October 12, 2026 Guide 7 min read

Cybersecurity Grants and Funding for Canadian Small Businesses (2026)

By Cybersecurity Canada Editorial Team | Published October 12, 2026

There is no single federal "cybersecurity grant" in Canada. The Canada Digital Adoption Program (CDAP), which helped cover digital transformation costs, closed to new applicants in 2024. What remains is a mix of innovation funding (NRC IRAP), provincial training grants, free government resources, and one active certification program. This guide covers only programs confirmed active on official government pages as of October 2026.

Before applying to any program listed below, check the official page directly. Eligibility requirements, funding levels, and application windows change without notice.

Federal Programs

NRC Industrial Research Assistance Program (NRC IRAP)

The National Research Council Industrial Research Assistance Program is Canada's leading innovation support program for small and medium businesses. It provides advisory services, connections, and in some cases funding for technology development, including cybersecurity.

Who qualifies: Canadian businesses that are incorporated, for-profit, operating in Canada, with up to 500 employees, and developing innovative, technology-driven products or services. Meeting these criteria does not guarantee funding.

What it covers: IRAP can fund research and development of innovative products and services. IRAP's 2026 program materials specifically list cybersecurity as an eligible funding area.

How to access: Contact NRC IRAP at 1-877-994-4727. An advisor will assess your business needs and determine whether IRAP support is appropriate. Funding decisions depend on the technical merit, commercialization potential, and benefits to Canada.

Official page: nrc.canada.ca/en/support-technology-innovation

In-Sec-M SME Cyber Security Support (via NRC IRAP)

In-Sec-M, Canada's national cybersecurity industry cluster, partners with NRC IRAP to provide cybersecurity consulting for qualifying small and medium businesses.

Who qualifies: Existing NRC IRAP clients only. You must first be accepted into the IRAP program.

What it covers: Personalized consulting including vulnerability assessments, compliance coaching, incident response planning, and cybersecurity best practices. Services are delivered through 25-hour engagements.

How to access: Ask your IRAP advisor about In-Sec-M support, or contact In-Sec-M directly through their IRAP support page.

CyberSecure Canada Certification (Not a Grant)

CyberSecure Canada is a federal certification program, not a funding program. Businesses that implement the 13 Canadian Centre for Cyber Security baseline controls can obtain a two-year certification mark through an accredited certification body.

Who qualifies: Any Canadian organization that has implemented the 13 baseline controls and is willing to undergo a third-party audit.

What it costs: Businesses pay the certification body directly for the audit. Costs vary by organization size and complexity. This is not a free or subsidized program.

How to access: Implement the 13 baseline controls, then contact an SCC-accredited certification body to arrange an audit. ISED transferred program authority to the Standards Council of Canada as of March 31, 2023.

Our guide to CyberSecure Canada certification explains the four-step process.

Canada Digital Adoption Program: Closed

The Canada Digital Adoption Program (CDAP) is no longer accepting new applications.

• Boost Your Business Technology (up to $15,000 grant + $100,000 interest-free loan): Closed to new applications February 19, 2024. BDC confirms that only businesses with valid, signed grant agreements before that date remain eligible.
• Grow Your Business Online (up to $2,400 microgrant): Closed to new applications September 30, 2024.

ISED moved CDAP to its "past programs" list in December 2025. No reopening or successor program has been announced. If your business signed a grant agreement before the closure, check with your advisor about remaining deadlines.

Provincial and Regional Programs

Ontario: Rogers Cybersecure Catalyst Programs (Free)

Rogers Cybersecure Catalyst, operated by Toronto Metropolitan University with funding from the Government of Ontario, offers free cybersecurity programs for eligible Ontario businesses.

Cyber Roadmap

A free self-assessment and consultation program that provides a personalized cybersecurity report and one-on-one advisory session.

• Who qualifies: Ontario-based small and medium businesses (under 500 employees) in automotive, life sciences/digital health, advanced manufacturing, smart infrastructure, mining, or agri-food sectors.
• What you get: Online self-assessment, personalized report, and a 30-minute consultation with a senior cybersecurity advisor.
• Cost: Free, funded by the Government of Ontario.

Cyber Integration for Businesses

Sector-specific training and bootcamps for professionals responsible for cybersecurity, digital risk management, or IT operations.

• Who qualifies: Staff employed in Ontario, working in or supporting key economic sectors.
• What you get: Webinars, six-week bootcamps, and access to Cyber Roadmap assessments.
• Cost: Free, funded by the Government of Ontario.

Official page: cybersecurecatalyst.ca

British Columbia: Employer Training Grant

The B.C. Employer Training Grant provides funding for employers to train employees, including in cybersecurity skills.

• Who qualifies: B.C. employers of all sizes, including self-employed individuals.
• What it covers: Up to 80% of eligible training costs, to a maximum of $10,000 per participant per fiscal year. Employers can receive up to $300,000 per fiscal year.
• What qualifies as training: Cybersecurity training from an independent training provider that delivers training as a main business activity. The training must be relevant to current or future job duties.
• How to apply: Training must start on or after your application date. Apply through WorkBC.

Official page: workbc.ca/employer-resources/bc-employer-training-grant

Quebec: ESSOR Program (Digital Transformation)

Quebec's ESSOR program from Investissement Quebec can support digital transformation projects, including cybersecurity improvements.

• Volet 1B (Diagnostic/Digital Plan): Up to $20,000 (50% of eligible expenses) for a digital assessment or plan.
• Volet 1C (Implementation): Up to $50,000 (50% of eligible expenses) for implementing digital projects.
• Program status: Active until March 31, 2027. Check the Investissement Quebec ESSOR page for current eligibility and application details.

Cybersecurity improvements may qualify as part of a broader digital transformation project. Contact Investissement Quebec to confirm eligibility for your specific project.

Other Provinces

Check your provincial government's economic development or small business website for current programs. Programs change frequently, and some regions offer cybersecurity-specific support through economic development agencies or industry clusters.

Free Government Resources (No Application Required)

Several government resources are available at no cost and require no application process.

Canadian Centre for Cyber Security

The CCCS provides free guidance including:

• Baseline Cyber Security Controls for Small and Medium Organizations (ITSM.10.089): The 13 controls that form the minimum recommended standard for Canadian SMBs.
• Learning Hub: Free eLearning including Course 625 on cybersecurity for small and medium organizations.
• Alerts and Advisories: Current threat information and security bulletins.

Get Cyber Safe

Get Cyber Safe is the Government of Canada's public awareness campaign. It provides free guides, tips, and training materials for individuals and businesses. October is Cyber Security Awareness Month, with additional resources released throughout the month.

Cybersecurity Canada Free Assessment

Our free cybersecurity assessment evaluates your organization against all 13 CCCS Baseline Controls. The assessment takes under 30 minutes, runs entirely in your browser, and your answers are never transmitted or stored. You receive a score, letter grade, and prioritized recommendations.

See our full resources page for additional free programs and government links.

What Should Canadian Small Businesses Do?

The absence of a dedicated federal cybersecurity grant does not mean you need to wait for funding before improving your security posture. Many of the CCCS Baseline Controls can be implemented at low or no cost:

1. Enable multi-factor authentication on email, cloud services, and remote access (BC.5).
2. Turn on automatic updates for operating systems and critical software (BC.2).
3. Verify your backups are running and test that you can restore from them (BC.7).
4. Train your team to recognize phishing using free Get Cyber Safe materials (BC.6).
5. Document an incident response plan so you know who to call if something goes wrong (BC.1).

If your business qualifies for NRC IRAP or provincial training grants, those programs can help fund more substantial security improvements. But the first steps toward better security cost time, not money.

Start with the free assessment to identify where your business stands on each of the 13 controls.

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). Cybersecurity Grants and Funding for Canadian Small Businesses (2026). Retrieved from https://cybersecuritycanada.ca/news/posts/cybersecurity-grants-funding-canadian-small-businesses-2026/

Permanent URL: https://cybersecuritycanada.ca/news/posts/cybersecurity-grants-funding-canadian-small-businesses-2026/ · Published October 12, 2026