Canada's 13 Baseline Cyber Security Controls

The Canadian Centre for Cyber Security (CCCS) publishes the Baseline Cyber Security Controls for Small and Medium Organizations as the minimum recommended security standard for Canadian businesses. The controls are designed using the 80/20 principle — achieving 80% of the security benefit from 20% of the effort — making them practical for organizations with limited cybersecurity resources.

Each control area below includes an overview of what the CCCS guidance recommends, why it matters for Canadian businesses, and how to get started. Our free assessment tool evaluates your organization across all 13 control areas.