This free self-assessment gives you an instant score against Canada's 13 Baseline Controls. It runs entirely in your browser with no data collection and no obligation. For organizations that need a documented, independently verified evaluation, Cyber Unit (the Canadian cybersecurity company that built and maintains Cybersecurity Canada) offers a Professional Security Assessment: analyst-led interviews with your team, hands-on review of your systems and configurations across 20+ security areas, and a written report with executive summary and prioritized roadmap, conducted remotely over Zoom or Teams.

What is the difference between a free self-assessment and a professional cybersecurity assessment?

A free self-assessment is a self-guided questionnaire you complete on your own, producing an instant score based on your answers. It is a useful starting point for understanding your security posture, but it relies entirely on what you report and cannot verify findings. A professional cybersecurity assessment involves structured interviews with your team and hands-on review of your actual systems and configurations by a security analyst, resulting in a formal written report suitable for leadership, insurers, or a board.

Who can do a professional cybersecurity assessment in Canada?

Cyber Unit, the Canadian cybersecurity company that built and maintains Cybersecurity Canada, offers a Professional Security Assessment for Canadian businesses. The assessment includes analyst-led structured interviews with your team, hands-on review of your systems and configurations across 20+ security areas, and a written report with executive summary and prioritized roadmap. A findings walkthrough session is included. The assessment is conducted remotely over Zoom or Teams. The free self-assessment on this site remains free with no obligation.

What should I do after completing the free assessment?

Review your per-control scores to identify the areas with the lowest ratings. Start with the controls that have the greatest impact relative to effort, typically multi-factor authentication, data backup, and patch management. For detailed guidance on interpreting and acting on your results, see How to Use Your Assessment Results. If you need a formal evaluation or documented findings, consider a professional assessment from Cyber Unit.

What is a cybersecurity assessment?

A cybersecurity assessment (also written as "cyber security assessment") is a structured evaluation of your organization's security practices against a defined standard. In Canada, the most widely recognized standard for small and medium businesses is the 13 Baseline Cyber Security Controls published by the Canadian Centre for Cyber Security. This free self-assessment lets you measure your own readiness across all 13 controls in under 30 minutes. For organizations that need documented findings or third-party verification, professional cybersecurity assessment services provide analyst-led reviews with formal written reports.

Cyber Security Assessment Checklist for Canadian Businesses

A cyber security assessment checklist helps Canadian businesses verify their practices against the Canadian Centre for Cyber Security's Baseline Controls. This free assessment covers all 13 control areas:

1. Develop an Incident Response Plan
2. Automatically Patch Operating Systems and Applications
3. Enable Security Software
4. Securely Configure Devices
5. Use Strong User Authentication
6. Provide Employee Awareness Training
7. Backup and Encrypt Data
8. Secure Mobility
9. Establish Basic Perimeter Defences
10. Secure Cloud and Outsourced IT Services
11. Secure Websites
12. Implement Access Control and Authorization
13. Secure Portable Media

Start the free assessment to receive a score for each control area, a letter grade, and prioritized recommendations you can print or share with your team.

This free cybersecurity self-assessment is available to small and medium businesses anywhere in Canada. It runs entirely online, takes under 30 minutes, and is based on the Canadian Centre for Cyber Security's 13 baseline controls. No signup is required. Businesses in Vancouver, Toronto, Calgary, Montreal, Ottawa and every other Canadian city can complete it today.

Vancouver and British Columbia

This free cybersecurity assessment is available to businesses in Vancouver, the Lower Mainland, and throughout British Columbia. It evaluates your organization against all 13 of the Canadian Centre for Cyber Security's Baseline Controls, covering incident response planning, patch management, multi-factor authentication, data backup and nine other control areas. At the end you receive a score by control area, a letter grade, and a printable report with prioritized recommendations. No signup or email is required, and your answers never leave your browser.

In British Columbia, private-sector organizations that collect, use, or disclose personal information are subject to BC PIPA (the Personal Information Protection Act), enforced by the Office of the Information and Privacy Commissioner for BC. Section 34 of PIPA requires organizations to "protect personal information in its custody or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks." BC PIPA does not currently require private-sector organizations to report breaches to the OIPC or to notify affected individuals, although the OIPC recommends both when a breach could cause significant harm, and treats voluntary reporting as a best practice.

Federally regulated businesses in British Columbia (such as banks, airlines, telecommunications companies, and interprovincial transport) fall under PIPEDA rather than BC PIPA, even when operating within the province. PIPEDA has mandatory breach reporting to the Office of the Privacy Commissioner of Canada when a breach poses a real risk of significant harm. Businesses that operate across provincial or national borders may also be subject to PIPEDA for interprovincial and international activities.

Toronto and Ontario

Businesses in Toronto and the Greater Toronto Area can use this free assessment to evaluate their cybersecurity posture against the Canadian Centre for Cyber Security's 13 baseline controls. The assessment covers incident response planning, patch management, authentication, data backup and nine other control areas. At the end you receive a score by control area, a letter grade and a printable report with recommendations.

Ontario does not have a general private sector privacy law, so PIPEDA (the Personal Information Protection and Electronic Documents Act) applies to commercial activities involving personal information. PIPEDA is enforced by the Office of the Privacy Commissioner of Canada. Organizations that handle personal health information as health information custodians (including physicians, hospitals, pharmacies and labs) must also comply with Ontario's Personal Health Information Protection Act (PHIPA), overseen by the Information and Privacy Commissioner of Ontario. For official guidance, see the OPC summary of privacy laws in Canada and the IPC Ontario page on health privacy rights.

Hamilton, Burlington and the Golden Horseshoe

Businesses in Hamilton, Burlington, Oakville and the rest of the Golden Horseshoe region can take the same free online assessment. Answer 50 questions in under 30 minutes, receive a score for each of the 13 control areas, and download a printable report with prioritized recommendations. No signup or email is required. For a quick overview of what the assessment covers, see our cybersecurity assessment checklist.

Calgary and Alberta

In Alberta, private-sector organizations that collect personal information are subject to Alberta PIPA (the Personal Information Protection Act), enforced by the Office of the Information and Privacy Commissioner of Alberta. Like BC PIPA, it requires organizations to make reasonable security arrangements to protect personal information. For official guidance, see the OIPC Alberta legislation page.

Montreal and Quebec

Quebec businesses handling personal information are subject to the Act respecting the protection of personal information in the private sector, as modernized by Law 25. The Commission d'accès à l'information du Québec oversees compliance. For official guidance, see the CAI guidance for private businesses (in French).

Ottawa

Ottawa businesses follow the same rule as the rest of Ontario: PIPEDA applies to personal information they collect, use or disclose in the course of commercial activities, and it is enforced by the Office of the Privacy Commissioner of Canada. For details, see the OPC PIPEDA page.

For businesses that need a professional, documented review rather than a self-assessment, Cyber Unit offers cybersecurity assessment services, conducted remotely for businesses anywhere in Canada and the US. Cyber Unit's on-site support is available in Metro Vancouver only, with remote support everywhere else in Canada and the US.