whoever supports its systems today.

What does the board need to see?

The board needs the overall maturity score, the scores by function, the gaps that carry the most risk and a plan with owners and dates. We write that version in plain language. The regulation itself asks the primary point of contact, a senior manager, to approve the summary that goes to the Ministry.

Do we have to report cyber incidents within 72 hours?

A critical cyber security incident must be reported to the Ministry's Chief Information Security Officer as soon as reasonably practical and no later than 72 hours after the society confirms it occurred. Privacy duties under Part X of the Child, Youth and Family Services Act, 2017 apply separately, including notices to affected people and, in prescribed cases, to the Commissioner and the Minister.

Can we hire a vendor or must we use the Ontario CMA Tool?

Both routes are allowed. The Ontario CMA Tool is free, and in-scope organizations may also use an outside provider if the assessment follows a framework the Ministry’s CISO endorses, such as NIST CSF 2.0. The tool asks for an email address on the society's own domain for its contact manager and approver, so your approver submits the results.

How much does an assessment for a society cost?

The price depends on the number of sites and devices, the systems in scope, how many outside providers host them, and whether you want help closing the gaps afterwards. After a 30-minute conversation we send a scope letter with a fixed price, the dates and the list of deliverables, so the board approves a known amount.

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

Book the free audit instead

Same day callback
Written permission first
Fixed quote