O. Reg. 51/26 · Higher education

Cyber maturity assessment for Ontario colleges and universities

Cyber security for colleges and universities in Ontario now rests on two statutes. O. Reg. 51/26 covers every educational institution as FIPPA defines it, a college of applied arts and technology or a university, and sets the first cyber security maturity assessment for 1 July 2027 at the latest.¹² FIPPA's breach reporting duties have applied since 1 July 2025.²

Ask us to call you back Book the free audit

A pale stone college building with a tall glass entrance, yellow autumn trees and fallen leaves on the lawn, no signs or logos — Faculty-run systems belong in the same assessment as central IT.

A person here calls you back the same business day, usually within an hour.

Written permission first
A report in plain words
Checked again after the fix

Which colleges and universities the regulation covers

The regulation reaches every institution that FIPPA calls an educational institution, a term the Act defines as a college of applied arts and technology or a university.¹² Section 2 of O. Reg. 51/26 uses exactly that wording: “an educational institution as defined in subsection 2 (1) of the Freedom of Information and Protection of Privacy Act”. Those institutions carry the cyber security duties from 1 July 2026, and the provincial guidance lists colleges and universities among the sectors in scope.³

Where an organization sits at the edge of that wording, for example an affiliated or federated college, reading the definition is a question for the institution's counsel. Our work starts once the institution knows it is in scope, or chooses to run the same assessment voluntarily; the Ontario CMA Tool is open to organizations outside the regulation as well.⁵ The O. Reg. 51/26 overview covers hospitals, school boards and children's aid societies.

Cybersecurity for higher education in Ontario: duties and dates
Provision	What the institution must do	In force	Source
O. Reg. 51/26, ss. 3–4	Run a cyber security program; designate a primary point of contact and an alternate, both in senior management	1 July 2026	¹
O. Reg. 51/26, ss. 5–6	Complete an initial maturity assessment within one year, then at least once every two years; send a summary to the ministry CISO within 30 business days	1 July 2026; first assessment by 1 July 2027	¹
O. Reg. 51/26, s. 7	Report a critical cyber security incident within 72 hours of confirming it	1 July 2026	¹
FIPPA, s. 38 (3)	Prepare a written privacy impact assessment before collecting personal information	1 July 2025	²
FIPPA, s. 40 (5) and s. 40.1	Keep reasonable safeguards; report breaches with a real risk of significant harm to the Commissioner, notify the people affected and keep a record of each	1 July 2025	²

How FIPPA applies to cyber incidents on campus

Under FIPPA, a cyber incident becomes a privacy breach whenever personal information is stolen, lost, or used or disclosed without authority. Since 1 July 2025, the head of the institution reports such a breach to the Information and Privacy Commissioner of Ontario, and notifies each person affected, when it is reasonable to believe there is a real risk of significant harm.²

The Act names the factors for that test: the sensitivity of the information, the probability of misuse, the steps the person could take to reduce harm, and the Commissioner's guidance. The head also keeps a record of every such breach.² O. Reg. 51/26 then adds its own report to the ministry CISO for critical incidents, within 72 hours of confirmation, and states that FIPPA obligations continue to apply alongside it.¹

In practice that means two clocks, two recipients and one set of facts. Our assessment checks whether logs, account records and backups would let the institution establish those facts quickly: which systems were touched, whose information, and when.

One incident on campus, two reports: the ministry under O. Reg. 51/26 and the Commissioner under FIPPA.

Assessing decentralised faculty and department IT

A college cyber maturity assessment in Ontario rates the institution as one entity, even where faculties, departments, research groups and residences run systems of their own. The summary carries one overall maturity score, so the assessment has to reach past central IT to be accurate.¹

We handle that in four moves, each written into the scope letter so the institution can see what was sampled and why.

Map who runs what

We list the systems central IT runs, the ones faculties and departments run, and the cloud services bought locally. The map shows where institution-wide controls reach and where local practice takes over.

Sample faculties, then rate the whole

We interview central IT and a sample of faculties that differ in size and research activity, then rate each CMA statement for the institution as a whole and note where local practice departs from the central standard.⁴

Research data and partner terms

Research groups may hold data under agreements that set their own security terms. Where the institution shares those terms with us, we keep them visible in the gap plan next to the CMA findings.

Students, staff and short-term accounts

Admission cycles, term contracts and visiting researchers create accounts that open and close on different calendars. We look at how accounts start and end, where multi-factor sign-in applies, and who can reach student records.

What the Ontario CMA Tool measures

The Ontario CMA Tool measures cyber security maturity against NIST Cybersecurity Framework 2.0 with Ontario-specific adaptations, across Govern, Identify, Protect, Detect, Respond and Recover.⁴⁶ Each statement in the standard assessment, of which there are more than 100, is scored on a scale aligned with CMMI, from Level 0 for non-existent to Level 5 for optimized.⁴⁵

The regulation requires a completed assessment and a summary; using the tool itself is a choice, and an in-scope institution may submit its own summary directly to the ministry CISO.⁵ Whatever the method, the model has to reflect industry standards or best practices endorsed by that CISO.¹ Evidence stays on campus, since the tool records general descriptions and where proof is kept.⁵

How long a college or university assessment takes

Duration depends on the number of campuses, faculties and systems in scope and on how much is already documented; the scope letter sets the calendar before work begins. The regulation's own clock is fixed: initial assessment by 1 July 2027, summary within 30 business days of completion, next assessment within two years.¹

An institution that completed an assessment in the year before 1 July 2026 may elect to treat it as the initial one, and the two-year clock then runs from 1 July 2026.¹ Starting in the winter term gives time to close the first findings before the summary reaches the approver.

Scope letter: campuses, systems, CMA roles and dates
Interviews with central IT, the privacy office, finance and a sample of faculties
Ratings with written reasons, reviewed with the approver
Draft summary and gap plan, then a short review before approval

What the institution has in hand afterwards

When the work ends, the institution holds a report its senior leadership can read in one sitting and the material its primary contact needs to approve and file the summary.

A plain-language maturity report for the board of governors and senior leadership, with a technical appendix
A rating and a written reason for each CMA statement, ready to enter in the tool
A draft summary covering method, framework, overall score and areas for improvement, for the primary contact to approve¹
A map of central and faculty-run systems
A gap plan with priorities, owners and target dates
A short note on preparing the 72-hour report and the FIPPA breach report from the same facts

Why a contracted team: the risks of doing it alone, with a chatbot or a freelancer

Central IT can rate the controls it runs, and its view of faculty systems is often partial; a self-assessment then scores the institution on what one team can see. Cyber Security Ontario also suggests an approver separate from the assessor, which is easier to honour with outside help.⁴

A chatbot can summarize the CSF, yet it has never seen your identity system or a lab server, and pasting configurations or student data into a public tool can itself become a FIPPA question. A freelancer working alone rarely has the time to interview a sample of faculties, and the institution then carries one person's availability across a two-year cycle.

We work under a signed scope letter with commercial general liability insurance in force, and the report belongs to the institution, ready to anchor the next assessment.

Five plain reasons to trust us with this

A registered Canadian company
INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.
In practice since 2013
The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.
We run servers of our own
Our own servers and more than 80 websites are checked for known vulnerabilities every day.
Insured
Commercial general liability insurance of CAD 1 million is in force.
Your scope, your report
A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

Step 1

We agree what to check

A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

Step 2

You sign the scope letter

It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

Step 3

We check, and write it down

One report in plain words for you, with the technical detail attached for whoever looks after your systems.

Step 4

We fix it

We make the repairs ourselves, or together with your current IT provider or web developer.

Step 5

We check again

A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

Ask for a quote →

A fixed quote once the scope is agreed
The price in writing before work starts
A second check after the fixes

Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

Ask on a call

Are colleges and universities covered by O. Reg. 51/26?

Yes. The regulation prescribes educational institutions as defined in subsection 2 (1) of FIPPA, which means colleges of applied arts and technology and universities. From 1 July 2026 they run a cyber security program, designate a senior primary contact and alternate, report critical incidents within 72 hours, and complete a first maturity assessment by 1 July 2027. Edge cases, such as affiliated colleges, are a question for counsel.

How does FIPPA apply to cyber incidents?

When an incident involves theft, loss, or unauthorized use or disclosure of personal information, FIPPA applies. Since 1 July 2025 the head of the institution reports the breach to the Information and Privacy Commissioner and notifies the people affected if there is a real risk of significant harm, and keeps a record of every breach. A critical incident also goes to the ministry CISO under O. Reg. 51/26.

How do you assess decentralised faculty IT?

We first map which systems central IT runs and which ones faculties, departments and research groups run themselves. We then interview central IT and a sample of faculties that differ in size and research activity, rate each statement for the institution as a whole, and record where local practice departs from the central standard. The sample is written into the scope letter.

How long does it take?

It depends on the number of campuses, faculties and systems in scope and on how much is already documented, so we fix the calendar in the scope letter. The legal dates are set: the first assessment by 1 July 2027 and the summary within 30 business days after completion. Starting a term ahead leaves time to fix early findings.

Is the Ontario CMA aligned with NIST CSF 2.0?

Yes. Cyber Security Ontario states that the CMA Tool is based on the NIST Cybersecurity Framework 2.0 with Ontario-specific adaptations, using the six functions Govern, Identify, Protect, Detect, Respond and Recover. Statements are rated from Level 0, non-existent, to Level 5, optimized, on a scale aligned with CMMI levels. The tool is available in French and in English.

Who must be the designated cyber security point of contact?

An employee in a senior management position with decision-making authority over cyber security. The institution names a primary contact and an alternate, gives their name, title, phone number and email address to the ministry CISO, and reports changes within 10 business days. The primary contact approves every maturity assessment summary before it is submitted.

Can we use an assessment we completed last year?

Possibly. If the institution completed a cyber security maturity assessment within one year before 1 July 2026, it may elect to treat that assessment as its initial one. The next assessment is then due within two years of 1 July 2026. We can review the earlier work against the summary contents the regulation requires before you decide.

How much does a college or university assessment cost?

The price depends on the number of campuses, faculties and systems in scope, the documentation already in place, the number of interviews, and whether the faculty systems map and gap plan are included. After a 30-minute conversation we send a scope letter with a fixed price, so the institution knows the full amount before work begins.

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

Book the free audit instead

Same day callback
Written permission first
Fixed quote