Cybersecurity Canada — Free Assessment & Resources for Canadian Businesses

What cybersecurity standards apply to Canadian small businesses?

The Canadian Centre for Cyber Security publishes the Baseline Cyber Security Controls for Small and Medium Organizations (ITSM.10.089), which defines 13 control areas as the minimum recommended security standard for Canadian SMBs. These controls cover incident response, patch management, authentication, data backup, network security, and more. Additionally, businesses that handle personal information must comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), which requires organizations to protect personal data and report breaches to the Office of the Privacy Commissioner of Canada.

Is there a free cybersecurity assessment for Canadian businesses?

Yes. While we are not affiliated with the Canadian Centre for Cyber Security, this free online cybersecurity assessment is based on the Canadian Centre for Cyber Security's 13 Baseline Controls. The assessment includes 50 questions, takes under 30 minutes, and provides an overall compliance score, letter grade, detailed breakdown by control area, and actionable recommendations. The tool is 100% confidential — all processing happens in your browser and no data is transmitted or stored.

What are the 13 Baseline Cyber Security Controls for Canadian organizations?

The 13 Baseline Controls defined by the Canadian Centre for Cyber Security are: (1) Incident Response Planning, (2) Patch Management, (3) Anti-Malware, (4) Secure Configuration, (5) Authentication, (6) Security Awareness Training, (7) Data Backup and Recovery, (8) Mobile Device Security, (9) Network and Perimeter Security, (10) Cloud Services Security, (11) Web Application Security, (12) Access Control and Authorization, and (13) Portable Media Security. These controls are designed to provide 80% of the security benefit from 20% of the effort, making them practical for organizations with limited resources.

How do I report a cyber incident in Canada?

Canadian organizations can report cyber incidents to the Canadian Centre for Cyber Security, which provides guidance and assistance during active incidents. Fraud and phishing should be reported to the Canadian Anti-Fraud Centre (CAFC) at 1-888-495-8501. If a breach involves personal information, organizations are required under PIPEDA to report to the Office of the Privacy Commissioner of Canada and notify affected individuals.

What is Cybersecurity Canada?

Cybersecurity Canada (cybersecuritycanada.ca) is a free, independent resource that helps Canadian businesses assess and improve their cybersecurity posture. It provides a free online assessment based on the Canadian Centre for Cyber Security's 13 Baseline Controls, along with news, guides, a glossary, and curated government resources. The site is built by Cyber Unit, a Canadian cybersecurity company, and does not collect user data.

How can I check my business's cybersecurity in Canada?

You can evaluate your organization's cybersecurity posture using the free assessment at cybersecuritycanada.ca. The tool measures your security across the 13 Baseline Controls defined by the Canadian Centre for Cyber Security, takes under 30 minutes, and runs entirely in your browser with no data collection. You receive a score, letter grade, and specific recommendations for each control area.

Is cybersecurity mandatory for Canadian businesses?

While Canada does not mandate specific cybersecurity measures for all businesses, the Personal Information Protection and Electronic Documents Act (PIPEDA) requires organizations that handle personal information to implement appropriate security safeguards and report breaches. The Canadian Centre for Cyber Security's Baseline Controls represent the Government of Canada's recommended minimum standard. Bill C-26 (Critical Cyber Systems Protection Act) introduces additional requirements for federally regulated operators of critical infrastructure.

What government cybersecurity resources are available for Canadian businesses?

The Canadian Centre for Cyber Security (cyber.gc.ca) publishes the Baseline Cyber Security Controls for Small and Medium Organizations, alerts and advisories, and guidance publications. The Get Cyber Safe campaign (getcybersafe.gc.ca) provides public awareness resources. Cybersecurity Canada (cybersecuritycanada.ca) curates these resources and provides a free assessment tool based on the CCCS Baseline Controls.