itopsi
Pricing
About
Contact
FrançaisCall me back
Ontario public sector

O. Reg. 51/26 cyber security maturity assessment for Ontario’s public sector

The cyber security maturity assessment Ontario now requires comes from O. Reg. 51/26, in force since 1 July 2026. School boards, colleges, universities, children’s aid societies, Group A, B and C public hospitals and the University of Ottawa Heart Institute must complete a first assessment by 1 July 2027, then one every two years.1 We prepare it with your team and help close the gaps it finds.

Ask us to call you backBook the free audit
An empty meeting room with grey and green chairs around a white table, a closed laptop and glasses of water set out, bare trees outside the window
Most of a maturity assessment happens in interviews with the people who run each area.

A person here calls you back the same business day, usually within an hour.

  • Written permission first
  • A report in plain words
  • Checked again after the fix

Who must comply with O. Reg. 51/26

Five kinds of Ontario public sector entity must comply with the 2026 cyber security regulation, O. Reg. 51/26: school boards, educational institutions as defined in the Freedom of Information and Protection of Privacy Act (colleges and universities), public hospitals graded Group A, B or C under the Public Hospitals Act, the University of Ottawa Heart Institute, and children’s aid societies.1 The provincial guidance adds that Indigenous child and family well-being agencies count as children’s aid societies, and that private hospitals are outside the rule.56

Municipalities are absent from the list. The parent Act defines “public sector entity” broadly enough to include municipal institutions, so the province could prescribe more bodies later; for now a city, town or local board that wants the same discipline can run the assessment voluntarily, and the provincial CMA Tool is open to municipalities.37 Each sector has its own page with the details that differ: hospitals, school boards, colleges and universities and children’s aid societies.

Who O. Reg. 51/26 covers, as of the e-Laws consolidation current to 20 October 2026
OrganizationStatus under O. Reg. 51/26Source
School boardsPrescribed (s. 2, para. 5)1
Colleges and universitiesPrescribed as educational institutions under FIPPA (s. 2, para. 1)1
Public hospitals, Groups A, B and CPrescribed (s. 2, para. 2); the ministry calls them public acute care hospitals16
University of Ottawa Heart InstitutePrescribed by name (s. 2, para. 3)1
Children’s aid societiesPrescribed (s. 2, para. 4), Indigenous child and family well-being agencies included15
Private hospitalsOutside the regulation6
Municipalities and local boardsOutside the regulation; voluntary assessment possible17

What the regulation requires: a program, two contacts, an assessment and incident reports

Every covered entity must run a cyber security program that meets at least four requirements: two named senior contacts, a maturity assessment on a fixed cycle, a summary of each assessment sent to the Ministry, and a report of any critical cyber security incident within 72 hours.1 The Ministry here is Public and Business Service Delivery and Procurement, and its Chief Information Security Officer receives everything.5

  • Program (s. 3). Develop and implement a program for ensuring cyber security that satisfies, at a minimum, the rest of the regulation.1
  • Primary point of contact and alternate (s. 4). Two employees in senior management with decision-making authority over cyber security. The primary contact speaks with the Ministry and approves assessment summaries. Their names, titles, phone numbers and email addresses go to the Ministry’s CISO, and any change must follow within 10 business days.1
  • Cyber security maturity assessment (s. 5). An assessment carried out under industry standards or best practices endorsed by the Ministry’s CISO, on the cycle described in the next section.1
  • Assessment summary (s. 6). Within 30 business days of finishing, a summary with the method used, the name of the model or framework, an overall maturity score with any other scores, and the areas for improvement. The primary contact approves it.1
  • Critical cyber security incident report (s. 7). As soon as reasonably practical and no later than 72 hours after the entity confirms the incident. The report lists the contacts, the overseeing ministry, dates and times, a description and the type of information affected.1

Deadlines: 1 July 2027, then every two years

The first cyber security maturity assessment is due no later than one year after the regulation first applies to the entity, which for every sector on the list means by 1 July 2027. The next one is due by the second anniversary of the first, and at least once in every two-year period after that.16

An entity that already finished an assessment in the year before 1 July 2026 may elect to treat it as the initial one; the regulation then deems it completed on 1 July 2026 for the two-year clock and for the summary.1 The provincial guidance adds that such an earlier assessment must follow a framework the Ministry’s CISO approves, NIST CSF 2.0 being the example it gives.6

Every clock in O. Reg. 51/26
ObligationDeadlineSection
Name a primary contact and an alternateIn place from 1 July 2026; changes reported within 10 business dayss. 4 1
First maturity assessmentBy 1 July 2027s. 5 (1) (a) 1
Assessment summary to the Ministry’s CISOWithin 30 business days of each assessments. 6 1
Next assessmentsBy the second anniversary of the first, then at least once every two yearss. 5 (1) (b) 1
Critical incident reportWithin 72 hours of confirmations. 7 (3) 1
2024 The Act passes Enhancing Digital Security and Trust Act 23 March 2026 O. Reg. 51/26 is filed The cyber security rules for the sector 1 July 2026 The rules take effect A point of contact, incident reporting By 1 July 2027 First maturity assessment Summary to the Ministry within 30 business days. Then every two years
From the Act to the first assessment summary: the dates set by O. Reg. 51/26.

Bill 194 and the Enhancing Digital Security and Trust Act

Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, received Royal Assent as chapter 24 of the Statutes of Ontario 2024; its Schedule 1 enacted the Enhancing Digital Security and Trust Act, 2024.43 That Act came into force on 29 January 2025 and lets the province make regulations on cyber security at prescribed public sector entities. O. Reg. 51/26 is the first of them: made on 12 March 2026, filed on 23 March 2026 and in force from 1 July 2026.32

A companion regulation, O. Reg. 52/26, deals with how school boards share students’ digital information with software providers; it applies to school boards only.5 Together, the bill, the Act and the regulation make up Ontario’s cyber security requirements for the broader public sector.

What the Ontario CMA measures and how it scores

The provincial Cyber Security Maturity Assessment Tool rates an organization against the six functions of NIST Cybersecurity Framework 2.0 with Ontario-specific adaptations: Govern, Identify, Protect, Detect, Respond and Recover.79 The standard assessment holds more than 100 outcome statements, each rated from Level 0 (non-existent) to Level 5 (optimized), on a scale aligned with CMMI maturity levels.78

Covered entities must submit an assessment, and they may complete it in the provincial tool or send the Ministry’s CISO a summary of an assessment done another way.8 The tool produces a downloadable summary with an overall rating and category ratings; evidence stays with the organization and is described only in general terms. Records submitted through the tool to meet the Act are excluded from FIPPA access requests from 1 July 2026.786

  • Assessor and approver: one person gathers information and enters the ratings; a manager, ideally someone else, approves the result and decides on submission.7

How we run a cyber security maturity assessment with your team

We run the assessment as a short, scoped project that ends with ratings your approver can defend and a plan the board can fund. Your organization keeps every decision the regulation gives it: the primary contact approves the summary and the entity submits it.1

1. Scope letter and roles

We agree in writing which systems, sites and departments are in scope, who acts as assessor, approver and contact manager, the dates of the interviews and what we must leave untouched. Work starts once the letter is signed.

2. Interviews and evidence

We interview IT, operations, privacy and leadership against each of the six functions, and we look at the evidence behind every answer: policies, account settings, backup restore records, patch status, supplier access.

3. Ratings you can explain

Each statement gets a rating from 0 to 5 with a one-line reason. An answer that rests on an untested belief, such as a backup nobody has restored, is marked as such.

4. Summary and improvement plan

We draft the summary in the shape section 6 asks for, and a separate plan that turns every gap into a task with an owner, an order and a rough effort. Your primary contact reviews both before anything leaves the building.

5. Closing the gaps

If you want, we then do the technical work ourselves: security audit, email protection, backups tested by restore, staff phishing training, and a retest of what we fixed.

What your organization has in hand afterwards

Your organization ends the engagement with five documents it owns and can reuse for the next cycle.

  • A maturity report in plain language for the board and senior leadership, with the overall score and the score by function.
  • A technical appendix with every statement, its rating, the reason and where the evidence sits.
  • A list of gaps ranked by risk: what to fix this month, this year, and before the next assessment.
  • A work plan with owners and realistic dates, written so a funding request can quote it.
  • A draft of the assessment summary in the form O. Reg. 51/26 sets out, ready for your primary contact to approve and submit.1

Why a contracted team: the risks of doing it alone, with a chatbot or a freelancer

A self-rating done in a hurry tends to score what the organization intends, and the gap shows only after an incident, when the summary is already on file with the Ministry. Public sector IT teams are usually stretched, and the assessment lands on top of their daily work.

General-purpose chatbots produce fluent answers about NIST CSF and invent section numbers with equal fluency; pasting your configurations or incident history into one also moves sensitive information outside your control. A single freelancer can be capable and still disappear between the assessment and the remediation, with no insurance, no signed scope and no one to call during the 72-hour reporting window.

A contracted team gives you a signed scope, a named counterpart, a report that belongs to you and the same people available when the improvement plan turns into work.

In this part of the section

Five plain reasons to trust us with this

  • A registered Canadian company

    INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.

  • In practice since 2013

    The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.

  • We run servers of our own

    Our own servers and more than 80 websites are checked for known vulnerabilities every day.

  • Insured

    Commercial general liability insurance of CAD 1 million is in force.

  • Your scope, your report

    A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

  1. Step 1

    We agree what to check

    A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

  2. Step 2

    You sign the scope letter

    It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

  3. Step 3

    We check, and write it down

    One report in plain words for you, with the technical detail attached for whoever looks after your systems.

  4. Step 4

    We fix it

    We make the repairs ourselves, or together with your current IT provider or web developer.

  5. Step 5

    We check again

    A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

  • A fixed quote once the scope is agreed
  • The price in writing before work starts
  • A second check after the fixes
Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

Which organizations are covered by O. Reg. 51/26?
Five kinds of Ontario public sector entity: school boards, colleges and universities defined as educational institutions under FIPPA, public hospitals graded Group A, B or C under the Public Hospitals Act, the University of Ottawa Heart Institute, and children’s aid societies, including Indigenous child and family well-being agencies. Private hospitals and municipalities sit outside the regulation, though municipalities may use the provincial assessment tool voluntarily.
When is the first cyber security maturity assessment due?
By 1 July 2027 for every covered sector, because the regulation first applied on 1 July 2026 and gives one year. A summary must reach the Ministry’s Chief Information Security Officer within 30 business days of finishing. The next assessment is due by the second anniversary of the first, then at least once in every two-year period.
What is the Ontario CMA and is it aligned with NIST CSF 2.0?
The CMA is the cyber security maturity assessment the regulation requires. The provincial CMA Tool is built on NIST Cybersecurity Framework 2.0 with Ontario-specific adaptations, covering Govern, Identify, Protect, Detect, Respond and Recover. It holds more than 100 statements rated from Level 0 to Level 5. Organizations may also assess outside the tool if the framework is one the Ministry’s CISO approves.
Who must be the designated cyber security point of contact?
An employee in a senior management position with decision-making authority over cyber security. The entity names a primary contact and an alternate, sends their name, title, phone and email to the Ministry’s Chief Information Security Officer, and reports any change within 10 business days. The primary contact communicates with the Ministry and approves each assessment summary.
Do we have to report cyber incidents within 72 hours?
Critical cyber security incidents, yes: as soon as reasonably practical and no later than 72 hours after you confirm one. An incident is critical when it affects your digital information or infrastructure and seriously disrupts public services, risks public safety, needs significant recovery effort or activates your response plan, or threatens public confidence. Other duties, such as privacy breach notices, still apply.
Can an outside provider prepare the assessment summary for the Ministry?
A provider can run the assessment and draft the summary, and that is a common way to get it done on time. The regulation still puts approval with your primary point of contact, and the entity itself submits the summary to the Ministry’s Chief Information Security Officer. We prepare the draft and the evidence trail; your organization approves and files it.
What is Bill 194 in Ontario?
Bill 194 is the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024. It became chapter 24 of the Statutes of Ontario 2024, and its first schedule enacted the Enhancing Digital Security and Trust Act, 2024, in force since 29 January 2025. O. Reg. 51/26, the cyber security regulation, was made under that Act and took effect on 1 July 2026.
How much does an O. Reg. 51/26 assessment cost?
The price depends on the number of sites and systems in scope, how much evidence already exists, how many people we interview, and whether you also want us to close the gaps afterwards. After a 30-minute conversation we send a scope letter with one fixed price for the agreed work, so the figure your board approves is the figure you pay.

Read this next

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

  • Same day callback
  • Written permission first
  • Fixed quote

Ask us to call you back

Leave your name and number. A real person calls you back the same business day, usually within an hour.

We use your number to call you back about your request. Nothing else.

Call me back