Canada's 13 Baseline Cyber Security Controls

The Canadian Centre for Cyber Security (CCCS) publishes the Baseline Cyber Security Controls for Small and Medium Organizations as the minimum recommended security standard for Canadian businesses. Cybersecurity Canada explains each control and offers a free assessment tool so you can measure your organization against these standards. The controls are designed using the 80/20 principle, achieving 80% of the security benefit from 20% of the effort, making them practical for organizations with limited cybersecurity resources.

Each control area below includes an overview of what the CCCS guidance recommends, why it matters for Canadian businesses, and how to get started. Our free assessment tool evaluates your organization across all 13 control areas. For a printable overview, see our cybersecurity assessment checklist.