itopsi
Pricing
About
Contact
FrançaisCall me back
O. Reg. 51/26 · School boards

Cyber security maturity assessment for Ontario school boards

School board cyber security Ontario-wide now has a legal floor. Since 1 July 2026, every school board is a prescribed entity under O. Reg. 51/26: it names a senior cyber security contact, reports critical incidents within 72 hours and completes its first cyber security maturity assessment by 1 July 2027.1 We prepare that assessment with your board.

Ask us to call you backBook the free audit
A school meeting room overlooking the schoolyard, a basketball hoop and a play structure outside, a green binder and a closed laptop on the table
The assessment is prepared with the board's senior team and IT.

A person here calls you back the same business day, usually within an hour.

  • Written permission first
  • A report in plain words
  • Checked again after the fix

Cybersecurity for school boards: the rules in force from 2026

Three sets of rules now shape cybersecurity for school boards in Ontario, and each one has its own start date. O. Reg. 51/26 lists “a school board” among the prescribed public sector entities, and the Act defines a school board by reference to the Education Act, so every board carries the cyber security duties from 1 July 2026.13 O. Reg. 52/26 adds notice duties about student data shared with software applications, and amendments to MFIPPA add privacy breach reporting from 1 January 2027.27

Our O. Reg. 51/26 overview reads the regulation section by section. This page stays with what changes inside a board: who signs, what gets rated, and how the rules meet after an incident.

What an Ontario school board works under, and since when
RuleWhat it asks of the boardIn forceSource
O. Reg. 51/26 (cyber security)A cyber security program, a senior primary contact and alternate, a maturity assessment with a summary to the ministry, critical incident reports within 72 hours1 July 20261
O. Reg. 52/26 (individuals under 18)Written notice to a parent or guardian (students under 16) or to the student (16 and 17) when personal digital information goes to a third-party software application1 July 20262
MFIPPA, s. 28 (3)A written privacy impact assessment before the board collects personal information1 January 20277
MFIPPA, s. 30 (5) and 30.1Reasonable safeguards; a report to the Information and Privacy Commissioner and notice to the people affected when a breach creates a real risk of significant harm1 January 20277

The primary contact and alternate: who signs for the board

Each board must designate two senior employees for cyber security, a primary point of contact and an alternate, under O. Reg. 51/26, and both need decision-making authority over cyber security.1 The primary contact speaks for the board with the ministry and approves every maturity assessment summary; the alternate takes over when the primary is unavailable.

The regulation leaves the job title to the board and fixes the level. Names, titles, phone numbers and email addresses go to the Chief Information Security Officer of the Ministry of Public and Business Service Delivery and Procurement, and any change follows within 10 business days.14

  • Develop and implement a cyber security program that meets the regulation at a minimum (s. 3).1
  • Designate a primary contact and an alternate, both in senior management (s. 4 (1) and (2)).1
  • Send their details to the ministry CISO and update them within 10 business days of a change (s. 4 (4)).1
  • Report a critical cyber security incident to the ministry CISO within 72 hours of confirming it (s. 7 (3)).1

School board cyber maturity assessment: what gets rated

A school board cyber maturity assessment rates how far the board's cyber security has come, using industry standards or best practices endorsed by the ministry's Chief Information Security Officer.1 The Ontario CMA Tool on Cyber Security Ontario follows NIST Cybersecurity Framework 2.0 with Ontario adaptations and rates each statement from Level 0 (non-existent) to Level 5 (optimized).59

The standard assessment holds more than 100 statements across six functions: Govern, Identify, Protect, Detect, Respond and Recover.65 A board may complete it in the tool or send its own summary to the ministry CISO. Either way the summary is due within 30 business days of completing the assessment and names the method, the framework, an overall maturity score and the areas for improvement.61

Student information and learning applications

Student records, attendance and the classroom applications that receive student data sit at the centre of the Identify and Protect functions; the same inventory supports the notices O. Reg. 52/26 requires.

K-12 cybersecurity beyond the classroom: staff and student accounts

Large account populations, shared devices and seasonal staff changes make identity hard to keep current. We look at how accounts are created and closed, and where multi-factor sign-in is in place. Cyber Security Ontario runs a K-12 Zone with lessons for students;8 our part is the board's own systems and staff.

Many schools, one board

Ratings describe the board as a whole, so we sample schools of different sizes and equipment ages and record where practice differs from the central standard.

Backups and the school day

Recover statements ask whether the systems a school day depends on can be restored and how fast. We test restores and record the date and the time taken.

1 Name the contacts Primary and alternate, sent to the ministry CISO 2 Agree scope and roles Schools, systems, Assessor and Approver 3 Interviews and evidence Evidence stays at the board 4 Rate in the CMA Tool Level 0 to Level 5, six NIST functions 5 Approve the summary Primary contact signs, within 30 business days 6 Plan the gaps Next assessment within two years
The path from naming a cyber contact to the board's approved summary.

Student digital information under O. Reg. 52/26

Every Ontario school board is a prescribed board for the digital information of its students under O. Reg. 52/26. When personal digital information about an enrolled student will be disclosed to the owner or operator of a software application the board uses for its Education Act duties, or acquires for students, the board gives written notice: to a parent or guardian for students under 16, and to the student at 16 and 17.2

Each notice names the data elements, the legal authority, the purpose, the application and its operator, a contact person at the board, and the rights of the student or parent.2 The government's guidance confirms it applies to school boards only.4 Counsel drafts the notices. Our part is the inventory of applications that receive student data, what each receives and who can reach it, which also serves the maturity assessment and any later breach review.

After an incident: two reports, two recipients

A serious cyber incident at a school board can trigger two separate reports, to two different offices, on two different clocks. Under O. Reg. 51/26, a critical cyber security incident goes to the ministry CISO within 72 hours of confirmation; from 1 January 2027, MFIPPA also requires a report to the Information and Privacy Commissioner when stolen, lost or misused personal information creates a real risk of significant harm.17

The regulation states that its reporting rule leaves other legal obligations in place.1 The triggers differ, so one incident can meet both, one or neither. Under MFIPPA the board also notifies the people affected, tells them they may complain to the Commissioner, and keeps a record of every such breach.7

After an incident, our incident response team helps gather the facts; the board files the reports.

One incident, two possible reports
QuestionO. Reg. 51/26, s. 7MFIPPA, s. 30.1 (from 1 January 2027)
What triggers itImpact on digital information or infrastructure, plus one criterion: major disruption of services, a public safety risk, a significant recovery effort or an activated response plan, serious harm to public confidenceTheft, loss, or unauthorized use or disclosure of personal information with a real risk of significant harm
Who receives itThe Chief Information Security Officer of the ministryThe Information and Privacy Commissioner of Ontario, plus notice to each person affected
WhenAs soon as reasonably practical, within 72 hours of confirmationAs soon as feasible after the board determines the breach occurred
Source17

How the assessment runs with a school board

We prepare the assessment in four stages after a signed scope letter, and the board keeps every decision. The calendar depends on the number of schools and systems in scope, and we set it in the scope letter. Starting a full term before 1 July 2027 leaves room to fix early findings before the summary is approved.

A board that completed an assessment in the year before 1 July 2026 may elect to treat it as the initial one under s. 5 (2).1 We then review that earlier work against what the summary must contain.

1. Scope and roles

We agree on the systems and schools in scope, on who acts as Contact Manager, Assessor and Approver in the CMA Tool, and on whether the board submits through the tool or sends its own summary.5

2. Interviews and evidence

We talk with IT, the business office, the privacy lead and a sample of principals. Evidence stays at the board; the tool asks only where it is stored.6

3. Ratings and draft summary

Every statement gets a draft rating with its reason, and we walk the approver through the draft before anything is final.

4. Gap plan

Each gap receives a priority, an owner and a target date, sorted into today, this school year and later, ahead of the next assessment due within two years.1

What the board has in hand afterwards

At the end the board holds a plain-language maturity report and everything its primary contact needs to approve and submit the summary, which the board files itself.

  • A maturity report in plain language for trustees and senior staff, with a technical appendix for IT
  • A rating and a written reason for every statement, ready to enter in the CMA Tool
  • A draft summary with the four contents s. 6 requires: method, framework, overall score, areas for improvement1
  • A list of gaps by priority, with owners and target dates
  • An inventory of applications that receive student data, when it is part of the scope
  • A one-page map of who reports what to whom after an incident

Why a contracted team: the risks of doing it alone, with a chatbot or a freelancer

A board that runs the assessment alone ends up rating its own work, while Cyber Security Ontario recommends keeping the approver separate from the assessor.5 An outside team adds a second view and a written reason under each rating.

A chatbot can explain NIST terms, yet it has no view of your accounts, backups or schools, and pasting configurations or student details into a public tool raises a disclosure question under MFIPPA. A single freelancer leaves the board depending on one person across a two-year cycle, often without a written scope, insurance or a successor.

We work under a scope letter, carry commercial general liability insurance, and hand over a report the board owns, ready for the next cycle.

Five plain reasons to trust us with this

  • A registered Canadian company

    INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.

  • In practice since 2013

    The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.

  • We run servers of our own

    Our own servers and more than 80 websites are checked for known vulnerabilities every day.

  • Insured

    Commercial general liability insurance of CAD 1 million is in force.

  • Your scope, your report

    A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

  1. Step 1

    We agree what to check

    A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

  2. Step 2

    You sign the scope letter

    It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

  3. Step 3

    We check, and write it down

    One report in plain words for you, with the technical detail attached for whoever looks after your systems.

  4. Step 4

    We fix it

    We make the repairs ourselves, or together with your current IT provider or web developer.

  5. Step 5

    We check again

    A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

  • A fixed quote once the scope is agreed
  • The price in writing before work starts
  • A second check after the fixes
Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

Are school boards covered by O. Reg. 51/26?
Yes. Section 2 of O. Reg. 51/26 lists a school board among the prescribed public sector entities, and the Act defines a school board by reference to the Education Act. The duties apply from 1 July 2026: a cyber security program, a senior primary contact and an alternate, critical incident reports within 72 hours, and a first cyber security maturity assessment within one year, which means by 1 July 2027.
When is a school board's first cyber security maturity assessment due?
By 1 July 2027 at the latest, one year after the regulation first applied to school boards. The next assessment is due by the second anniversary of the first and at least once in every two-year period after that. A board that completed an assessment in the year before 1 July 2026 may elect to count it as the initial one.
What about student digital information obligations?
O. Reg. 52/26 applies to every school board from 1 July 2026. When personal digital information about an enrolled student will be disclosed to the owner or operator of a software application, the board gives written notice to a parent or guardian, or to the student at 16 or 17. Counsel drafts the notices; we map which applications receive which student data and how access is controlled.
Can several boards share one assessment approach?
Yes for the method, and each board still completes its own assessment. The regulation places the duty on each prescribed entity, and each summary is approved by that board's own primary contact. Boards can share our framework, interview plan and report layout, with separate findings and a scope letter for each board.
Do you work with French-language boards?
Yes. We work in French and in English, and interviews, reports and the plain-language summary can be in French from the start. The Ontario CMA Tool also lets users switch between French and English, so ratings and the approved summary can stay in the board's working language.
Do we have to report cyber incidents within 72 hours?
For critical cyber security incidents, yes. O. Reg. 51/26 requires a report to the ministry's Chief Information Security Officer as soon as reasonably practical and no later than 72 hours after the board confirms the incident. An incident is critical when it affects digital information or infrastructure and meets one of four criteria, such as a significant disruption of public services or a risk to public safety.
Does the provider submit the assessment summary to the Ministry for us?
The board submits it. Section 6 requires the summary to be approved by the board's primary point of contact and sent to the ministry CISO within 30 business days of completing the assessment. We prepare the draft summary and explain each score to the approver before the board files it.
How much does a school board cyber maturity assessment cost?
The price depends on the number of schools and systems in scope, the documentation that already exists, the number of interviews, and whether the student application inventory is included. After a 30-minute conversation we send a scope letter with a fixed price, so the board knows the full amount before any work starts.

Read this next

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

  • Same day callback
  • Written permission first
  • Fixed quote

Ask us to call you back

Leave your name and number. A real person calls you back the same business day, usually within an hour.

We use your number to call you back about your request. Nothing else.

Call me back