Cybersecurity Assessment Checklist for Canadian Businesses

This checklist helps Canadian small and medium businesses evaluate their cybersecurity practices against the 13 Baseline Controls published by the Canadian Centre for Cyber Security in ITSM.10.089. Use it as a starting point for your security review, then take the free Cybersecurity Canada assessment to receive a detailed score and tailored recommendations.

BC.1: Develop an Incident Response Plan

Organizations should assume cyber incidents will occur and have a documented plan for detection, response, and recovery. Learn more about incident response planning.

• We have a written plan for responding to cyber incidents of varying severity (ITSM.10.089 section 3.1)
• Our plan includes contact information for external parties, stakeholders, and regulators
• We maintain a hard copy of the incident response plan for situations where digital copies are unavailable
• We have considered purchasing cyber insurance that covers incident response and recovery

BC.2: Automatically Patch Operating Systems and Applications

Software updates address security vulnerabilities. Enable automatic patching wherever possible. Learn more about patch management.

• Automatic updates are enabled for all operating systems (ITSM.10.089 section 3.2)
• Automatic updates are enabled for all applications and software
• We have replaced or have a plan to replace software past its end of life (no longer receiving updates)
• Devices without automatic update capability have a documented manual update process

BC.3: Enable Security Software

Anti-malware software protects against viruses, ransomware, and other malicious software. Learn more about security software.

• Anti-malware solutions are installed on all devices (ITSM.10.089 section 3.3)
• Anti-malware software is configured to update automatically
• Anti-malware software is configured to scan automatically
• Software firewalls are enabled on all devices within organizational networks

BC.4: Securely Configure Devices

Default settings and passwords often introduce security risks. Learn more about secure configuration.

• All default administrative passwords have been changed (ITSM.10.089 section 3.4)
• Unnecessary features and services have been disabled on all devices
• All relevant security features have been enabled

BC.5: Use Strong User Authentication

Two-factor authentication significantly reduces the risk of account compromise. Learn more about authentication.

• Two-factor authentication is enabled wherever possible (ITSM.10.089 section 3.5)
• Two-factor authentication is required for critical accounts: financial, administrative, cloud, and executive
• We have clear policies on password length and reuse, use of password managers, and when and how passwords may be written down and stored securely
• Password changes are only enforced on suspicion or evidence of compromise
• We have documented any business decisions not to implement two-factor authentication

BC.6: Provide Employee Awareness Training

Employees are a critical line of defence against phishing and social engineering. Learn more about security awareness training.

• All employees receive cybersecurity awareness training (ITSM.10.089 section 3.6)
• Training covers how to identify malicious emails and links
• Training covers password policies and safe use of the internet
• Training covers use of approved software and safe use of social media

BC.7: Backup and Encrypt Data

Regular backups ensure you can recover from ransomware, equipment failure, or disaster. Learn more about backup and recovery.

• All systems containing essential business information are backed up (ITSM.10.089 section 3.7)
• We have verified that backups can be restored effectively
• Long-term backups (weekly or less frequent) are stored offline
• Backups are encrypted and access is restricted to authorized personnel
• We store backups at a secure offsite location or via cloud services

BC.8: Secure Mobility

Mobile devices require specific security measures whether company-owned or employee-owned. Learn more about mobile security.

• We have decided on an ownership model for mobile devices and documented the rationale (ITSM.10.089 section 3.8)
• Work and personal data are separated on mobile devices with corporate access
• Employees download mobile apps only from approved, trusted sources
• All sensitive information on mobile devices is stored in an encrypted state
• Users are instructed to avoid unknown Wi-Fi networks and disable automatic connections to open networks

BC.9: Establish Basic Perimeter Defences

Firewalls and network security controls protect your organization from external threats. Learn more about perimeter defences.

• Dedicated firewalls exist between the corporate network and the internet (ITSM.10.089 section 3.9)
• A DNS firewall is implemented for outbound DNS requests
• Remote access to corporate networks requires VPN with two-factor authentication
• Only secure Wi-Fi is used, preferably WPA2-Enterprise
• Guest or public Wi-Fi is isolated from corporate networks

BC.10: Secure Cloud and Outsourced IT Services

Cloud providers and outsourced services must meet security standards. Learn more about cloud security.

• Cloud service providers share an AICPA SSAE 18 SOC 3 report showing Trust Service Principles compliance (ITSM.10.089 section 3.10)
• We have evaluated how outsourced providers handle and access our sensitive information
• We have evaluated the legal jurisdictions where providers store or use our data
• All communication with cloud services uses secure connections
• Cloud administrative accounts use two-factor authentication and differ from internal admin accounts

BC.11: Secure Websites

Websites handling sensitive information require security controls against common vulnerabilities. Learn more about web security.

• Our websites meet the OWASP ASVS Level 1 guidelines (ITSM.10.089 section 3.11)
• We have determined the appropriate OWASP ASVS level for each website

Good practice beyond the baseline:

• Websites use HTTPS encryption
• Content management systems and plugins are kept up to date

BC.12: Implement Access Control and Authorization

Users should have only the access they need. Administrator accounts require special restrictions. Learn more about access control.

• Accounts are provisioned with minimum necessary access (ITSM.10.089 section 3.12)
• Administrator privileges are restricted to an as-needed basis
• Administrator accounts are used only for administrative activities, not email or web browsing
• Accounts are removed when employees leave or no longer need access

BC.13: Secure Portable Media

USB drives and portable storage devices can cause data breaches if lost or compromised. Learn more about portable media security.

• Only organization-owned encrypted portable media is permitted (ITSM.10.089 section 3.13)
• Strong asset controls are maintained for all portable storage devices
• Encryption is required on all portable media
• We have documented processes for sanitizing or destroying portable media before disposal

How to Score Yourself

This checklist provides a starting point for evaluating your security practices. For a comprehensive assessment with scoring across all 13 control areas, tailored recommendations, and a downloadable report, take the free Cybersecurity Canada assessment. The assessment includes 50 questions, takes under 30 minutes, and runs entirely in your browser with no data collection.

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). Cybersecurity Assessment Checklist for Canadian Businesses (13 Controls). Retrieved from https://cybersecuritycanada.ca/cybersecurity-assessment-checklist/

Permanent URL: https://cybersecuritycanada.ca/cybersecurity-assessment-checklist/

Frequently Asked Questions

What does a cybersecurity assessment cover in Canada?

A cybersecurity assessment based on Government of Canada guidance evaluates an organization against the 13 Baseline Cyber Security Controls published by the Canadian Centre for Cyber Security in ITSM.10.089. These controls cover incident response planning, automatic patching, security software, secure configuration, user authentication, employee training, data backup, mobile security, network defences, cloud security, website security, access control, and portable media. The assessment identifies gaps and provides recommendations for improvement.

What is the difference between a checklist and a security audit?

A checklist is a self-guided tool for reviewing your practices against a known standard. It helps you identify areas that may need attention but relies on your own assessment of each item. A security audit, by contrast, is typically conducted by an independent third party who verifies your controls through interviews, technical testing, and documentation review. Audits provide formal assurance suitable for regulators, insurers, or certification bodies. This checklist is a useful starting point; a professional audit may be appropriate for organizations seeking certification or contractual compliance.

How often should a business review its cybersecurity controls?

We recommend reviewing your security practices at least annually or whenever significant changes occur in your IT environment, such as new systems, acquisitions, or changes in staff. The CCCS recommends that organizations commit to progressive improvements in cybersecurity (ITSM.10.089 section 2.5). CCCS also recommends regularly verifying that backup and restore mechanisms work (BC.7).

Does CyberSecure Canada certification use the same 13 controls?

Yes. The CyberSecure Canada certification program, now administered by the Standards Council of Canada, is based on the same 13 Baseline Controls defined in ITSM.10.089. Certification requires implementation of these controls, verified by an accredited certification body. This checklist helps you prepare, but certification requires third-party assessment. See our guide on cybersecurity certifications in Canada for more details.