Free Cybersecurity Assessment for Canadian Businesses
Evaluate your organization's security posture against the Canadian Centre for Cyber Security's Baseline Controls. 50 questions, under 30 minutes, completely confidential.
Your answers stay in your browser and are never transmitted. Progress is saved locally for 48 hours.
Three Steps to Better Security
Our assessment is based on the 13 Baseline Cyber Security Controls from the Canadian Centre for Cyber Security.
Answer 50 Questions
Evaluate your organization's readiness and security across 13 baseline control areas defined by the Canadian Centre for Cyber Security.
Get Your Score
Receive an overall compliance percentage, letter grade, and detailed breakdown by control area.
Improve Your Security
Get actionable recommendations for every control area with links to official Canadian government resources.
What We Assess
Based on the Canadian Centre for Cyber Security's Baseline Controls for Small and Medium Organizations.
50 questions · Under 30 minutes · Progress saved for 48 hours
Cybersecurity Canada is an independent resource and is not affiliated with, endorsed by, or connected to the Canadian Centre for Cyber Security, the Communications Security Establishment, or the Government of Canada.
The information provided on this website is for general educational and informational purposes only and does not constitute professional cybersecurity, legal, IT, compliance, or risk management advice. All content, including assessment results, scores, grades, and recommendations, is provided on a best-effort, "as is" basis without warranties of any kind. We expressly disclaim liability for any errors, omissions, or inaccuracies. Organizations should consult with qualified cybersecurity professionals and legal counsel to assess their specific situation. Use of this website or the assessment tool does not create a professional-client relationship. See our Terms of Use for full details.
Free Self-Assessment or Professional Assessment?
This free self-assessment gives you an instant score against Canada's 13 Baseline Controls. It runs entirely in your browser with no data collection and no obligation. For organizations that need a documented, independently verified evaluation, Cyber Unit (the Canadian cybersecurity company that built and maintains Cybersecurity Canada) offers a Professional Security Assessment: analyst-led interviews with your team, hands-on review of your systems and configurations across 20+ security areas, and a written report with executive summary and prioritized roadmap, conducted remotely over Zoom or Teams.
What is the difference between a free self-assessment and a professional cybersecurity assessment?
A free self-assessment is a self-guided questionnaire you complete on your own, producing an instant score based on your answers. It is a useful starting point for understanding your security posture, but it relies entirely on what you report and cannot verify findings. A professional cybersecurity assessment involves structured interviews with your team and hands-on review of your actual systems and configurations by a security analyst, resulting in a formal written report suitable for leadership, insurers, or a board.
Who can do a professional cybersecurity assessment in Canada?
Cyber Unit, the Canadian cybersecurity company that built and maintains Cybersecurity Canada, offers a Professional Security Assessment for Canadian businesses. The assessment includes analyst-led structured interviews with your team, hands-on review of your systems and configurations across 20+ security areas, and a written report with executive summary and prioritized roadmap. A findings walkthrough session is included. The assessment is conducted remotely over Zoom or Teams. The free self-assessment on this site remains free with no obligation.
What should I do after completing the free assessment?
Review your per-control scores to identify the areas with the lowest ratings. Start with the controls that have the greatest impact relative to effort, typically multi-factor authentication, data backup, and patch management. For detailed guidance on interpreting and acting on your results, see How to Use Your Assessment Results. If you need a formal evaluation or documented findings, consider a professional assessment from Cyber Unit.
Common Questions
Is this assessment really free?
Yes, completely free with no strings attached. There is no upsell, no email required, and no data collected. This is a community resource for Canadian businesses.
How long does the assessment take?
Most people complete the 50 questions in under 30 minutes. The assessment auto-advances after each selection, so the process is quick and smooth.
Do I need technical knowledge to take it?
No, but we recommend having your most technical team member available. The questions are written in plain language for business owners and managers. If you're unsure about a question, simply select "None" — you don't need to be a cybersecurity expert.
Is my data private and secure?
Your answers never leave your browser. No data is transmitted to any server, stored in any database, or shared with anyone. Your answers are saved locally in your browser for up to 48 hours so you can resume later or review your results, then automatically deleted. Nothing is ever sent to our servers.
What do I get at the end?
You'll receive an overall compliance score, letter grade (A through F), a visual breakdown of all 13 control areas, top risks requiring attention, and specific recommendations for every question. You can print or save the results.
Who is this assessment designed for?
This assessment is designed for Canadian small and medium businesses (SMBs). It's based on the Canadian Centre for Cyber Security's "Baseline Cyber Security Controls for Small and Medium Organizations" (ITSM.10.089), which is the Government of Canada's recommended security baseline.
Before You Begin
50 questions. 13 Baseline Controls. One clear action plan. This assessment evaluates your organization against the cybersecurity baseline defined by the Canadian Centre for Cyber Security — just answer honestly about your current practices.
The best part? This assessment is built on the 80/20 rule — a few key controls deliver the vast majority of your protection. At the end, you'll get actionable recommendations you can print, download, and share with your team so you know exactly where to focus first.
Tip: Some questions are technical in nature. We recommend having your most technical team member — such as an IT administrator or managed service provider — present or available while completing the assessment. If you're unsure about a question, select "None" — if you can't confirm a security control is in place, it's safest to assume it isn't.
Need more context? Each question has a "What does this mean?" toggle directly beneath it — tap it to see a plain-language explanation of what the question is asking.
Your progress is saved automatically. Your answers are saved locally in your browser for up to 48 hours, so you can close the page and come back to finish later. No data ever leaves your browser.
Cybersecurity Canada is an independent resource and is not affiliated with, endorsed by, or connected to the Canadian Centre for Cyber Security, the Communications Security Establishment, or the Government of Canada.
Educational Use Only: This assessment is an educational self-assessment tool provided free of charge by Cyber Unit Security Inc. for informational purposes only. It is not a security audit, penetration test, compliance certification, or professional consultation. Results, scores, grades, and recommendations are approximate, general in nature, and provided on a best-effort basis. They should not be relied upon as a definitive evaluation of your cybersecurity posture. Cyber Unit Security Inc. accepts no liability for errors, omissions, or any damages arising from the use of this tool or reliance on its results. By proceeding, you agree to our Terms of Use. Read our full Terms of Use.
Cybersecurity Baseline Assessment Report
Based on the Canadian Centre for Cyber Security (CCCS)
Baseline Cyber Security Controls for Small and Medium Organizations
Cybersecurity Canada is an independent resource and is not affiliated with, endorsed by, or connected to the Canadian Centre for Cyber Security, the Communications Security Establishment, or the Government of Canada. For educational purposes only: this report is a general self-assessment provided free of charge on a best-effort basis by Cyber Unit Security Inc. It is not a security audit, compliance certification, or professional consultation. Scores and recommendations are approximate and may contain errors or omissions. No liability is accepted for any damages arising from the use of or reliance on this report. Consult qualified cybersecurity professionals for advice specific to your organization. Full Terms of Use: https://cybersecuritycanada.ca/terms/
Your Cybersecurity Baseline Assessment
Security Breakdown by Control Area
How your organization scored across all control areas
Your report is available for 48 hours. Download the PDF or print to keep a permanent copy.
Detailed Breakdown
Individual scores and recommendations for all 50 questions
Your report is available for 48 hours. Download the PDF or print to keep a permanent copy.
Need a hand with any of this?
This report is yours to keep and act on at your own pace. If you'd like help implementing any of the recommendations or just want to talk through your results, the team at Cyber Unit (cyberunit.com), the people behind this free tool, would be glad to help. No obligation, no pressure.
info@cyberunit.com
Need a hand with any of this?
This report is yours to keep and act on at your own pace. If you'd like help implementing any of the recommendations or just want to talk through your results, the team at Cyber Unit, the people behind this free tool, would be glad to help. No obligation, no pressure.
Learn More at cyber.gc.ca
Visit the Canadian Centre for Cyber Security for the full Baseline Controls document and additional resources for Canadian organizations.